I've been using this page on a regular basis for nearly a month and a half, my "output flows" had (previous to thursday) averaged around 300. Post thursday morning, 1500 minimum.
Have you talked to them about this? If you are using a router / cable modem box, I would unplug the
power from them for about 5 mins. That can help clear the junk out of those as well.
Actually, they suggested using Trojanhunter and the various non-ewido scans that I listed in the OP, with last resorts being a Hijackthis! log post since it's a fairly large campus and they're understaffed.
I'll try the unplug you suggested
You need to update SunJava.
Updating Java:
Download the latest version of
Java Runtime Environment (JRE) 5.0 Update 9. Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the [external image: Posted Image] icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-1_5_0_09-windowsi586-p.exe to install the newest version.
All removed, specified version installed
That's all I can think of. Don't forget to Remove the Power from those 2 devices if you have them.
I unplugged and made sure there was no source of power for the hardware I have access to, left it as such for approx 6 minutes.
I'll post another reply at the hour as an update
Thank ye kindly for your help
No change
I can't even imagine what's causing this
Have you added any software or hardware around the time this started?
Negative.
A week or two ago, however, McAfee detected the Malformed Archive (I'm not sure if it's a virus or a trojan or what) but it was seemingly irradicated. All signs of it were gone, flowswere normal, and none of my recent scans have found it. Is it possible these are related?
* Download
Combofix to your desktop.
Doubleclick
combo.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log
David - 06-10-02 21:33:28.73 Service Pack 2
ComboFix 06.09.28 - Running from: "C:\Program Files\Mozilla Firefox"
((((((((((((((((((((((((((((((( Files Created from 2006-09-02 to 2006-10-02 ))))))))))))))))))))))))))))))))))
2006-09-22 23:45 94,720 –a—— C:\WINDOWS\system32\dneinobj.dll
2006-09-22 23:45 110,080 –a—— C:\WINDOWS\system32\drivers\dne2000.sys
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-10-02 21:32 ——– d——– C:\Program Files\Mozilla Firefox
2006-10-02 20:25 ——– d——– C:\Program Files\Java
2006-10-02 20:25 ——– d——– C:\Program Files\Common Files\Java
2006-10-02 20:25 ——– d——– C:\Program Files\Common Files
2006-10-02 20:12 ——– d——– C:\Documents and Settings\David\Application Data\Adobe
2006-10-02 19:37 ——– d——– C:\Program Files\HJT
2006-10-02 17:05 ——– d——– C:\Program Files\ewido anti-spyware 4.0
2006-09-30 14:56 ——– d——– C:\Documents and Settings\David\Application Data\Lavasoft
2006-09-30 14:55 ——– d——– C:\Program Files\Lavasoft
2006-09-30 14:55 ——– d——– C:\Program Files\adaware
2006-09-30 14:35 ——– d——– C:\Program Files\TrojanHunter 4.6
2006-09-30 14:35 ——– d——– C:\Program Files\Internet Explorer
2006-09-30 14:35 ——– d——– C:\Program Files\Common Files\System
2006-09-30 14:35 ——– d——– C:\Program Files\bblean
2006-09-30 11:36 ——– d——– C:\Program Files\Hamachi
2006-09-30 11:36 ——– d——– C:\Documents and Settings\David\Application Data\Azureus
2006-09-26 20:30 ——– d——– C:\Documents and Settings\David\Application Data\TrojanHunter
2006-09-22 23:45 ——– d——– C:\Program Files\Common Files\Deterministic Networks
2006-09-22 23:43 ——– d——– C:\Program Files\VPN client
2006-09-08 14:49 ——– d——– C:\Documents and Settings\David\Application Data\dvdcss
2006-09-05 19:14 ——– d——– C:\Documents and Settings\David\Application Data\vlc
2006-09-05 18:24 ——– d——– C:\Program Files\VLC
2006-08-27 20:40 ——– d——– C:\Documents and Settings\David\Application Data\AdobeUM
2006-08-27 20:39 1419 –a—— C:\Documents and Settings\David\Application Data\AdobeDLM.log
2006-08-27 20:39 0 –a—— C:\Documents and Settings\David\Application Data\dm.ini
