OnStartUP - Usenet starting

[dc]

In Process Explorer on startup on one box I show Windows NT Logon
Application using a good deal of processor and also for a very brief period
of time something showsup starting Usenet something and then goes away. But
I then 'suspend' NT logon and the Generic Host Process for Win32 Services
and the CPU settles down. Hope this makes some sense. Does this sound like
there is a possibility I have something running that doesn't showup in the
Processes list of Task Manager?

May be dumb, but the only way to stay that way is 'do nothing'.

Sorry for the bandwidth use.

dc

[pcbutts1]

Download HJT from here
http://www.trendsecure.com/portal/en...hijackthis.php and
post the log, I need to see it.


--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



"dc" <yada@nunya.com> wrote in message
news:46999b4b$0$8839$bbae4d71@news.suddenlink.net. ..
> In Process Explorer on startup on one box I show Windows NT Logon
> Application using a good deal of processor and also for a very brief
> period
> of time something showsup starting Usenet something and then goes away.
> But
> I then 'suspend' NT logon and the Generic Host Process for Win32 Services
> and the CPU settles down. Hope this makes some sense. Does this sound like
> there is a possibility I have something running that doesn't showup in the
> Processes list of Task Manager?
>
> May be dumb, but the only way to stay that way is 'do nothing'.
>
> Sorry for the bandwidth use.
>
> dc
>
>

[dc]

I will as soon as possible...
Okay to zip it as attachment?

dc





"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
news:f7c668$7r5$1@blackhelicopter.databasix.com...
> Download HJT from here
> http://www.trendsecure.com/portal/en...hijackthis.php
and
> post the log, I need to see it.
>
>
> --
>
> Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
> The list grows. Leythos the stalker http://www.leythosthestalker.com,
David
> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
>
>
>
> "dc" <yada@nunya.com> wrote in message
> news:46999b4b$0$8839$bbae4d71@news.suddenlink.net. ..
> > In Process Explorer on startup on one box I show Windows NT Logon
> > Application using a good deal of processor and also for a very brief
> > period
> > of time something showsup starting Usenet something and then goes away.
> > But
> > I then 'suspend' NT logon and the Generic Host Process for Win32
Services
> > and the CPU settles down. Hope this makes some sense. Does this sound
like
> > there is a possibility I have something running that doesn't showup in
the
> > Processes list of Task Manager?
> >
> > May be dumb, but the only way to stay that way is 'do nothing'.
> >
> > Sorry for the bandwidth use.
> >
> > dc
> >
> >
>
>

[pcbutts1]

Just cut and paste it. My news server with strip the attachment in a non
binary group.


--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



"dc" <yada@nunya.com> wrote in message
news:4699ae2d$0$8839$bbae4d71@news.suddenlink.net. ..
>I will as soon as possible...
> Okay to zip it as attachment?
>
> dc
>
>
>
>
>
> "pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
> news:f7c668$7r5$1@blackhelicopter.databasix.com...
>> Download HJT from here
>> http://www.trendsecure.com/portal/en...hijackthis.php
> and
>> post the log, I need to see it.
>>
>>
>> --
>>
>> Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
>> The list grows. Leythos the stalker http://www.leythosthestalker.com,
> David
>> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
>> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
>>
>>
>>
>> "dc" <yada@nunya.com> wrote in message
>> news:46999b4b$0$8839$bbae4d71@news.suddenlink.net. ..
>> > In Process Explorer on startup on one box I show Windows NT Logon
>> > Application using a good deal of processor and also for a very brief
>> > period
>> > of time something showsup starting Usenet something and then goes away.
>> > But
>> > I then 'suspend' NT logon and the Generic Host Process for Win32
> Services
>> > and the CPU settles down. Hope this makes some sense. Does this sound
> like
>> > there is a possibility I have something running that doesn't showup in
> the
>> > Processes list of Task Manager?
>> >
>> > May be dumb, but the only way to stay that way is 'do nothing'.
>> >
>> > Sorry for the bandwidth use.
>> >
>> > dc
>> >
>> >
>>
>>
>
>

[dc]

Okay, here it is
Only changes Computer Name to Xxx Xxxxxxx

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:57:58 PM, on 7/14/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINNT\system32\RunDll32.exe
C:\WINNT\System32\sistray.EXE
C:\WINNT\Samsung\LaserSMMgr\ssmmgr.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Documents and Settings\Xxx Xxxxxxx\My Documents\APPS\Process
Explorer\procexp.exe
C:\PROGRA~1\EasyZip\EZIP.EXE
C:\DOCUME~1\XXXXXX~1\LOCALS~1\Temp\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://clusty.com/
O1 - Hosts: 255.255.255.255 broadcasthost
O1 - Hosts: ::1 localhost
O1 - Hosts: 66.35.250.150 s # slashdot.org
O1 - Hosts: 216.239.39.99 g # google.com
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat
7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [SiS Tray] C:\WINNT\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINNT\System32\khooker.exe
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINNT\Samsung\LaserSMMgr\ssmmgr.exe"
/autorun
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat
7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe
/RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet
Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program
Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Startup: procexp.lnk = C:\Documents and Settings\Xxx Xxxxxxx\My
Documents\APPS\Process Explorer\procexp.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program
Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsof...?1145843001996
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) -
http://217.71.245.166/activex/AMC.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb
Class) - http://85.235.16.148/activex/AMC.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX
Control) - http://driveragent.com/files/driveragent.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) -
VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program
Files\Ahead\InCD\InCDsrv.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program
Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program
Files\Raxco\PerfectDisk\PDEngine.exe

