This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Malware/Spyware network activity

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hi All!

Windows XP. PC seems to run fine, then periodically will "slow down" the network activity/web browsing of the 3 other computers on the home LAN. Unplugging this PC from the LAN solves the slowdown issue right away, as does rebooting this PC. Avast anti-virus finds no viruses on full system scans even in safe mode.

I got to the PC when it was slowing down the home LAN, ran netstat and found a large number of connections (the only Internet applications that I knew of that were running were Firefox connected to redsox.com and AIM open).

I've included a HJT log and netstat copy/paste from about 2 minutes after the problem started.

Any help is GREATLY appreciated! Thanks!
Al

Logfile of HijackThis v1.99.1
Scan saved at 8:57:59 PM, on 7/31/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\cmd.exe
C:\WINDOWS\system32\netstat.exe
C:\Documents and Settings\Owner\My Documents\New Folder\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\PROGRA~1\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

————-
Netstat Paste below:

SHED
TCP your-2s4kn5k0h3:1597 210.4.7.159:23101 ESTABLISHED
TCP your-2s4kn5k0h3:1599 adsl-69-153-9-98.dsl.snantx.swbell.net:4579 EST
ABLISHED
TCP your-2s4kn5k0h3:1604 c-67-189-141-63.hsd1.ny.comcast.net:39132 ESTAB
LISHED
TCP your-2s4kn5k0h3:1607 ip68-6-102-84.sb.sd.cox.net:6348 ESTABLISHED
TCP your-2s4kn5k0h3:1611 d150-147-255.home.cgocable.net:36501 ESTABLISHE
D
TCP your-2s4kn5k0h3:1655 192.168.2.1:http CLOSE_WAIT
TCP your-2s4kn5k0h3:2152 bos-m039c.blue.aol.com:5190 ESTABLISHED
TCP your-2s4kn5k0h3:2153 www-aim-vm04.evip.aol.com:http TIME_WAIT
TCP your-2s4kn5k0h3:2154 oam-m08a.blue.aol.com:5190 ESTABLISHED
TCP your-2s4kn5k0h3:2155 [removed]:5190 ESTABLISHED
TCP your-2s4kn5k0h3:2162 [removed]:http ESTABLISHED
TCP your-2s4kn5k0h3:2170 [removed]:http LAST_ACK
TCP your-2s4kn5k0h3:2172 [removed]:http SYN_SENT
TCP your-2s4kn5k0h3:26097 dialup-[removed].Dial1.Atlanta1.Level3.net:10
64 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 dialup-[removed].Dial1.Atlanta1.Level3.net:1
213 TIME_WAIT
TCP your-2s4kn5k0h3:26097 dialup-[removed].Dial1.SanJose1.Level3.net:2
833 SYN_RECEIVED
TCP your-2s4kn5k0h3:26097 111.san-francisco-21rh15-16rt.ca.dial-access.att
.net:4383 TIME_WAIT
TCP your-2s4kn5k0h3:26097 12-216-68-175.client.mchsi.com:1863 ESTABLISHED