2006-08-27 20:21 ——– d——– C:\Program Files\PCRescue4.0
2006-08-27 19:32 ——– d——– C:\Program Files\Adobe
2006-08-27 19:26 ——– d——– C:\Program Files\Common Files\Adobe
2006-08-26 21:11 ——– d——– C:\Program Files\Cisco Systems
2006-08-22 17:31 ——– d——– C:\Documents and Settings\David\Application Data\HP
2006-08-22 16:33 ——– d——– C:\Program Files\HP
2006-08-22 16:33 ——– d——– C:\Program Files\Hewlett-Packard
2006-08-21 07:21 16896 –a—— C:\WINDOWS\system32\fltlib.dll
2006-08-21 04:14 23040 –a—— C:\WINDOWS\system32\fltmc.exe
2006-08-21 04:14 128896 –a—— C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-16 16:54 ——– d——– C:\Program Files\WinRAR
2006-08-15 16:18 ——– d—s—- C:\Documents and Settings\David\Application Data\Microsoft
2006-08-15 16:18 ——– d——– C:\Program Files\Western Digital Technologies
2006-08-11 01:14 98304 –a—— C:\WINDOWS\system32\CmdLineExt.dll
2006-08-10 15:45 ——– d——– C:\Documents and Settings\David\Application Data\Roxio
2006-08-10 15:36 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-08-10 15:20 ——– d——– C:\Documents and Settings\David\Application Data\InstallShield
2006-08-10 14:46 ——– d——– C:\Program Files\Common Files\Roxio Shared
2006-08-10 14:45 ——– d——– C:\Program Files\Roxio
2006-08-10 14:42 ——– d——– C:\Program Files\Common Files\InstallShield
2006-08-03 15:01 ——– d——– C:\Program Files\Common Files\Blizzard Entertainment
2006-08-03 12:49 ——– d——– C:\Documents and Settings\David\Application Data\Sun
2006-08-02 21:40 ——– d——– C:\Documents and Settings\David\Application Data\Macromedia
2006-08-02 05:42 ——– d——– C:\Program Files\Messenger
2006-08-02 05:36 ——– d——– C:\Program Files\Windows Media Player
2006-08-02 05:31 ——– d——– C:\Program Files\Outlook Express
2006-08-02 01:17 ——– d——– C:\Program Files\Common Files\Adobe Systems Shared
2006-08-02 01:17 ——– d——– C:\Program Files\Adobe Photoshop CS 8.0
2006-07-30 23:26 0 -rahs—- C:\MSDOS.SYS
2006-07-30 23:26 0 -rahs—- C:\IO.SYS
2006-07-30 23:26 0 –a—— C:\CONFIG.SYS
2006-07-30 23:26 0 –a—— C:\AUTOEXEC.BAT
2006-07-30 15:28 62 –ahs—- C:\Documents and Settings\David\Application Data\desktop.ini
2006-07-27 08:24 679424 –a—— C:\WINDOWS\system32\inetcomm.dll
2006-07-21 03:24 72704 –a—— C:\WINDOWS\system32\hlink.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent"
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"VSOCheckTask"="\"C:\\PROGRA~1\\McAfee.com\\VSO\\mcmnhdlr.exe\" /checktask"
"VirusScan Online"="C:\\Program Files\\McAfee.com\\VSO\\mcvsshld.exe"
"OASClnt"="C:\\Program Files\\McAfee.com\\VSO\\oasclnt.exe"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe"
"MCUpdateExe"="c:\\PROGRA~1\\mcafee.com\\agent\\McUpdate.exe"
"MPFExe"="C:\\PROGRA~1\\McAfee.com\\PERSON~1\\MpfTray.exe"
"MSKAGENTEXE"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MskAgent.exe"
"MSKDetectorExe"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MSKDetct.exe /startup"
"MPSExe"="c:\\PROGRA~1\\mcafee.com\\mps\\mscifapp.exe /embedding"
"Broadcom Wireless Manager UI"="C:\\WINDOWS\\system32\\WLTRAY.exe"
"IntelZeroConfig"="\"C:\\Program Files\\Intel\\Wireless\\bin\\ZCfgSvc.exe\""
"IntelWireless"="\"C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe\" /tf Intel PROSet/Wireless"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /installquiet"
"NVHotkey"="rundll32.exe nvHotkey.dll,Start"
"RoxioDragToDisc"="\"C:\\Program Files\\Roxio\\Easy Media Creator 7\\Drag to Disc\\DrgToDsc.exe\""
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"THGuard"="\"C:\\Program Files\\TrojanHunter 4.6\\THGuard.exe\""
"!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,98,00,00,00,00,00,00,00,e8,06,00,00,b0,04,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (DDONALD2-David).job
C:\WINDOWS\tasks\WebReg Deskjet 5400 series.job
Completion time: Mon 10/02/2006 21:33:46.68
ComboFix.txt
I just don't see anything, sorry.
Alright, thank you for your time, sir.
