Outlook 2003 Virus?
Dianne C
Running: Windows XP
A couple of days ago, I received a note from my ISP (Comcast) stating that
mass mailings were being sent from my account and that the capability of
sending email had been blocked by them.
I have utilized Windows Defender, AVG, and Ad-Aware (complete scan --- took
over 2 hours) to search for any issues; all have come up 'clean.' I can send
using Comcast's Webmail, but, Outlook still does not work. When I was on the
phone with Comcast's Tech Group, she had me change one of my ports to a
different number to see if that would help and it did not. So, aside from
running those programs I mentioned, and changing that port number (sorry, I
don't recall exactly where we were), nothing else has changed.
I tried the 'Detect & Repair' option in Outlook which was when I discovered
that I can't locate my original Outlook disk! I do have a disk from Dell that
is for 'Reinstalling Dell Tools System Software.' Its contents are supposed
to include: AV Software, Support Software, Multimedia Software, and Internet
Software. Not sure if MS Outlook may be in one of those?
Can anyone get me on the straight and narrow? I love Outlook and want it
back & fully functioning, again.
Oh, and I did go through previous posts, here, and found one from 2006 that
sounded VERY much like mine but it seemed the OP never returned, so, the
thread just dropped.
Thanks,
Roady [MVP]
turned off your computer and ask if they still see mass mailings coming from
you. If yes, you know it's Comcast drawing the wrong conclusions and wasting
your time.
--
Robert Sparnaaij [MVP-Outlook]
Coauthor, Configuring Microsoft Outlook 2003
http://www.howto-outlook.com/
Outlook FAQ, HowTo, Downloads, Add-Ins and more
http://www.msoutlook.info/
Real World Questions, Real World Answers
-----
"Dianne C" <Dia...@discussions.microsoft.com> wrote in message
news:85806E50-7FDF-4D8B...@microsoft.com...
Dianne C
Thank you for your reply.
Now I'm intrigued. Did I get the 'Scarlett S' from Comcast? ;-)
Seriously, though, is that something that they (reps on the phone) can see in
Real Time?
Also, if it were something that Comcast was .... uh .... "messing" up, how
do I get things set up to be able to use Outlook, again?
Thanks, again.
Roady [MVP]
result they are now blocking "something" which causes your Outlook not to
function as you've read in the email you got by Comcast and experienced by
yourself. You took your responsibility and checked (even triple checked)
your computer for malware and didn't find anything. It is now up to them to
unblock what they've blocked on your account.
I indeed question if they took appropriate steps in the first place and
correctly identified the root cause of the issue (being you). To get things
working again, it is my experience that you have to clearly state that they
either should unblock the restriction on your account or proof that you are
still causing issues on their network. Most phone reps indeed cannot do real
time checking but that doesn't keep them from claiming that they can and do.
Having them (not) do that while your comp is of is a good trick to call
their bluff.
--
Robert Sparnaaij [MVP-Outlook]
Coauthor, Configuring Microsoft Outlook 2003
http://www.howto-outlook.com/
Outlook FAQ, HowTo, Downloads, Add-Ins and more
http://www.msoutlook.info/
Real World Questions, Real World Answers
-----
"Dianne C" <Dia...@discussions.microsoft.com> wrote in message
news:691123AC-D84E-4802...@microsoft.com...
DL
the only people who can re-supply the cd
If Comcast have blocked sending then nothing you can do in OL will re-enable
it
Yes they can monitor in real time
"Dianne C" <Dia...@discussions.microsoft.com> wrote in message
news:691123AC-D84E-4802...@microsoft.com...
Dianne C
OK -- thanks, again, for all of your input. I just didn't want to have my
bluff called by Comcast reps and look like the idiot that I am when it comes
to these things. ;-)
I used to use Hijack This, years ago. It's a free download, isn't it? I'll
search it out and do that, as well.
Again - Thanks all around. :)
"N. Miller" wrote:
> On Thu, 27 Dec 2007 14:02:01 -0800, Dianne C wrote:
> >> Turn off you computer and contact Comcast. Don't tell them that you've
> >> turned off your computer and ask if they still see mass mailings coming from
> >> you. If yes, you know it's Comcast drawing the wrong conclusions and wasting
> >> your time.
>
> > Now I'm intrigued. Did I get the 'Scarlett S' from Comcast? ;-)
>
> You probably *do* have the 'Scarlet S' from the Spamhaus project...(see my
> log entries later in this post).
>
> > Seriously, though, is that something that they (reps on the phone) can see in
> > Real Time?
>
> Probably not; at least, not the normal CSR you talk with.
>
> > Also, if it were something that Comcast was .... uh .... "messing" up, how
> > do I get things set up to be able to use Outlook, again?
>
> It is really unlikely that Comcast has got it wrong. They would be going by
> logs. They do have a cap on email activity on residential accounts; I
> believe about 200 emails per hour:
>
> http://www.dslreports.com/forum/remark,19688413
>
> See the post by 'ajs4123'.
>
> Did you run Hijack This? I recommend a second opinion on your search for
> malware; it is a common problem on broadband Internet services. It is why
> Cox and Bellsouth put a block on outbound port 25 to SMTP servers other than
> there own; SBC did this, as well (both Bellsouth and SBC are now AT&T).
>
> I see a lot of connection attempts to my computer from Comcast residential
> IP addresses; most are not from MTAs:
>
> | T 20071227 082610 4772cd21 Connection from 75.68.188.133
> | T 20071227 082610 4772cd21 EHLO c-75-68-188-133.hsd1.vt.comcast.net
> | T 20071227 082611 4772cd21 MAIL FROM:<God...@helixe.com> SIZE=1189
> | E 20071227 082611 4772cd21 Host 75.68.188.133 blocked by Spamhaus - message rejected.
> | T 20071227 082611 4772cd21 QUIT
> | T 20071227 082611 4772cd21 Connection closed with 75.68.188.133, 1 sec. elapsed.
> |
> | T 20071227 135200 4772cd6a Connection from 76.16.143.18
> | T 20071227 135201 4772cd6a EHLO c-76-16-143-18.hsd1.il.comcast.net
> | T 20071227 135201 4772cd6a MAIL FROM:<Bharat...@berlim.brte.com.br> SIZE=1195
> | E 20071227 135201 4772cd6a Host 76.16.143.18 blocked by Spamhaus - message rejected.
> | T 20071227 135201 4772cd6a QUIT
> | T 20071227 135201 4772cd6a Connection closed with 76.16.143.18, 1 sec. elapsed.
>
> Those are just the most recent entries in my MTA logs. So, humor me (and
> Comcast), and see if HJT doesn't find anything suspicious. BTW, I am using
> the 'zen.spamhaus.org' zone:
>
> http://www.spamhaus.org/zen/
>
> ....which is why there is a "blocked by Spamhaus" note in the log entries.
>
> --
> Norman
> ~Oh Lord, why have you come
> ~To Konnyu, with the Lion and the Drum
>
Dianne C
You may need to speak slowly and use small words when replying to me, but, if
you could tell me if you see anything that may be causing my issues, I'd
greatly appreciate some guidance - or, if I need to be booted from this
[Outlook] forum, pls tell me where I should then go for that guidance. :)
Thank you.
Here's the logfile that I copied:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:22:08 PM, on 12/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\QuickTime\bak\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common
Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} -
C:\Program Files\NetZero\qsacc\x1IEBHO.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} -
C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -
C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\bak\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows
Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program
Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft
Money\System\mnyexpr.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe
/RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe
/RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe
/RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe
/RUNONCE (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: Display All Images with Full Quality -
"res://C:\Program Files\NetZero\qsacc\appres.dll/228"
O8 - Extra context menu item: Display Image with Full Quality -
"res://C:\Program Files\NetZero\qsacc\appres.dll/227"
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program
Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -
C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com -
{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program
Files\PartyPoker\PartyPoker.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no
file)
O9 - Extra button: MUSICMATCH MX Web Player -
{d81ca86b-ef63-42af-bee3-4502d9a03c2d} -
http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network
Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} -
C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net -
{F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program
Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} -
C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net/
O15 - Trusted Zone: *.whataboutadog.com
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner
Class) - http://www.comcastsupport.com/sdcxuser/asp/tgctlsr.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection
Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {10E0E75E-6701-4134-9D95-C0942ED1F1C8} (Snapfish Outlook Import
ActiveX Control) - http://www1.snapfish.com/SnapfishOutlookImport.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage
Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D9EFA3B-4E85-41A8-9092-14012CD447C9} (NetCamPlayerWeb Control)
- http://kerrycam.ourlinksys.com:1025/img/NetCamPlayerWeb.ocx
O16 - DPF: {21F16767-8DA7-4113-BEB0-F161B313407F} (XMirage Control) -
http://www.myfamily.com/plugins/ue/Install_UE.exe
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} -
http://www.miniclip.com/supergerball/miniclipGameLoader.dll
O16 - DPF: {3BA494B1-D507-4C11-9BDA-D47E1A65DFCF} (Confidence Online for Web
Applications) -
https://dnet.dom.com/llclient/dnetewpp/winxp/AXXPEE.dll,DanaInfo=D800033359.dominionnet.com,CT=java+
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) -
http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control)
- http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4
Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1171572851704
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) -
http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment
1.6.0) -
http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) -
http://65.40.167.144/activex/AxisCamControl.ocx
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} -
http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6}
(CacheManager.CacheManagerCtrl) -
http://www.candystand.com/assets/activex/virtools/CacheManager.CAB
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb
Class) - http://67.86.143.68:81/activex/AMC.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control)
- https://dnet.dom.com/dana-cached/setup/JuniperSetupSP1.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} -
https://livewc01.custhelp.com/7520-b289h-turbotax/rnl/java/RntX.cab
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) -
Unknown owner - C:\Program Files\Adobe\Photoshop Elements
4.0\PhotoshopElementsFileAgent.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program
Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel
32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program
Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -
C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation -
C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 10309 bytes
"N. Miller" wrote:
> On Thu, 27 Dec 2007 14:02:01 -0800, Dianne C wrote:
>
> > "Roady [MVP]" wrote:
> >> Turn off you computer and contact Comcast. Don't tell them that you've
> >> turned off your computer and ask if they still see mass mailings coming from
> >> you. If yes, you know it's Comcast drawing the wrong conclusions and wasting
> >> your time.
>
> > Now I'm intrigued. Did I get the 'Scarlett S' from Comcast? ;-)
>
> You probably *do* have the 'Scarlet S' from the Spamhaus project...(see my
> log entries later in this post).
>
> > Seriously, though, is that something that they (reps on the phone) can see in
> > Real Time?
>
> Probably not; at least, not the normal CSR you talk with.
>
> > Also, if it were something that Comcast was .... uh .... "messing" up, how
> > do I get things set up to be able to use Outlook, again?
>
Dianne C
I found and downloaded Trend Micro's Hijack This v2.0.2. This is my logfile:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:55:20 PM, on 12/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\QuickTime\bak\qttask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Money\System\mnyexpr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKUS\S-1-5-21-4021123949-3023086717-332755131-1009\..\Run: [ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe (User 'Dad')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe
/RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe
/RUNONCE (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: Display All Images with Full Quality -
"res://C:\Program Files\NetZero\qsacc\appres.dll/228"
O8 - Extra context menu item: Display Image with Full Quality -
"res://C:\Program Files\NetZero\qsacc\appres.dll/227"
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program
Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -
C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com -
{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program
Files\PartyPoker\PartyPoker.exe (file missing)
--
End of file - 10571 bytes
Is this telling me (you) anything?
I have also had a 'Eureka' moment (aka Blonde Moment) when I realized that
my children's machine is also on my cable connection. I will run the same
tests on their machine, as well. I believe I read in another post that the
best thing to do would be to start a separate thread for their machine?
Thanks very much for your time.
--
~Dianne
A computer lets you make more mistakes faster than any invention in human
history - with the possible exceptions of handguns and tequila.
~unknown
Dianne C
(Not certain that my email went through; I apologize if this is a duplicate
post)
I ran Trend Micro Hijack This v2.0.2 and got the following log:
--
~Dianne
A computer lets you make more mistakes faster than any invention in human
history - with the possible exceptions of handguns and tequila.
~unknown
"N. Miller" wrote:
> On Thu, 27 Dec 2007 14:02:01 -0800, Dianne C wrote:
>
> > "Roady [MVP]" wrote:
> >> Turn off you computer and contact Comcast. Don't tell them that you've
> >> turned off your computer and ask if they still see mass mailings coming from
> >> you. If yes, you know it's Comcast drawing the wrong conclusions and wasting
> >> your time.
>
> > Now I'm intrigued. Did I get the 'Scarlett S' from Comcast? ;-)
>
> You probably *do* have the 'Scarlet S' from the Spamhaus project...(see my
> log entries later in this post).
>
> > Seriously, though, is that something that they (reps on the phone) can see in
> > Real Time?
>
> Probably not; at least, not the normal CSR you talk with.
>
> > Also, if it were something that Comcast was .... uh .... "messing" up, how
> > do I get things set up to be able to use Outlook, again?
>