TCP your-2s4kn5k0h3:26097 c-24-12-79-246.hsd1.il.comcast.net:2991 TIME_WA
IT
TCP your-2s4kn5k0h3:26097 c-24-14-255-143.hsd1.il.comcast.net:52257 ESTAB
LISHED
TCP your-2s4kn5k0h3:26097 c-24-20-103-36.hsd1.wa.comcast.net:3393 ESTABLI
SHED
TCP your-2s4kn5k0h3:26097 d36-103-73.home1.cgocable.net:8519 ESTABLISHED
TCP your-2s4kn5k0h3:26097 ool-182f53fc.dyn.optonline.net:2292 FIN_WAIT_1
TCP your-2s4kn5k0h3:26097 pembrkfl-bellsouth-24-53-201-101.miamfl.adelphia
.net:63506 ESTABLISHED
TCP your-2s4kn5k0h3:26097 S01060013200895d4.wp.shawcable.net:1635 TIME_WA
IT
TCP your-2s4kn5k0h3:26097 S01060012171a7e86.wp.shawcable.net:3050 TIME_WA
IT
TCP your-2s4kn5k0h3:26097 S010600a0d1419563.wp.shawcable.net:3012 CLOSE_W
AIT
TCP your-2s4kn5k0h3:26097 S010600d0093f75d6.vs.shawcable.net:4947 CLOSE_W
AIT
TCP your-2s4kn5k0h3:26097 S01060050f27bfc43.vs.shawcable.net:4824 TIME_WA
IT
TCP your-2s4kn5k0h3:26097 user-24-96-37-8.knology.net:1861 TIME_WAIT
TCP your-2s4kn5k0h3:26097 S0106000d883e6f40.su.shawcable.net:1167 TIME_WA
IT
TCP your-2s4kn5k0h3:26097 [removed]:2125 TIME_WAIT
TCP your-2s4kn5k0h3:26097 ip112.thecanyons.dfw.ygnition.net:3288 ESTABLIS
HED
TCP your-2s4kn5k0h3:26097 ip3-87.tvmax-fiber-1.hou.ygnition.net:1990 ESTA
BLISHED
TCP your-2s4kn5k0h3:26097 ip4-56.tvmax-fiber-1.hou.ygnition.net:3521 ESTA
BLISHED
TCP your-2s4kn5k0h3:26097 ip5-8.tvmax-fiber-1.hou.ygnition.net:3367 ESTAB
LISHED
TCP your-2s4kn5k0h3:26097 ip6-171.tvmax-fiber-2.hou.ygnition.net:1043 EST
ABLISHED
TCP your-2s4kn5k0h3:26097 ip6-171.tvmax-fiber-2.hou.ygnition.net:1053 EST
ABLISHED
TCP your-2s4kn5k0h3:26097 ip6-171.tvmax-fiber-2.hou.ygnition.net:1125 EST
ABLISHED
TCP your-2s4kn5k0h3:26097 ip6-171.tvmax-fiber-2.hou.ygnition.net:1126 EST
ABLISHED
TCP your-2s4kn5k0h3:26097 ip6-171.tvmax-fiber-2.hou.ygnition.net:4013 EST
ABLISHED
TCP your-2s4kn5k0h3:26097 ip6-171.tvmax-fiber-2.hou.ygnition.net:4773 EST
ABLISHED
TCP your-2s4kn5k0h3:26097 59-104-172-129.adsl.dynamic.seed.net.tw:2373 TI
ME_WAIT
TCP your-2s4kn5k0h3:26097 59-116-101-224.dynamic.hinet.net:4206 TIME_WAIT

