OnStartUP - Usenet starting

[dc]

In Process Explorer on startup on one box I show Windows NT Logon
Application using a good deal of processor and also for a very brief period
of time something showsup starting Usenet something and then goes away. But
I then 'suspend' NT logon and the Generic Host Process for Win32 Services
and the CPU settles down. Hope this makes some sense. Does this sound like
there is a possibility I have something running that doesn't showup in the
Processes list of Task Manager?

May be dumb, but the only way to stay that way is 'do nothing'.

Sorry for the bandwidth use.

dc

[pcbutts1]

Download HJT from here
http://www.trendsecure.com/portal/en...hijackthis.php and
post the log, I need to see it.


--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



"dc" <yada@nunya.com> wrote in message
news:46999b4b$0$8839$bbae4d71@news.suddenlink.net. ..
> In Process Explorer on startup on one box I show Windows NT Logon
> Application using a good deal of processor and also for a very brief
> period
> of time something showsup starting Usenet something and then goes away.
> But
> I then 'suspend' NT logon and the Generic Host Process for Win32 Services
> and the CPU settles down. Hope this makes some sense. Does this sound like
> there is a possibility I have something running that doesn't showup in the
> Processes list of Task Manager?
>
> May be dumb, but the only way to stay that way is 'do nothing'.
>
> Sorry for the bandwidth use.
>
> dc
>
>

[Andy Walker]

dc wrote:

>In Process Explorer on startup on one box I show Windows NT Logon
>Application using a good deal of processor and also for a very brief period
>of time something showsup starting Usenet something and then goes away. But
>I then 'suspend' NT logon and the Generic Host Process for Win32 Services
>and the CPU settles down. Hope this makes some sense. Does this sound like
>there is a possibility I have something running that doesn't showup in the
>Processes list of Task Manager?
>
>May be dumb, but the only way to stay that way is 'do nothing'.
>
>Sorry for the bandwidth use.
>
>dc

When is that last time you ran a Microsoft Update? I know there was a
patch to a patch last month (at least I think it was June) that dealt
with something like what you describe.

[dc]

Thanks, I'll check...

I have WinUD auto on that box. There have been 6ea d/l recently. KB926122
must be my latest, dated July13, according to the 'spuninst' directory.

I regularly delete these directories after I'm pretty sure there is no
problems caused by them (every little bit helps).

dc




"Andy Walker" <awalker@nspank.invalid> wrote in message
news:4699a2d2.4624562@news.webtv.com...
> dc wrote:
>
> >In Process Explorer on startup on one box I show Windows NT Logon
> >Application using a good deal of processor and also for a very brief
period
> >of time something showsup starting Usenet something and then goes away.
But
> >I then 'suspend' NT logon and the Generic Host Process for Win32 Services
> >and the CPU settles down. Hope this makes some sense. Does this sound
like
> >there is a possibility I have something running that doesn't showup in
the
> >Processes list of Task Manager?
> >
> >May be dumb, but the only way to stay that way is 'do nothing'.
> >
> >Sorry for the bandwidth use.
> >
> >dc
>
> When is that last time you ran a Microsoft Update? I know there was a
> patch to a patch last month (at least I think it was June) that dealt
> with something like what you describe.
>

[dc]

I will as soon as possible...
Okay to zip it as attachment?

dc





"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
news:f7c668$7r5$1@blackhelicopter.databasix.com...
> Download HJT from here
> http://www.trendsecure.com/portal/en...hijackthis.php
and
> post the log, I need to see it.
>
>
> --
>
> Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
> The list grows. Leythos the stalker http://www.leythosthestalker.com,
David
> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
>
>
>
> "dc" <yada@nunya.com> wrote in message
> news:46999b4b$0$8839$bbae4d71@news.suddenlink.net. ..
> > In Process Explorer on startup on one box I show Windows NT Logon
> > Application using a good deal of processor and also for a very brief
> > period
> > of time something showsup starting Usenet something and then goes away.
> > But
> > I then 'suspend' NT logon and the Generic Host Process for Win32
Services
> > and the CPU settles down. Hope this makes some sense. Does this sound
like
> > there is a possibility I have something running that doesn't showup in
the
> > Processes list of Task Manager?
> >
> > May be dumb, but the only way to stay that way is 'do nothing'.
> >
> > Sorry for the bandwidth use.
> >
> > dc
> >
> >
>
>

[pcbutts1]

Just cut and paste it. My news server with strip the attachment in a non
binary group.


