[feisele]

Blocked by Buffer Overflow Protection ....

I've included the Hijackthis log below. Any help would be greatly appreciated.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:14:13 PM, on 9/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\system32\CTsvcCDA.exe
H:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache

Group\Apache2\bin\apache.exe
H:\WINDOWS\system32\inetsrv\inetinfo.exe
H:\Program Files\Common Files\LightScribe\LSSrvc.exe
H:\Program Files\Network Associates\Common Framework\FrameworkService.exe
H:\Program Files\Network Associates\VirusScan\Mcshield.exe
H:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
H:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
H:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
H:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\SearchIndexer.exe
H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\mom.exe
H:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache

Group\Apache2\bin\apache.exe
H:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Analog Devices\SoundMAX\Smax4.exe
H:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
H:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
H:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
H:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\Common Files\Macrovision Shared\FLEXnet

Publisher\FNPLicensingService.exe
H:\Program Files\Analog Devices\Core\smax4pnp.exe
H:\Program Files\Microsoft IntelliType Pro\itype.exe
H:\Program Files\Microsoft IntelliPoint\ipoint.exe
H:\Program Files\HP\hpcoretech\hpcmpmgr.exe
H:\WINDOWS\system32\hphmon05.exe
H:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
H:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
H:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe
H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
H:\Program Files\NeoLink\app\NeoLink-server.exe
H:\Program Files\Windows Desktop Search\WindowsSearch.exe
H:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
H:\WINDOWS\system32\HPZipm12.exe
H:\Program Files\BitTorrent_DNA\dna.exe
H:\Program Files\NewsRover\NewsRover.exe
H:\Program Files\Internet Explorer\iexplore.exe
H:\Program Files\BitTorrent\bittorrent.exe
H:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
H:\WINDOWS\explorer.exe
H:\WINDOWS\system32\SearchProtocolHost.exe
H:\Documents and Settings\Frank Eisele\Local Settings\Temporary Internet

Files\Content.IE5\NF75H5M8\HiJackThis[1].exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

H:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper -

{AE7CD045-E861-484f-8273-0445EE161910} - H:\Program Files\Adobe\Acrobat

8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - H:\Program

Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMAX] "H:\Program Files\Analog

Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ShStatEXE] "H:\Program Files\Network

Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "H:\Program Files\Network

Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "H:\Program

Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "H:\Program Files\Adobe\Acrobat

8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\qttask.exe"

-atboottime
O4 - HKLM\..\Run: [iTunesHelper] "H:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] H:\Program Files\Analog

Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [itype] "H:\Program Files\Microsoft IntelliType

Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "H:\Program Files\Microsoft

IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]

H:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] H:\Program

Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "H:\Program

Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] H:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program

Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMS] H:\Program Files\Common

Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "H:\Program Files\Adobe\Adobe

Photoshop Lightroom\apdproxy.exe"
O4 - HKLM\..\RunServices: [mrtmon] mrtmon.exe
O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "H:\Program Files\Creative\Sync Manager

Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

"H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [StartCCC] H:\Program Files\ATI

Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "H:\Program Files\BitTorrent_DNA\dna.exe"
O4 - Global Startup: ASUS WiFi-AP Solo.lnk = H:\Program Files\ASUS WiFi-AP

Solo\RtWLan.exe
O4 - Global Startup: NeoLink.lnk = H:\Program

Files\NeoLink\app\NeoLink-server.exe
O4 - Global Startup: Windows Desktop Search.lnk = H:\Program Files\Windows

Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Append to existing PDF -

res://H:\PROGRA~1\Adobe\ACROBA~2.0\Acrobat\ACROIE~1.DLL/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF -

res://H:\PROGRA~1\Adobe\ACROBA~2.0\Acrobat\ACROIE~1.DLL/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF -

res://H:\PROGRA~1\Adobe\ACROBA~2.0\Acrobat\ACROIE~1.DLL/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF -

res://H:\PROGRA~1\Adobe\ACROBA~2.0\Acrobat\ACROIE~1.DLL/AcroIECaptureSelLinks.

html
O8 - Extra context menu item: Convert selected links to existing PDF -

res://H:\PROGRA~1\Adobe\ACROBA~2.0\Acrobat\ACROIE~1.DLL/AcroIEAppendSelLinks.h

tml
O8 - Extra context menu item: Convert selection to Adobe PDF -

res://H:\PROGRA~1\Adobe\ACROBA~2.0\Acrobat\ACROIE~1.DLL/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF -

res://H:\PROGRA~1\Adobe\ACROBA~2.0\Acrobat\ACROIE~1.DLL/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF -

res://H:\PROGRA~1\Adobe\ACROBA~2.0\Acrobat\ACROIE~1.DLL/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://H:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

H:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program

Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

H:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1F75C3DC-38E2-4424-A028-217AA4CB43CA} (NetCamMotionDetect Control)

- http://feisele.dyndns.org/adm/NetCamMotionDetect.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_

site.cab?1172279946593
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_

site.cab?1172279937843
O16 - DPF: {D7208880-9B7A-43E1-AABB-8C888A5704F9} (NetCamPlayerWeb11gv2

Control) - http://192.150.23.107/NetCamPlayerWeb11gv2.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -

H:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - H:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -

H:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution

- H:\Program Files\DynDNS Updater\DynDNS.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. -

H:\Program Files\Common Files\Macrovision Shared\FLEXnet

Publisher\FNPLicensingService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner

- H:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache

Software Foundation - H:\Program Files\NVIDIA

Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: LightScribeService Direct Disc Labeling Service

(LightScribeService) - Hewlett-Packard Company - H:\Program Files\Common

Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. -

H:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates,

Inc. - H:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network

Associates, Inc. - H:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NBService - Nero AG - H:\Program Files\Nero\Nero 7\Nero

BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - H:\Program Files\Common

Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - H:\Program

Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation -

H:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: Pml Driver HPZ12 - HP - H:\WINDOWS\system32\HPZipm12.exe
O24 - Desktop Component 0: (no name) -

file:///H:/DOCUME~1/FRANKE~1/LOCALS~1/Temp/msohtmlclip1/01/clip_image001.jpg

--
End of file - 11339 bytes