TCP your-2s4kn5k0h3:26097 61-220-193-75.HINET-IP.hinet.net:3547 TIME_WAIT

TCP your-2s4kn5k0h3:26097 1Cust4165.an2.lax32.da.uu.net:3496 ESTABLISHED
TCP your-2s4kn5k0h3:26097 63-221-14-58.btnaccess.net:1326 ESTABLISHED
TCP your-2s4kn5k0h3:26097 [removed]:34836 TIME_WAIT
TCP your-2s4kn5k0h3:26097 [removed]:1153 ESTABLISHED
TCP your-2s4kn5k0h3:26097 adsl-12-42-13.jan.bellsouth.net:50217 ESTABLISH
ED
TCP your-2s4kn5k0h3:26097 CPE-65-26-137-237.kc.res.rr.com:1223 ESTABLISHE
D
TCP your-2s4kn5k0h3:26097 0-2pool41-130.nas19.miami1.fl.us.da.qwest.net:10
69 ESTABLISHED
TCP your-2s4kn5k0h3:26097 c-66-31-170-53.hsd1.ma.comcast.net:59421 TIME_W
AIT
TCP your-2s4kn5k0h3:26097 66-50-97-108.prtc.net:2491 TIME_WAIT
TCP your-2s4kn5k0h3:26097 cpe-66-61-64-243.midsouth.res.rr.com:2630 ESTAB
LISHED
TCP your-2s4kn5k0h3:26097 cpe-66-91-17-115.hawaii.res.rr.com:1529 SYN_REC
EIVED
TCP your-2s4kn5k0h3:26097 c-66-176-16-211.hsd1.fl.comcast.net:3273 TIME_W
AIT
TCP your-2s4kn5k0h3:26097 reverse.[removed].dynamic.ldmi.com:3014 TIME
_WAIT
TCP your-2s4kn5k0h3:26097 66-233-83-204.rcc.clearwire-dns.net:4016 CLOSE_
WAIT
TCP your-2s4kn5k0h3:26097 adsl-33-163-139.asm.bellsouth.net:3410 ESTABLIS
HED
TCP your-2s4kn5k0h3:26097 67-40-216-127.tukw.qwest.net:2447 ESTABLISHED
TCP your-2s4kn5k0h3:26097 Toronto-HSE-ppp3881030.sympatico.ca:61056 TIME_
WAIT
TCP your-2s4kn5k0h3:26097 c-67-160-58-241.hsd1.wa.comcast.net:10653 TIME_
WAIT
TCP your-2s4kn5k0h3:26097 c-67-161-106-85.hsd1.wa.comcast.net:1935 ESTABL
ISHED
TCP your-2s4kn5k0h3:26097 c-67-176-94-178.hsd1.co.comcast.net:1196 ESTABL
ISHED
TCP your-2s4kn5k0h3:26097 ip68-0-156-119.tc.ph.cox.net:60824 TIME_WAIT
TCP your-2s4kn5k0h3:26097 c-68-36-197-137.hsd1.nj.comcast.net:3456 ESTABL
ISHED
TCP your-2s4kn5k0h3:26097 c-68-38-99-2.hsd1.nj.comcast.net:1404 CLOSE_WAI
T
TCP your-2s4kn5k0h3:26097 c-68-41-42-248.hsd1.mi.comcast.net:2859 ESTABLI
SHED
TCP your-2s4kn5k0h3:26097 c-68-41-50-82.hsd1.mi.comcast.net:3661 TIME_WAI
T
TCP your-2s4kn5k0h3:26097 c-68-45-8-235.hsd1.nj.comcast.net:1086 ESTABLIS
HED
TCP your-2s4kn5k0h3:26097 c-68-62-46-155.hsd1.mi.comcast.net:3247 ESTABLI
SHED
TCP your-2s4kn5k0h3:26097 ip68-99-129-10.ph.ph.cox.net:3789 ESTABLISHED
TCP your-2s4kn5k0h3:26097 68-119-137-249.dhcp.chtn.wv.charter.com:2855 TI
ME_WAIT
TCP your-2s4kn5k0h3:26097 S0106000625612789.cg.shawcable.net:3999 TIME_WA
IT
TCP your-2s4kn5k0h3:26097 S0106000f3d01876e.ed.shawcable.net:61327 ESTABL
ISHED
TCP your-2s4kn5k0h3:26097 ool-44c7a644.dyn.optonline.net:3438 ESTABLISHED

TCP your-2s4kn5k0h3:26097 [removed].cfl.res.rr.com:3120 TIME_WAIT
TCP your-2s4kn5k0h3:26097 host-68-212-139-89.mia.bellsouth.net:4098 ESTAB
LISHED
TCP your-2s4kn5k0h3:26097 ip68-228-17-152.pn.at.cox.net:4798 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 adsl-68-250-156-101.dsl.milwwi.ameritech.net:123
4 ESTABLISHED
TCP your-2s4kn5k0h3:26097 unknown.nscnap.net:2559 ESTABLISHED
TCP your-2s4kn5k0h3:26097 crlspr-[removed].myacc.net:61395 ESTABLISHED
TCP your-2s4kn5k0h3:26097 [removed]:4526 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 69-89-193-57.unfiltered.dsl.wiktel.com:4288 TIM
E_WAIT
TCP your-2s4kn5k0h3:26097 [removed]:56793 ESTABLISHED
TCP your-2s4kn5k0h3:26097 ool-45721d8b.dyn.optonline.net:2860 ESTABLISHED