--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



"dc" <yada@nunya.com> wrote in message
news:4699ae2d$0$8839$bbae4d71@news.suddenlink.net. ..
>I will as soon as possible...
> Okay to zip it as attachment?
>
> dc
>
>
>
>
>
> "pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
> news:f7c668$7r5$1@blackhelicopter.databasix.com...
>> Download HJT from here
>> http://www.trendsecure.com/portal/en...hijackthis.php
> and
>> post the log, I need to see it.
>>
>>
>> --
>>
>> Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
>> The list grows. Leythos the stalker http://www.leythosthestalker.com,
> David
>> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
>> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
>>
>>
>>
>> "dc" <yada@nunya.com> wrote in message
>> news:46999b4b$0$8839$bbae4d71@news.suddenlink.net. ..
>> > In Process Explorer on startup on one box I show Windows NT Logon
>> > Application using a good deal of processor and also for a very brief
>> > period
>> > of time something showsup starting Usenet something and then goes away.
>> > But
>> > I then 'suspend' NT logon and the Generic Host Process for Win32
> Services
>> > and the CPU settles down. Hope this makes some sense. Does this sound
> like
>> > there is a possibility I have something running that doesn't showup in
> the
>> > Processes list of Task Manager?
>> >
>> > May be dumb, but the only way to stay that way is 'do nothing'.
>> >
>> > Sorry for the bandwidth use.
>> >
>> > dc
>> >
>> >
>>
>>
>
>

[dc]

Okay, here it is
Only changes Computer Name to Xxx Xxxxxxx

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:57:58 PM, on 7/14/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINNT\system32\RunDll32.exe
C:\WINNT\System32\sistray.EXE
C:\WINNT\Samsung\LaserSMMgr\ssmmgr.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Documents and Settings\Xxx Xxxxxxx\My Documents\APPS\Process
Explorer\procexp.exe
C:\PROGRA~1\EasyZip\EZIP.EXE
C:\DOCUME~1\XXXXXX~1\LOCALS~1\Temp\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://clusty.com/
O1 - Hosts: 255.255.255.255 broadcasthost
O1 - Hosts: ::1 localhost
O1 - Hosts: 66.35.250.150 s # slashdot.org
O1 - Hosts: 216.239.39.99 g # google.com
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat
7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [SiS Tray] C:\WINNT\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINNT\System32\khooker.exe
O4 - HKLM\..\Run: [Samsung LBP SM] "C:\WINNT\Samsung\LaserSMMgr\ssmmgr.exe"
/autorun
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat
7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe
/RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet
Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program
Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Startup: procexp.lnk = C:\Documents and Settings\Xxx Xxxxxxx\My
Documents\APPS\Process Explorer\procexp.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program
Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsof...?1145843001996
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) -
http://217.71.245.166/activex/AMC.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb
Class) - http://85.235.16.148/activex/AMC.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX
Control) - http://driveragent.com/files/driveragent.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) -
VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program
Files\Ahead\InCD\InCDsrv.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program
Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program
Files\Raxco\PerfectDisk\PDEngine.exe

--
End of file - 4764 bytes


=====================
Apologies to those about the band width use
=====================

dc

thanks for offering any help

"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
news:f7cbmu$l49$1@blackhelicopter.databasix.com...
> Just cut and paste it. My news server with strip the attachment in a non
> binary group.
>
>
> --
>
> Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
> The list grows. Leythos the stalker http://www.leythosthestalker.com,
David
> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
>
>
>
> "dc" <yada@nunya.com> wrote in message
> news:4699ae2d$0$8839$bbae4d71@news.suddenlink.net. ..
> >I will as soon as possible...
> > Okay to zip it as attachment?
> >
> > dc
> >
> >
> >
> >
> >
> > "pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
> > news:f7c668$7r5$1@blackhelicopter.databasix.com...
> >> Download HJT from here
> >> http://www.trendsecure.com/portal/en...hijackthis.php
> > and
> >> post the log, I need to see it.
> >>
> >>
> >> --
> >>
> >> Newsgroup Trolls. Read about mine here
http://www.pcbutts1.com/downloads
> >> The list grows. Leythos the stalker http://www.leythosthestalker.com,
> > David
> >> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
> >> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
> >>
> >>
> >>
> >> "dc" <yada@nunya.com> wrote in message
> >> news:46999b4b$0$8839$bbae4d71@news.suddenlink.net. ..
> >> > In Process Explorer on startup on one box I show Windows NT Logon
> >> > Application using a good deal of processor and also for a very brief
> >> > period
> >> > of time something showsup starting Usenet something and then goes
away.
> >> > But
> >> > I then 'suspend' NT logon and the Generic Host Process for Win32
> > Services
> >> > and the CPU settles down. Hope this makes some sense. Does this sound
> > like
> >> > there is a possibility I have something running that doesn't showup
in
> > the
> >> > Processes list of Task Manager?
> >> >
> >> > May be dumb, but the only way to stay that way is 'do nothing'.
> >> >
> >> > Sorry for the bandwidth use.
> >> >
> >> > dc
> >> >
> >> >
> >>
> >>
> >
> >
>
>

[Leythos]

In article <4699b975$0$8836$bbae4d71@news.suddenlink.net>,
yada@nunya.com says...
> Okay, here it is
> Only changes Computer Name to Xxx Xxxxxxx

Nice, posting a HJ Log in Usenet, showing that you can't read
instructions, showing that you can't follow directions, showing that you
can't use Google, showing that you follow the post of someone that posts
porn links in Usenet and exposes his porn to kids....

Why can't you post HJ Logs to the sites that read/monitor them? Usenet
is not where you post them, it will screw with how people check for
malware information - which you were already told.

--
Leythos - spam999free@rrohio.com (remove 999 to email me)

Learn more about PCBUTTS1 and his antics and ethic and his perversion
with Porn and Filth. Just take a look at some of the FILTH he's created
and put on his website: http://www.futurehardware.in/595578-2.htm all
exposed to children (the link I've include does not directly display his
filth). You can find the same information by googling for 'PCBUTTS1' and
'exposed to kids'.

[dc]

Sorry

dc


"Leythos" <void@nowhere.lan> wrote in message
news:MPG.2103bd894f7c12f2989784@adfree.Usenet.com. ..
> In article <4699b975$0$8836$bbae4d71@news.suddenlink.net>,
> yada@nunya.com says...
> > Okay, here it is
> > Only changes Computer Name to Xxx Xxxxxxx
>
> Nice, posting a HJ Log in Usenet, showing that you can't read
> instructions, showing that you can't follow directions, showing that you
> can't use Google, showing that you follow the post of someone that posts
> porn links in Usenet and exposes his porn to kids....
>
> Why can't you post HJ Logs to the sites that read/monitor them? Usenet
> is not where you post them, it will screw with how people check for
> malware information - which you were already told.
>
> --
> Leythos - spam999free@rrohio.com (remove 999 to email me)
>
> Learn more about PCBUTTS1 and his antics and ethic and his perversion
> with Porn and Filth. Just take a look at some of the FILTH he's created
> and put on his website: http://www.futurehardware.in/595578-2.htm all
> exposed to children (the link I've include does not directly display his
> filth). You can find the same information by googling for 'PCBUTTS1' and
> 'exposed to kids'.

[dc]

Something I failed to mention earlier is, this box has 'restarted' by itself
on several occasions in the past several days. I don't have a temperature on
the CPU, but the machine is physically clean (lint-free), and is running
very quiet (no fan bearing noises) with the processor fan running normally.

dc


"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
news:f7cbmu$l49$1@blackhelicopter.databasix.com...
> Just cut and paste it. My news server with strip the attachment in a non
> binary group.
>
>
> --
>
> Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
> The list grows. Leythos the stalker http://www.leythosthestalker.com,
David
> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
>
>
>
> "dc" <yada@nunya.com> wrote in message
> news:4699ae2d$0$8839$bbae4d71@news.suddenlink.net. ..
> >I will as soon as possible...
> > Okay to zip it as attachment?
> >
> > dc
> >
> >
> >
> >
> >
> > "pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
> > news:f7c668$7r5$1@blackhelicopter.databasix.com...
> >> Download HJT from here
> >> http://www.trendsecure.com/portal/en...hijackthis.php
> > and
> >> post the log, I need to see it.
> >>
> >>
> >> --
> >>
> >> Newsgroup Trolls. Read about mine here
http://www.pcbutts1.com/downloads
> >> The list grows. Leythos the stalker http://www.leythosthestalker.com,
> > David
> >> H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
> >> Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
> >>
> >>
> >>
> >> "dc" <yada@nunya.com> wrote in message
> >> news:46999b4b$0$8839$bbae4d71@news.suddenlink.net. ..
> >> > In Process Explorer on startup on one box I show Windows NT Logon
> >> > Application using a good deal of processor and also for a very brief
> >> > period
> >> > of time something showsup starting Usenet something and then goes
away.
> >> > But
> >> > I then 'suspend' NT logon and the Generic Host Process for Win32
> > Services
> >> > and the CPU settles down. Hope this makes some sense. Does this sound
> > like
> >> > there is a possibility I have something running that doesn't showup
in
> > the
> >> > Processes list of Task Manager?
> >> >
> >> > May be dumb, but the only way to stay that way is 'do nothing'.
> >> >
> >> > Sorry for the bandwidth use.
> >> >
> >> > dc
> >> >
> >> >
> >>
> >>
> >
> >
>
>