--
End of file - 4764 bytes


=====================
Apologies to those about the band width use
=====================

dc

thanks for offering any help

"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
news:f7cbmu$l49$1@blackhelicopter.databasix.com...
> Just cut and paste it. My news server with strip the attachment in a non
> binary group.
>
>
> --
>
> Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
> The list grows. Leythos the stalker http://www.leythosthestalker.com,
David
> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
>
>
>
> "dc" <yada@nunya.com> wrote in message
> news:4699ae2d$0$8839$bbae4d71@news.suddenlink.net. ..
> >I will as soon as possible...
> > Okay to zip it as attachment?
> >
> > dc
> >
> >
> >
> >
> >
> > "pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
> > news:f7c668$7r5$1@blackhelicopter.databasix.com...
> >> Download HJT from here
> >> http://www.trendsecure.com/portal/en...hijackthis.php
> > and
> >> post the log, I need to see it.
> >>
> >>
> >> --
> >>
> >> Newsgroup Trolls. Read about mine here
http://www.pcbutts1.com/downloads
> >> The list grows. Leythos the stalker http://www.leythosthestalker.com,
> > David
> >> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
> >> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
> >>
> >>
> >>
> >> "dc" <yada@nunya.com> wrote in message
> >> news:46999b4b$0$8839$bbae4d71@news.suddenlink.net. ..
> >> > In Process Explorer on startup on one box I show Windows NT Logon
> >> > Application using a good deal of processor and also for a very brief
> >> > period
> >> > of time something showsup starting Usenet something and then goes
away.
> >> > But
> >> > I then 'suspend' NT logon and the Generic Host Process for Win32
> > Services
> >> > and the CPU settles down. Hope this makes some sense. Does this sound
> > like
> >> > there is a possibility I have something running that doesn't showup
in
> > the
> >> > Processes list of Task Manager?
> >> >
> >> > May be dumb, but the only way to stay that way is 'do nothing'.
> >> >
> >> > Sorry for the bandwidth use.
> >> >
> >> > dc
> >> >
> >> >
> >>
> >>
> >
> >
>
>

[Leythos]

In article <4699b975$0$8836$bbae4d71@news.suddenlink.net>,
yada@nunya.com says...
> Okay, here it is
> Only changes Computer Name to Xxx Xxxxxxx

Nice, posting a HJ Log in Usenet, showing that you can't read
instructions, showing that you can't follow directions, showing that you
can't use Google, showing that you follow the post of someone that posts
porn links in Usenet and exposes his porn to kids....

Why can't you post HJ Logs to the sites that read/monitor them? Usenet
is not where you post them, it will screw with how people check for
malware information - which you were already told.

--
Leythos - spam999free@rrohio.com (remove 999 to email me)

Learn more about PCBUTTS1 and his antics and ethic and his perversion
with Porn and Filth. Just take a look at some of the FILTH he's created
and put on his website: http://www.futurehardware.in/595578-2.htm all
exposed to children (the link I've include does not directly display his
filth). You can find the same information by googling for 'PCBUTTS1' and
'exposed to kids'.

[pcbutts1]

First let me say ignore the troll Leythos and anyone else who tells you to
post your log somewhere else. The log is text only it clogs nothing. It does
not screw up search engines, they use that excuse to keep people from
posting it here simply because they don't like me. Pick any line in your log
and do a Google search and you will see results from websites not newsgroups
so don't let them BS you with those lies. The truth is very few here are
able to diagnose the logs so as to not seem dumb they would rather not see
them (like you are really forcing them to read it) Now as for your log the
only 2 things I would change would be these lines. Have HJT fix these line
by placing a check next to each line then click on the fix checked button on
the bottom.

O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe
/RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet
Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')

You should also update your version of IE.


--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



"dc" <yada@nunya.com> wrote in message
news:4699b975$0$8836$bbae4d71@news.suddenlink.net. ..
> Okay, here it is
> Only changes Computer Name to Xxx Xxxxxxx
>
> Logfile of Trend Micro HijackThis v2.0.2
> Scan saved at 11:57:58 PM, on 7/14/2007
> Platform: Windows 2000 SP4 (WinNT 5.00.2195)
> MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
> Boot mode: Normal
>

[dc]

Something I failed to mention earlier is, this box has 'restarted' by itself
on several occasions in the past several days. I don't have a temperature on
the CPU, but the machine is physically clean (lint-free), and is running
very quiet (no fan bearing noises) with the processor fan running normally.

dc


"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
news:f7cbmu$l49$1@blackhelicopter.databasix.com...
> Just cut and paste it. My news server with strip the attachment in a non
> binary group.
>
>
> --
>
> Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
> The list grows. Leythos the stalker http://www.leythosthestalker.com,
David
> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
>
>
>
> "dc" <yada@nunya.com> wrote in message
> news:4699ae2d$0$8839$bbae4d71@news.suddenlink.net. ..
> >I will as soon as possible...
> > Okay to zip it as attachment?
> >
> > dc
> >
> >
> >
> >
> >
> > "pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
> > news:f7c668$7r5$1@blackhelicopter.databasix.com...
> >> Download HJT from here
> >> http://www.trendsecure.com/portal/en...hijackthis.php
> > and
> >> post the log, I need to see it.
> >>
> >>
> >> --
> >>
> >> Newsgroup Trolls. Read about mine here
http://www.pcbutts1.com/downloads
> >> The list grows. Leythos the stalker http://www.leythosthestalker.com,
> > David
> >> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
> >> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
> >>
> >>
> >>
> >> "dc" <yada@nunya.com> wrote in message
> >> news:46999b4b$0$8839$bbae4d71@news.suddenlink.net. ..
> >> > In Process Explorer on startup on one box I show Windows NT Logon
> >> > Application using a good deal of processor and also for a very brief
> >> > period
> >> > of time something showsup starting Usenet something and then goes
away.
> >> > But
> >> > I then 'suspend' NT logon and the Generic Host Process for Win32
> > Services
> >> > and the CPU settles down. Hope this makes some sense. Does this sound
> > like
> >> > there is a possibility I have something running that doesn't showup
in
> > the
> >> > Processes list of Task Manager?
> >> >
> >> > May be dumb, but the only way to stay that way is 'do nothing'.
> >> >
> >> > Sorry for the bandwidth use.
> >> >
> >> > dc
> >> >
> >> >
> >>
> >>
> >
> >
>
>

[pcbutts1]

Check your event viewer for errors. Look for errors that happened right
before the reboots and tell me what they are.



--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



"dc" <yadayada@nunya.com> wrote in message
news:469a3335$0$8857$bbae4d71@news.suddenlink.net. ..
> Something I failed to mention earlier is, this box has 'restarted' by
> itself
> on several occasions in the past several days. I don't have a temperature
> on
> the CPU, but the machine is physically clean (lint-free), and is running
> very quiet (no fan bearing noises) with the processor fan running
> normally.
>
> dc
>
>
> "pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
> news:f7cbmu$l49$1@blackhelicopter.databasix.com...
>> Just cut and paste it. My news server with strip the attachment in a non
>> binary group.
>>
>>
>> --
>>
>> Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
>> The list grows. Leythos the stalker http://www.leythosthestalker.com,
> David
>> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
>> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
>>
>>
>>
>> "dc" <yada@nunya.com> wrote in message
>> news:4699ae2d$0$8839$bbae4d71@news.suddenlink.net. ..
>> >I will as soon as possible...
>> > Okay to zip it as attachment?
>> >
>> > dc
>> >
>> >
>> >
>> >
>> >
>> > "pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
>> > news:f7c668$7r5$1@blackhelicopter.databasix.com...
>> >> Download HJT from here
>> >> http://www.trendsecure.com/portal/en...hijackthis.php
>> > and
>> >> post the log, I need to see it.
>> >>
>> >>
>> >> --
>> >>
>> >> Newsgroup Trolls. Read about mine here
> http://www.pcbutts1.com/downloads
>> >> The list grows. Leythos the stalker http://www.leythosthestalker.com,
>> > David
>> >> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
>> >> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
>> >>
>> >>
>> >>
>> >> "dc" <yada@nunya.com> wrote in message
>> >> news:46999b4b$0$8839$bbae4d71@news.suddenlink.net. ..
>> >> > In Process Explorer on startup on one box I show Windows NT Logon
>> >> > Application using a good deal of processor and also for a very brief
>> >> > period
>> >> > of time something showsup starting Usenet something and then goes
> away.
>> >> > But
>> >> > I then 'suspend' NT logon and the Generic Host Process for Win32
>> > Services
>> >> > and the CPU settles down. Hope this makes some sense. Does this
>> >> > sound
>> > like
>> >> > there is a possibility I have something running that doesn't showup
> in
>> > the
>> >> > Processes list of Task Manager?
>> >> >
>> >> > May be dumb, but the only way to stay that way is 'do nothing'.
>> >> >
>> >> > Sorry for the bandwidth use.
>> >> >
>> >> > dc
>> >> >
>> >> >
>> >>
>> >>
>> >
>> >
>>
>>
>
>

[Andy Walker]

dc wrote:

>In Process Explorer on startup on one box I show Windows NT Logon
>Application using a good deal of processor and also for a very brief period
>of time something showsup starting Usenet something and then goes away. But
>I then 'suspend' NT logon and the Generic Host Process for Win32 Services
>and the CPU settles down. Hope this makes some sense. Does this sound like
>there is a possibility I have something running that doesn't showup in the
>Processes list of Task Manager?
>
>May be dumb, but the only way to stay that way is 'do nothing'.
>
>Sorry for the bandwidth use.
>
>dc

When is that last time you ran a Microsoft Update? I know there was a
patch to a patch last month (at least I think it was June) that dealt
with something like what you describe.