TCP your-2s4kn5k0h3:26097 ool-45722df2.dyn.optonline.net:3150 ESTABLISHED

TCP your-2s4kn5k0h3:26097 ool-457391be.dyn.optonline.net:1268 ESTABLISHED

TCP your-2s4kn5k0h3:26097 c-69-138-161-29.hsd1.md.comcast.net:2284 ESTABL
ISHED
TCP your-2s4kn5k0h3:26097 host-69-144-150-17.bln-mt.client.bresnan.net:378
7 ESTABLISHED
TCP your-2s4kn5k0h3:26097 Quebec-HSE-ppp212989.qc.sympatico.ca:24141 CLOS
E_WAIT
TCP your-2s4kn5k0h3:26097 69-160-66-51.frdrmd.adelphia.net:60702 TIME_WAI
T
TCP your-2s4kn5k0h3:26097 newcastlepa-bsr1-etcb01-00-ncaspa-69-166-177-213
.pittpa.adelphia.net:1953 ESTABLISHED
TCP your-2s4kn5k0h3:26097 CPE001558049907-CM0012c9214606.cpe.net.cable.rog
ers.com:4442 ESTABLISHED
TCP your-2s4kn5k0h3:26097 CPE0013d4bf4a91-CM0014f8c189a6.cpe.net.cable.rog
ers.com:2547 ESTABLISHED
TCP your-2s4kn5k0h3:26097 CPE000c6eac3a8f-CM001225d744d8.cpe.net.cable.rog
ers.com:3926 ESTABLISHED
TCP your-2s4kn5k0h3:26097 CPE00e01850be08-CM00159a68ebc2.cpe.net.cable.rog
ers.com:3764 ESTABLISHED
TCP your-2s4kn5k0h3:26097 adsl-69-209-210-203.dsl.chcgil.ameritech.net:221
2 TIME_WAIT
TCP your-2s4kn5k0h3:26097 adsl-69-231-250-129.dsl.irvnca.pacbell.net:3913
CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 CPE0050ba26bee4-CM001371852736.cpe.net.cable.rog
ers.com:4051 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 CPE0015f290d89e-CM00159a42ec90.cpe.net.cable.rog
ers.com:4640 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 [removed]:3711 FIN_WAIT_2
TCP your-2s4kn5k0h3:26097 CPE0013209823ba-CM00e06f14e938.cpe.net.cable.rog
ers.com:1183 ESTABLISHED
TCP your-2s4kn5k0h3:26097 70-39-229-129.clvdoh.adelphia.net:1272 TIME_WAI
T
TCP your-2s4kn5k0h3:26097 host-70-45-73-159.onelinkpr.net:2867 CLOSE_WAIT

TCP your-2s4kn5k0h3:26097 S010600142aa14919.vf.shawcable.net:1318 CLOSE_W
AIT
TCP your-2s4kn5k0h3:26097 S0106000c6e8cd3c1.vs.shawcable.net:1684 CLOSE_W
AIT
TCP your-2s4kn5k0h3:26097 adsl-144-51-156.chs.bellsouth.net:50590 ESTABLI
SHED
TCP your-2s4kn5k0h3:26097 adsl-156-35-179.mem.bellsouth.net:1086 ESTABLIS
HED
TCP your-2s4kn5k0h3:26097 ip70-176-246-154.ph.ph.cox.net:4573 TIME_WAIT
TCP your-2s4kn5k0h3:26097 ip70-179-184-22.dl.dl.cox.net:3403 ESTABLISHED
TCP your-2s4kn5k0h3:26097 ppp-70-224-209-30.dsl.applwi.ameritech.net:4047
ESTABLISHED
TCP your-2s4kn5k0h3:26097 adsl-70-233-135-218.dsl.okcyok.sbcglobal.net:ing
reslock TIME_WAIT
TCP your-2s4kn5k0h3:26097 ppp-70-251-158-163.dsl.rcsntx.swbell.net:2927 C
LOSE_WAIT
TCP your-2s4kn5k0h3:26097 ppp-70-251-240-67.dsl.rcsntx.swbell.net:3411 TI
ME_WAIT
TCP your-2s4kn5k0h3:26097 71-15-139-11.dhcp.stls.mo.charter.com:4536 TIME
_WAIT
TCP your-2s4kn5k0h3:26097 71-34-201-59.omah.qwest.net:4565 TIME_WAIT
TCP your-2s4kn5k0h3:26097 cpe-71-74-215-4.woh.res.rr.com:2065 ESTABLISHED

TCP your-2s4kn5k0h3:26097 71-83-199-70.dhcp.rvsd.ca.charter.com:4036 TIME
_WAIT
TCP your-2s4kn5k0h3:26097 pool-71-107-77-150.lsanca.dsl-w.verizon.net:1979
FIN_WAIT_1
TCP your-2s4kn5k0h3:26097 71-211-45-169.clsp.qwest.net:3565 TIME_WAIT
TCP your-2s4kn5k0h3:26097 CPE00123fbb2fcc-CM0014f86313f6.cpe.net.cable.rog
ers.com:4093 ESTABLISHED
TCP your-2s4kn5k0h3:26097 CPE0016b614401d-CM0011e6c4173d.cpe.net.cable.rog
ers.com:13836 ESTABLISHED
TCP your-2s4kn5k0h3:26097 cpe-72-184-98-240.tampabay.res.rr.com:1157 ESTA
BLISHED
TCP your-2s4kn5k0h3:26097 ip72-197-145-171.sd.sd.cox.net:4181 ESTABLISHED

TCP your-2s4kn5k0h3:26097 ip72-199-182-101.sd.sd.cox.net:3360 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 ip72-200-154-120.ri.ri.cox.net:2964 ESTABLISHED

TCP your-2s4kn5k0h3:26097 CPE000c763bf3d4-CM0012c922d13c.cpe.net.cable.rog
ers.com:3413 ESTABLISHED
TCP your-2s4kn5k0h3:26097 CPE00407b87bd5f-CM00407b87bd5e.cpe.net.cable.rog
ers.com:2127 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 CPE0011250fde79-CM0012c91001cc.cpe.net.cable.rog
ers.com:1864 ESTABLISHED
TCP your-2s4kn5k0h3:26097 DHCP-74-130-116-239.insightbb.com:4095 ESTABLIS
HED
TCP your-2s4kn5k0h3:26097 adsl-75-11-222-172.dsl.klmzmi.sbcglobal.net:1606
ESTABLISHED
TCP your-2s4kn5k0h3:26097 [removed]:33894 ESTABLISHED
TCP your-2s4kn5k0h3:26097 d51536CAA.access.telenet.be:3448 TIME_WAIT
TCP your-2s4kn5k0h3:26097 xdsl-81-173-154-231.netcologne.de:2921 TIME_WAI
T
TCP your-2s4kn5k0h3:26097 cpc3-rdng9-0-0-cust499.winn.cable.ntl.com:3741
TIME_WAIT
TCP your-2s4kn5k0h3:26097 addr-82-128-230-77.suomi.net:59933 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 c5375396e.cable.wanadoo.nl:4521 TIME_WAIT
TCP your-2s4kn5k0h3:26097 d83-182-40-14.cust.tele2.be:2843 TIME_WAIT
TCP your-2s4kn5k0h3:26097 p549C6613.dip.t-dialin.net:62279 TIME_WAIT
TCP your-2s4kn5k0h3:26097 p54ACB13C.dip0.t-ipconnect.de:63190 ESTABLISHED

TCP your-2s4kn5k0h3:26097 d54C279DD.access.telenet.be:59109 ESTABLISHED
TCP your-2s4kn5k0h3:26097 [removed]:51308 TIME_WAIT
TCP your-2s4kn5k0h3:26097 user-85-201-127-12.tvcablenet.be:3084 TIME_WAIT

TCP your-2s4kn5k0h3:26097 adsl8-102-1.du.simnet.is:2767 ESTABLISHED
TCP your-2s4kn5k0h3:26097 ip38-137-212-87.adsl2.versatel.nl:2385 ESTABLIS
HED
TCP your-2s4kn5k0h3:26097 88-105-10-220.dynamic.dsl.as9105.com:55799 ESTA
BLISHED
TCP your-2s4kn5k0h3:26097 bzq-88-154-124-51.red.bezeqint.net:3002 TIME_WA
IT
TCP your-2s4kn5k0h3:26097 125-14-0-196.rev.home.ne.jp:2506 ESTABLISHED
TCP your-2s4kn5k0h3:26097 dy248226.resnet.uky.edu:4836 ESTABLISHED
TCP your-2s4kn5k0h3:26097 zoo-fabrice.ekol.lu.se:2109 FIN_WAIT_1
TCP your-2s4kn5k0h3:26097 Phoebeluo.m8.ntu.edu.tw:2497 ESTABLISHED
TCP your-2s4kn5k0h3:26097 [removed]:4999 ESTABLISHED
TCP your-2s4kn5k0h3:26097 wnklmb01dc1-213-92.dynamic.mts.net:20896 ESTABL
ISHED
TCP your-2s4kn5k0h3:26097 stjhnf0122w-142162049055.pppoe-dynamic.nl.aliant
.net:60494 ESTABLISHED
TCP your-2s4kn5k0h3:26097 nat-147-226-209-238.bsu.edu:54029 ESTABLISHED
TCP your-2s4kn5k0h3:26097 AC8EF442.ipt.aol.com:4138 ESTABLISHED
TCP your-2s4kn5k0h3:26097 AC8F2698.ipt.aol.com:1332 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 AC90125F.ipt.aol.com:3150 SYN_RECEIVED
TCP your-2s4kn5k0h3:26097 ACBA56D5.ipt.aol.com:3757 ESTABLISHED
TCP your-2s4kn5k0h3:26097 ACBF7CDB.ipt.aol.com:3502 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 ACD51878.ipt.aol.com:2239 ESTABLISHED
TCP your-2s4kn5k0h3:26097 ACD66621.ipt.aol.com:3365 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 styx.kettering.edu:62840 ESTABLISHED
TCP your-2s4kn5k0h3:26097 217-63-208.0514.adsl.tele2.no:4569 TIME_WAIT
TCP your-2s4kn5k0h3:26097 host-194-46-226-88.dsl-ie.utvinternet.net:60546
TIME_WAIT
TCP your-2s4kn5k0h3:26097 [removed]:2590 CLOSING
TCP your-2s4kn5k0h3:26097 [removed]:3508 ESTABLISHED
TCP your-2s4kn5k0h3:26097 164-233-90.dial.terra.cl:63239 LAST_ACK
TCP your-2s4kn5k0h3:26097 164-233-90.dial.terra.cl:63301 CLOSING
TCP your-2s4kn5k0h3:26097 Dynamic-IP-cr20011882155.cable.net.co:1625 ESTA
BLISHED
TCP your-2s4kn5k0h3:26097 Dynamic-IP-cr20011888241.cable.net.co:1970 TIME
_WAIT
TCP your-2s4kn5k0h3:26097 200165021143.user.veloxzone.com.br:1752 ESTABLI
SHED
TCP your-2s4kn5k0h3:26097 [removed]:2105 TIME_WAIT
TCP your-2s4kn5k0h3:26097 201-26-34-46.dsl.telesp.net.br:1758 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 201-26-121-168.dsl.telesp.net.br:62813 TIME_WAI
T
TCP your-2s4kn5k0h3:26097 [removed]:63321 TIME_WAIT
TCP your-2s4kn5k0h3:26097 20179247023.user.veloxzone.com.br:4338 ESTABLIS
HED
TCP your-2s4kn5k0h3:26097 axmvnet-201-140-1-8.mtyxl.axtel.net:3949 CLOSE_
WAIT
TCP your-2s4kn5k0h3:26097 pc-46-162-239-201.cm.vtr.net:1307 CLOSE_WAIT
TCP your-2s4kn5k0h3:26097 201.247.214.24:1064 TIME_WAIT
^C
C:\Documents and Settings\Owner>
Hello and Welcome to the forum.

I can help you clean the PC but as for the netstat, I have no idea.


I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove if listed:
Viewpoint
Viewpoint Manager



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

Close ALL windows and browsers except HijackThis and click "Fix checked"


Delete this File if listed:
ALCXMNTR.EXE



Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI