« previous next »
Pages: [1]   Go Down

Author Topic: tracking device  (Read 3500 times)

0 Members and 1 Guest are viewing this topic.

Offline Finch

  • Newbie
  • *
  • Posts: 7
tracking device
« on: February 28, 2006, 04:35:46 PM »
 This is a message I sent to Lavasoft, heard from them once to perform a scan based
on one extra criterion but produced nothing, haven't heard back sense I filed
results. Has anyone encountered this problem?

Thanks Ezra

For several months whenever online and off a window minimized appears on my start
bar. Very quickly it goes to the open program or web page so quickly that even if
I have my mouse there to click on it right or left I cannot stop or freeze it. Just
before it happens the hard drive will grunt the pointer arrow will turn to an hour
glass just for a split instant then 2 seconds latter it will appear with just a white
little window like the normal explorer window only with no (e) logo and no script
in the box. For instance if I have 5 windows open on the start bar, it will appear
at the end as if it slide out from the last one then shoot's to the open window or
program. This thing is buggin the **** out of me. I tried process watch in Ad-AWare
SE Pro it does not log it. Nor does Ad-Watch catch it. I am running ZoneAlarm Pro
and Computer Associates for virus. Your product was the latest addition and all have
been running perfectly together since the install. Everthing on this machine
is updated daily. I have resorted to three other products to try and catch this thing,
nothing, I removed them all right after.  What is this thing and How do I catch it.
Thanks hope you can help.

Logged

Offline GR@PH;<'S

  • Administrator
  • Hero Member
  • *****
  • Posts: 15651
    • http://www.taktmobiles.co.uk
Re: tracking device
« Reply #1 on: February 28, 2006, 04:56:52 PM »
Finch,
As a starting pont please can you make sure that you are using
Ad-aware SE Build 106
[if not Uninstall your old Ad-aware first then install SE]
Then use the WebUpDate
to get the latest Definition file
(SE1R.94.28.02.2006)
To do this Open Ad-aware
Click the WebUpDate
button at the top right hand side of the Ad-aware screen (The world globe).
Click "Connect"
Ad-aware will then download the latest  Definition file for you.
To make sure it is updated , look at the main
Ad-aware screen, and look under "Initialization Status"
It should say the Latest Definition file.
then scan  doing a  "Full Scan" and then post your logfile here by using the Add-Reply Feature .
As Logs are stored in :
C:\Documents and Settings\USERNAME\Application Data\Lavasoft\Ad-aware\Logs\.
An easy way to get there is to
click Start,
click Run
And type in and press ENTER: %appdata%
then click  Lavasoft
then Ad-Aware
and then Logs.
scroll down to find the latest one that you have
(by date & time)
and open it right Click select all
copy and then paste the contents of it here.
(Make sure that all of your Logfile has been posted, sometimes it will require two post's to get it all)
I recommend that you use the WebUpDate just before you scan that way you will always be up to date.

(note The Application Data is a hidden folder, so you will need to show hidden files and folders
and for Windows 98/ME users your logs are stored in
 C:\WINDOWS\All Users\Application Data\ ) by default
GR@PH;<'S   :breakkie:


Logged
press Enter then have a Brandy then if the problem is still there have another Brandy
Q: does it work
A: It does seem to for a few hours at least.

Offline Finch

  • Newbie
  • *
  • Posts: 7
Re: tracking device
« Reply #2 on: February 28, 2006, 10:13:55 PM »
Yes I am running the current version with the latest update from this morning, in fact I ran a scan after updating and sent it to Lavasoft just before posting here hoping to get a response but still nothing. Thanks for responding GR@PH;< here is the log report I saved it to desktop this morning for quick reference but thanks for the tip how to retrive it quickly.   


Ad-Aware SE Build 1.06r1
Logfile Created on:Tuesday, February 28, 2006 11:36:54 AM
Using definitions file:SE1R94 28.02.2006
Computer name:MACHINA
User name:Owner
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):12 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Search for low-risk threats
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Obtain command line of scanned processes
Set : Ignore spanned files when scanning cab archives
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Block pop-ups aggressively
Set : Automatically select problematic objects in results lists
Set : Include info about ignored objects in log file, if detected in scan
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include used command line parameters in log file
Set : Include computer and username in log file
Set : Include reference summary in log file
Set : Create log file for removal operations
Set : Include module list in log file
Set : Include alternate data stream details in log file
Set : Show splash screen
Set : Backup current definitions file before updating


2/28/2006 11:36:54 AM - Scan started. (Full System Scan)

 MRU List Object Recognized!
    Location:          : C:\Documents and Settings\Owner\Application Data\microsoft\office\recent
    Description        :


 MRU List Object Recognized!
    Location:          : C:\Documents and Settings\Owner\recent
    Description        :


 MRU List Object Recognized!
    Location:          : S-1-5-21-1993962763-2139871995-682003330-1003\software\lavasoft\reghance
    Description        :


 MRU List Object Recognized!
    Location:          : software\microsoft\directdraw\mostrecentapplication
    Description        :


 MRU List Object Recognized!
    Location:          : S-1-5-21-1993962763-2139871995-682003330-1003\software\microsoft\mediaplayer\preferences
    Description        :


 MRU List Object Recognized!
    Location:          : S-1-5-21-1993962763-2139871995-682003330-1003\software\microsoft\mediaplayer\preferences
    Description        :


 MRU List Object Recognized!
    Location:          : S-1-5-21-1993962763-2139871995-682003330-1003\software\microsoft\microsoft management console\recent file list
    Description        :


 MRU List Object Recognized!
    Location:          : S-1-5-21-1993962763-2139871995-682003330-1003\software\microsoft\search assistant\acmru
    Description        :


 MRU List Object Recognized!
    Location:          : S-1-5-21-1993962763-2139871995-682003330-1003\software\microsoft\windows\currentversion\applets\regedit
    Description        :


 MRU List Object Recognized!
    Location:          : S-1-5-21-1993962763-2139871995-682003330-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
    Description        :


 MRU List Object Recognized!
    Location:          : S-1-5-21-1993962763-2139871995-682003330-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
    Description        :


 MRU List Object Recognized!
    Location:          : S-1-5-21-1993962763-2139871995-682003330-1003\software\microsoft\windows\currentversion\explorer\recentdocs
    Description        :


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
    ModuleName         : \SystemRoot\System32\smss.exe
    Command Line       : n/a
    ProcessID          : 416
    ThreadCreationTime : 2/28/2006 4:22:31 PM
    BasePriority       : Normal

    Scanning Module:\SystemRoot\System32\smss.exe...
    Scanning Module:C:\WINDOWS\system32\ntdll.dll...

#:2 [csrss.exe]
    ModuleName         : \??\C:\WINDOWS\system32\csrss.exe
    Command Line       : C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestTh
    ProcessID          : 464
    ThreadCreationTime : 2/28/2006 4:22:32 PM
    BasePriority       : Normal

    Scanning Module:\??\C:\WINDOWS\system32\csrss.exe...
    Scanning Module:C:\WINDOWS\system32\CSRSRV.dll...
    Scanning Module:C:\WINDOWS\system32\basesrv.dll...
    Scanning Module:C:\WINDOWS\system32\winsrv.dll...
    Scanning Module:C:\WINDOWS\system32\GDI32.dll...
    Scanning Module:C:\WINDOWS\system32\KERNEL32.dll...
    Scanning Module:C:\WINDOWS\system32\USER32.dll...
    Scanning Module:C:\WINDOWS\system32\sxs.dll...
    Scanning Module:C:\WINDOWS\system32\ADVAPI32.dll...
    Scanning Module:C:\WINDOWS\system32\RPCRT4.dll...

#:3 [winlogon.exe]
    ModuleName         : \??\C:\WINDOWS\system32\winlogon.exe
    Command Line       : winlogon.exe
    ProcessID          : 488
    ThreadCreationTime : 2/28/2006 4:22:33 PM
    BasePriority       : High

    Scanning Module:\??\C:\WINDOWS\system32\winlogon.exe...
    Scanning Module:C:\WINDOWS\system32\AUTHZ.dll...
    Scanning Module:C:\WINDOWS\system32\msvcrt.dll...
    Scanning Module:C:\WINDOWS\system32\CRYPT32.dll...
    Scanning Module:C:\WINDOWS\system32\MSASN1.dll...
    Scanning Module:C:\WINDOWS\system32\NDdeApi.dll...
    Scanning Module:C:\WINDOWS\system32\PROFMAP.dll...
    Scanning Module:C:\WINDOWS\system32\NETAPI32.dll...
    Scanning Module:C:\WINDOWS\system32\USERENV.dll...
    Scanning Module:C:\WINDOWS\system32\PSAPI.DLL...
    Scanning Module:C:\WINDOWS\system32\REGAPI.dll...
    Scanning Module:C:\WINDOWS\system32\Secur32.dll...
    Scanning Module:C:\WINDOWS\system32\SETUPAPI.dll...
    Scanning Module:C:\WINDOWS\system32\VERSION.dll...
    Scanning Module:C:\WINDOWS\system32\WINSTA.dll...
    Scanning Module:C:\WINDOWS\system32\WINTRUST.dll...
    Scanning Module:C:\WINDOWS\system32\IMAGEHLP.dll...
    Scanning Module:C:\WINDOWS\system32\WS2_32.dll...
    Scanning Module:C:\WINDOWS\system32\WS2HELP.dll...
    Scanning Module:C:\WINDOWS\system32\MSGINA.dll...
    Scanning Module:C:\WINDOWS\system32\SHELL32.dll...
    Scanning Module:C:\WINDOWS\system32\SHLWAPI.dll...
    Scanning Module:C:\WINDOWS\system32\COMCTL32.dll...
    Scanning Module:C:\WINDOWS\system32\ODBC32.dll...
    Scanning Module:C:\WINDOWS\system32\comdlg32.dll...
    Scanning Module:C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll...
    Scanning Module:C:\WINDOWS\system32\odbcint.dll...
    Scanning Module:C:\WINDOWS\system32\SHSVCS.dll...
    Scanning Module:C:\WINDOWS\system32\sfc.dll...
    Scanning Module:C:\WINDOWS\system32\sfc_os.dll...
    Scanning Module:C:\WINDOWS\system32\ole32.dll...
    Scanning Module:C:\WINDOWS\system32\Apphelp.dll...
    Scanning Module:C:\WINDOWS\system32\WINSCARD.DLL...
    Scanning Module:C:\WINDOWS\system32\WTSAPI32.dll...
    Scanning Module:C:\WINDOWS\system32\uxtheme.dll...
    Scanning Module:C:\WINDOWS\system32\WINMM.dll...
    Scanning Module:C:\WINDOWS\system32\serwvdrv.dll...
    Scanning Module:C:\WINDOWS\system32\umdmxfrm.dll...
    Scanning Module:C:\WINDOWS\system32\SYNCOR11.DLL...
    Scanning Module:C:\WINDOWS\system32\cscdll.dll...
    Scanning Module:C:\WINDOWS\system32\WlNotify.dll...
    Scanning Module:C:\WINDOWS\system32\WINSPOOL.DRV...
    Scanning Module:C:\WINDOWS\system32\MPR.dll...
    Scanning Module:C:\WINDOWS\system32\rsaenh.dll...
    Scanning Module:C:\WINDOWS\system32\msv1_0.dll...
    Scanning Module:C:\WINDOWS\system32\iphlpapi.dll...
    Scanning Module:C:\WINDOWS\system32\SAMLIB.dll...
    Scanning Module:C:\WINDOWS\system32\cscui.dll...
    Scanning Module:C:\WINDOWS\system32\wdmaud.drv...
    Scanning Module:C:\WINDOWS\system32\msacm32.drv...
    Scanning Module:C:\WINDOWS\system32\MSACM32.dll...
    Scanning Module:C:\WINDOWS\system32\midimap.dll...
    Scanning Module:C:\WINDOWS\system32\MPRAPI.dll...
    Scanning Module:C:\WINDOWS\system32\ACTIVEDS.dll...
    Scanning Module:C:\WINDOWS\system32\adsldpc.dll...
    Scanning Module:C:\WINDOWS\system32\WLDAP32.dll...
    Scanning Module:C:\WINDOWS\system32\ATL.DLL...
    Scanning Module:C:\WINDOWS\system32\OLEAUT32.dll...
    Scanning Module:C:\WINDOWS\system32\rtutils.dll...
    Scanning Module:C:\WINDOWS\system32\xpsp2res.dll...
    Scanning Module:C:\WINDOWS\system32\NTMARTA.DLL...
    Scanning Module:C:\WINDOWS\system32\COMRes.dll...
    Scanning Module:C:\WINDOWS\system32\CLBCATQ.DLL...

#:4 [services.exe]
    ModuleName         : C:\WINDOWS\system32\services.exe
    Command Line       : C:\WINDOWS\system32\services.exe
    ProcessID          : 532
    ThreadCreationTime : 2/28/2006 4:22:33 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Services and Controller app
    InternalName       : services.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : services.exe
    Scanning Module:C:\WINDOWS\system32\services.exe...
    Scanning Module:C:\WINDOWS\system32\SCESRV.dll...
    Scanning Module:C:\WINDOWS\system32\umpnpmgr.dll...
    Scanning Module:C:\WINDOWS\system32\NCObjAPI.DLL...
    Scanning Module:C:\WINDOWS\system32\MSVCP60.dll...
    Scanning Module:C:\WINDOWS\system32\ShimEng.dll...
    Scanning Module:C:\WINDOWS\AppPatch\AcGenral.DLL...
    Scanning Module:C:\WINDOWS\system32\eventlog.dll...

#:5 [lsass.exe]
    ModuleName         : C:\WINDOWS\system32\lsass.exe
    Command Line       : C:\WINDOWS\system32\lsass.exe
    ProcessID          : 544
    ThreadCreationTime : 2/28/2006 4:22:33 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : LSA Shell (Export Version)
    InternalName       : lsass.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : lsass.exe
    Scanning Module:C:\WINDOWS\system32\lsass.exe...
    Scanning Module:C:\WINDOWS\system32\LSASRV.dll...
    Scanning Module:C:\WINDOWS\system32\NTDSAPI.dll...
    Scanning Module:C:\WINDOWS\system32\DNSAPI.dll...
    Scanning Module:C:\WINDOWS\system32\SAMSRV.dll...
    Scanning Module:C:\WINDOWS\system32\cryptdll.dll...
    Scanning Module:C:\WINDOWS\system32\msprivs.dll...
    Scanning Module:C:\WINDOWS\system32\kerberos.dll...
    Scanning Module:C:\WINDOWS\system32\netlogon.dll...
    Scanning Module:C:\WINDOWS\system32\w32time.dll...
    Scanning Module:C:\WINDOWS\system32\schannel.dll...
    Scanning Module:C:\WINDOWS\system32\wdigest.dll...
    Scanning Module:C:\WINDOWS\system32\scecli.dll...
    Scanning Module:C:\WINDOWS\system32\ipsecsvc.dll...
    Scanning Module:C:\WINDOWS\system32\oakley.DLL...
    Scanning Module:C:\WINDOWS\system32\WINIPSEC.DLL...
    Scanning Module:C:\WINDOWS\system32\pstorsvc.dll...
    Scanning Module:C:\WINDOWS\system32\mswsock.dll...
    Scanning Module:C:\WINDOWS\system32\hnetcfg.dll...
    Scanning Module:C:\WINDOWS\System32\wshtcpip.dll...
    Scanning Module:C:\WINDOWS\system32\psbase.dll...
    Scanning Module:C:\WINDOWS\system32\dssenh.dll...

#:6 [svchost.exe]
    ModuleName         : C:\WINDOWS\system32\svchost.exe
    Command Line       : C:\WINDOWS\system32\svchost -k DcomLaunch
    ProcessID          : 716
    ThreadCreationTime : 2/28/2006 4:22:34 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
    Scanning Module:C:\WINDOWS\system32\svchost.exe...
    Scanning Module:c:\windows\system32\rpcss.dll...
    Scanning Module:c:\windows\system32\termsrv.dll...
    Scanning Module:c:\windows\system32\ICAAPI.dll...
    Scanning Module:c:\windows\system32\mstlsapi.dll...
    Scanning Module:C:\WINDOWS\system32\msi.dll...

#:7 [svchost.exe]
    ModuleName         : C:\WINDOWS\system32\svchost.exe
    Command Line       : C:\WINDOWS\system32\svchost -k rpcss
    ProcessID          : 784
    ThreadCreationTime : 2/28/2006 4:22:35 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
    Scanning Module:C:\WINDOWS\System32\winrnr.dll...
    Scanning Module:C:\WINDOWS\system32\rasadhlp.dll...
    Scanning Module:C:\WINDOWS\System32\VetRedir.dll...
    Scanning Module:C:\WINDOWS\system32\ISafeIf.dll...

#:8 [svchost.exe]
    ModuleName         : C:\WINDOWS\System32\svchost.exe
    Command Line       : C:\WINDOWS\System32\svchost.exe -k netsvcs
    ProcessID          : 816
    ThreadCreationTime : 2/28/2006 4:22:35 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
    Scanning Module:c:\windows\system32\dhcpcsvc.dll...
    Scanning Module:c:\windows\system32\wzcsvc.dll...
    Scanning Module:c:\windows\system32\WMI.dll...
    Scanning Module:c:\windows\system32\ESENT.dll...
    Scanning Module:C:\WINDOWS\System32\rastls.dll...
    Scanning Module:C:\WINDOWS\system32\CRYPTUI.dll...
    Scanning Module:C:\WINDOWS\system32\WININET.dll...
    Scanning Module:C:\WINDOWS\System32\RASAPI32.dll...
    Scanning Module:C:\WINDOWS\System32\rasman.dll...
    Scanning Module:C:\WINDOWS\System32\TAPI32.dll...
    Scanning Module:C:\WINDOWS\System32\raschap.dll...
    Scanning Module:c:\windows\system32\schedsvc.dll...
    Scanning Module:C:\WINDOWS\System32\MSIDLE.DLL...
    Scanning Module:c:\windows\system32\audiosrv.dll...
    Scanning Module:c:\windows\system32\wkssvc.dll...
    Scanning Module:c:\windows\system32\ersvc.dll...
    Scanning Module:c:\windows\pchealth\helpctr\binaries\pchsvc.dll...
    Scanning Module:c:\windows\system32\cryptsvc.dll...
    Scanning Module:c:\windows\system32\certcli.dll...
    Scanning Module:c:\windows\system32\es.dll...
    Scanning Module:c:\windows\system32\netman.dll...
    Scanning Module:c:\windows\system32\netshell.dll...
    Scanning Module:c:\windows\system32\credui.dll...
    Scanning Module:c:\windows\system32\WZCSAPI.DLL...
    Scanning Module:c:\windows\system32\seclogon.dll...
    Scanning Module:c:\windows\system32\srsvc.dll...
    Scanning Module:c:\windows\system32\POWRPROF.dll...
    Scanning Module:c:\windows\system32\tapisrv.dll...
    Scanning Module:c:\windows\system32\trkwks.dll...
    Scanning Module:c:\windows\system32\wbem\wmisvc.dll...
    Scanning Module:C:\WINDOWS\system32\VSSAPI.DLL...
    Scanning Module:c:\windows\system32\wuauserv.dll...
    Scanning Module:C:\WINDOWS\system32\wuaueng.dll...
    Scanning Module:C:\WINDOWS\System32\ADVPACK.dll...
    Scanning Module:C:\WINDOWS\System32\SHFOLDER.dll...
    Scanning Module:C:\WINDOWS\System32\WINHTTP.dll...
    Scanning Module:C:\WINDOWS\System32\Cabinet.dll...
    Scanning Module:C:\WINDOWS\System32\mspatcha.dll...
    Scanning Module:C:\WINDOWS\system32\comsvcs.dll...
    Scanning Module:C:\WINDOWS\system32\colbact.DLL...
    Scanning Module:C:\WINDOWS\system32\MTXCLU.DLL...
    Scanning Module:C:\WINDOWS\system32\WSOCK32.dll...
    Scanning Module:C:\WINDOWS\System32\CLUSAPI.DLL...
    Scanning Module:C:\WINDOWS\System32\RESUTILS.DLL...
    Scanning Module:c:\windows\system32\sens.dll...
    Scanning Module:c:\windows\system32\ipnathlp.dll...
    Scanning Module:c:\windows\system32\wscsvc.dll...
    Scanning Module:C:\WINDOWS\System32\wbem\wbemcomn.dll...
    Scanning Module:C:\WINDOWS\System32\Wbem\wbemcore.dll...
    Scanning Module:C:\WINDOWS\System32\Wbem\esscli.dll...
    Scanning Module:C:\WINDOWS\System32\Wbem\FastProx.dll...
    Scanning Module:C:\WINDOWS\System32\wbem\wmiutils.dll...
    Scanning Module:C:\WINDOWS\System32\wbem\repdrvfs.dll...
    Scanning Module:C:\WINDOWS\System32\wbem\wmiprvsd.dll...
    Scanning Module:C:\WINDOWS\System32\wbem\wbemess.dll...
    Scanning Module:C:\WINDOWS\System32\wbem\ncprov.dll...
    Scanning Module:C:\WINDOWS\System32\netcfgx.dll...
    Scanning Module:C:\WINDOWS\System32\rasmans.dll...
    Scanning Module:C:\WINDOWS\System32\rastapi.dll...
    Scanning Module:C:\WINDOWS\System32\unimdm.tsp...
    Scanning Module:C:\WINDOWS\System32\uniplat.dll...
    Scanning Module:C:\WINDOWS\System32\unimdmat.dll...
    Scanning Module:C:\WINDOWS\system32\modemui.dll...
    Scanning Module:C:\WINDOWS\System32\kmddsp.tsp...
    Scanning Module:C:\WINDOWS\System32\ndptsp.tsp...
    Scanning Module:C:\WINDOWS\System32\ipconf.tsp...
    Scanning Module:C:\WINDOWS\System32\h323.tsp...
    Scanning Module:C:\WINDOWS\System32\hidphone.tsp...
    Scanning Module:C:\WINDOWS\System32\HID.DLL...
    Scanning Module:C:\WINDOWS\System32\rasppp.dll...
    Scanning Module:C:\WINDOWS\System32\ntlsapi.dll...
    Scanning Module:C:\WINDOWS\System32\RASDLG.dll...
    Scanning Module:C:\WINDOWS\system32\WUPS.DLL...
    Scanning Module:C:\WINDOWS\system32\MSXML3.DLL...
    Scanning Module:C:\WINDOWS\System32\upnp.dll...
    Scanning Module:C:\WINDOWS\System32\SSDPAPI.dll...

#:9 [svchost.exe]
    ModuleName         : C:\WINDOWS\System32\svchost.exe
    Command Line       : C:\WINDOWS\System32\svchost.exe -k NetworkService
    ProcessID          : 880
    ThreadCreationTime : 2/28/2006 4:22:35 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
    Scanning Module:c:\windows\system32\dnsrslvr.dll...

#:10 [svchost.exe]
    ModuleName         : C:\WINDOWS\System32\svchost.exe
    Command Line       : C:\WINDOWS\System32\svchost.exe -k LocalService
    ProcessID          : 904
    ThreadCreationTime : 2/28/2006 4:22:35 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
    Scanning Module:c:\windows\system32\lmhsvc.dll...
    Scanning Module:c:\windows\system32\webclnt.dll...
    Scanning Module:C:\WINDOWS\system32\urlmon.dll...
    Scanning Module:c:\windows\system32\alrsvc.dll...

#:11 [spoolsv.exe]
    ModuleName         : C:\WINDOWS\system32\spoolsv.exe
    Command Line       : C:\WINDOWS\system32\spoolsv.exe
    ProcessID          : 1044
    ThreadCreationTime : 2/28/2006 4:22:36 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)
    ProductVersion     : 5.1.2600.2696
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Spooler SubSystem App
    InternalName       : spoolsv.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : spoolsv.exe
    Scanning Module:C:\WINDOWS\system32\spoolsv.exe...
    Scanning Module:C:\WINDOWS\system32\SPOOLSS.DLL...
    Scanning Module:C:\WINDOWS\system32\localspl.dll...
    Scanning Module:C:\WINDOWS\system32\cnbjmon.dll...
    Scanning Module:C:\WINDOWS\system32\hpzsnt10.dll...
    Scanning Module:C:\WINDOWS\system32\lprmon.dll...
    Scanning Module:C:\WINDOWS\system32\LPRHELP.dll...
    Scanning Module:C:\WINDOWS\system32\mdimon.dll...
    Scanning Module:C:\WINDOWS\system32\FXSMON.DLL...
    Scanning Module:C:\WINDOWS\system32\FXSEVENT.dll...
    Scanning Module:C:\WINDOWS\system32\pjlmon.dll...
    Scanning Module:C:\WINDOWS\system32\tcpmon.dll...
    Scanning Module:C:\WINDOWS\system32\usbmon.dll...
    Scanning Module:C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll...
    Scanning Module:C:\WINDOWS\system32\win32spl.dll...
    Scanning Module:C:\WINDOWS\system32\NETRAP.dll...
    Scanning Module:C:\WINDOWS\system32\inetpp.dll...

#:12 [isafe.exe]
    ModuleName         : C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
    Command Line       : "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe"
    ProcessID          : 1220
    ThreadCreationTime : 2/28/2006 4:22:37 PM
    BasePriority       : Normal
    FileVersion        : Version 11.0.5.3
    ProductVersion     : Version 11.0.5.3
    ProductName        : Computer Associates Antivirus
    CompanyName        : Computer Associates International, Inc.
    FileDescription    : CA ISafe Service
    InternalName       : ISafe
    LegalCopyright     : © 2004 Computer Associates International, Inc.
    LegalTrademarks    : Trademark of Computer Associates International, Inc.
    OriginalFilename   : ISafe.exe
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe...
    Scanning Module:C:\WINDOWS\system32\iSafProd.dll...
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\Arclib.dll...
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafeEngine.dll...

#:13 [cisvc.exe]
    ModuleName         : C:\WINDOWS\System32\cisvc.exe
    Command Line       : C:\WINDOWS\System32\cisvc.exe
    ProcessID          : 1260
    ThreadCreationTime : 2/28/2006 4:22:37 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Content Index service
    InternalName       : cisvc.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : cisvc.exe
    Scanning Module:C:\WINDOWS\System32\cisvc.exe...
    Scanning Module:C:\WINDOWS\System32\query.dll...

#:14 [smagent.exe]
    ModuleName         : C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    Command Line       : "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe"
    ProcessID          : 1364
    ThreadCreationTime : 2/28/2006 4:22:38 PM
    BasePriority       : Normal
    FileVersion        : 3, 2, 5, 0
    ProductVersion     : 3, 2, 5, 0
    ProductName        : SoundMAX service agent
    CompanyName        : Analog Devices, Inc.
    FileDescription    : SoundMAX service agent component
    InternalName       : SMAgent
    LegalCopyright     : Copyright © 2002
    OriginalFilename   : SMAgent.exe
    Scanning Module:C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe...

#:15 [svchost.exe]
    ModuleName         : C:\WINDOWS\System32\svchost.exe
    Command Line       : C:\WINDOWS\System32\svchost.exe -k imgsvc
    ProcessID          : 1420
    ThreadCreationTime : 2/28/2006 4:22:38 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe
    Scanning Module:c:\windows\system32\wiaservc.dll...
    Scanning Module:c:\windows\system32\CFGMGR32.dll...
    Scanning Module:c:\windows\system32\mscms.dll...
    Scanning Module:C:\WINDOWS\system32\hpgwiamd.dll...
    Scanning Module:C:\WINDOWS\system32\hpgt46.dll...
    Scanning Module:C:\WINDOWS\system32\ACTXPRXY.DLL...

#:16 [explorer.exe]
    ModuleName         : C:\WINDOWS\Explorer.EXE
    Command Line       : C:\WINDOWS\Explorer.EXE
    ProcessID          : 1444
    ThreadCreationTime : 2/28/2006 4:22:39 PM
    BasePriority       : Normal
    FileVersion        : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 6.00.2900.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows Explorer
    InternalName       : explorer
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : EXPLORER.EXE
    Scanning Module:C:\WINDOWS\Explorer.EXE...
    Scanning Module:C:\WINDOWS\system32\BROWSEUI.dll...
    Scanning Module:C:\WINDOWS\system32\SHDOCVW.dll...
    Scanning Module:C:\WINDOWS\System32\themeui.dll...
    Scanning Module:C:\WINDOWS\System32\MSIMG32.dll...
    Scanning Module:C:\WINDOWS\system32\mlang.dll...
    Scanning Module:C:\WINDOWS\System32\mshtml.dll...
    Scanning Module:C:\WINDOWS\System32\msls31.dll...
    Scanning Module:C:\WINDOWS\system32\sensapi.dll...
    Scanning Module:C:\WINDOWS\System32\shdoclc.dll...
    Scanning Module:C:\WINDOWS\system32\ntshrui.dll...
    Scanning Module:C:\WINDOWS\system32\LINKINFO.dll...
    Scanning Module:C:\WINDOWS\System32\msimtf.dll...
    Scanning Module:C:\WINDOWS\System32\MSCTF.dll...
    Scanning Module:C:\WINDOWS\system32\IMM32.DLL...
    Scanning Module:C:\WINDOWS\System32\webcheck.dll...
    Scanning Module:C:\WINDOWS\System32\stobject.dll...
    Scanning Module:C:\WINDOWS\System32\BatMeter.dll...
    Scanning Module:C:\WINDOWS\system32\fxsst.dll...
    Scanning Module:C:\WINDOWS\system32\FXSAPI.dll...
    Scanning Module:C:\WINDOWS\System32\drprov.dll...
    Scanning Module:C:\WINDOWS\System32\ntlanman.dll...
    Scanning Module:C:\WINDOWS\System32\NETUI0.dll...
    Scanning Module:C:\WINDOWS\System32\NETUI1.dll...
    Scanning Module:C:\WINDOWS\System32\davclnt.dll...
    Scanning Module:C:\WINDOWS\system32\wzcdlg.dll...
    Scanning Module:C:\WINDOWS\system32\mobsync.dll...

#:17 [wdfmgr.exe]
    ModuleName         : C:\WINDOWS\system32\wdfmgr.exe
    Command Line       : C:\WINDOWS\system32\wdfmgr.exe
    ProcessID          : 1452
    ThreadCreationTime : 2/28/2006 4:22:39 PM
    BasePriority       : Normal
    FileVersion        : 5.2.3790.1230 built by: dnsrv(bld4act)
    ProductVersion     : 5.2.3790.1230
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows User Mode Driver Manager
    InternalName       : WdfMgr
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : WdfMgr.exe
    Scanning Module:C:\WINDOWS\system32\wdfmgr.exe...

#:18 [imonnt.exe]
    ModuleName         : C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
    Command Line       : "C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe"
    ProcessID          : 1572
    ThreadCreationTime : 2/28/2006 4:22:39 PM
    BasePriority       : Normal
    FileVersion        : 1.1.8.141
    ProductVersion     : 1, 0, 0, 1
    ProductName        : Intel(R) Active Monitor
    CompanyName        : Intel Corp.
    FileDescription    : Intel(R) Active Monitor Win9x Background Service
    InternalName       : imonNT
    LegalCopyright     : Copyright © Intel Corp. 2000
    OriginalFilename   : imonNT.exe
    Scanning Module:C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe...
    Scanning Module:C:\Program Files\Intel\Intel(R) Active Monitor\IMONRES.LRC...
    Scanning Module:C:\WINDOWS\system32\SensorDLL.DLL...

#:19 [smtray.exe]
    ModuleName         : C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
    Command Line       : "C:\Program Files\Analog Devices\SoundMAX\Smtray.exe"
    ProcessID          : 188
    ThreadCreationTime : 2/28/2006 4:22:43 PM
    BasePriority       : Normal
    FileVersion        : 3, 2, 10, 0
    ProductVersion     : 3, 2, 10, 0
    ProductName        : SoundMAX Integrated Digital Audio
    CompanyName        : Analog Devices, Inc.
    FileDescription    : SoundMAX System Tray
    InternalName       : SMTray
    LegalCopyright     : Copyright © 2001 Analog Devices
    OriginalFilename   : SMTray.exe
    Scanning Module:C:\Program Files\Analog Devices\SoundMAX\Smtray.exe...
    Scanning Module:C:\WINDOWS\system32\MFC42.DLL...

#:20 [alg.exe]
    ModuleName         : C:\WINDOWS\System32\alg.exe
    Command Line       : C:\WINDOWS\System32\alg.exe
    ProcessID          : 228
    ThreadCreationTime : 2/28/2006 4:22:44 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Application Layer Gateway Service
    InternalName       : ALG.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : ALG.exe
    Scanning Module:C:\WINDOWS\System32\alg.exe...

#:21 [hkcmd.exe]
    ModuleName         : C:\WINDOWS\System32\hkcmd.exe
    Command Line       : "C:\WINDOWS\System32\hkcmd.exe"
    ProcessID          : 240
    ThreadCreationTime : 2/28/2006 4:22:44 PM
    BasePriority       : Normal
    FileVersion        : 3,0,0,1847
    ProductVersion     : 7,0,0,1847
    ProductName        : Intel(R) Common User Interface
    CompanyName        : Intel Corporation
    FileDescription    : hkcmd Module
    InternalName       : HKCMD
    LegalCopyright     : Copyright 1999-2002, Intel Corporation
    OriginalFilename   : HKCMD.EXE
    Scanning Module:C:\WINDOWS\System32\hkcmd.exe...
    Scanning Module:C:\WINDOWS\System32\hccutils.DLL...
    Scanning Module:C:\WINDOWS\System32\igfxdev.dll...
    Scanning Module:C:\WINDOWS\System32\igfxsrvc.dll...
    Scanning Module:C:\WINDOWS\System32\igfxhk.dll...
    Scanning Module:C:\WINDOWS\System32\igfxres.dll...

#:22 [imontray.exe]
    ModuleName         : C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
    Command Line       : "C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe"
    ProcessID          : 248
    ThreadCreationTime : 2/28/2006 4:22:44 PM
    BasePriority       : Normal
    FileVersion        : 1.1.8.141
    ProductVersion     : 1, 0, 0, 1
    ProductName        : imontray Application
    FileDescription    : imontray MFC Application
    InternalName       : imontray
    LegalCopyright     : Copyright (C) 2000
    OriginalFilename   : imontray.EXE
    Scanning Module:C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe...

#:23 [hpgs2wnd.exe]
    ModuleName         : C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    Command Line       : "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"
    ProcessID          : 264
    ThreadCreationTime : 2/28/2006 4:22:44 PM
    BasePriority       : Normal
    FileVersion        : 2,3,0,0\ 162
    ProductVersion     : 2,3,0,0\ 162
    ProductName        : Hewlett-Packard hpgs2wnd
    CompanyName        : Hewlett-Packard
    FileDescription    : hpgs2wnd
    InternalName       : hpgs2wnd
    LegalCopyright     : Copyright © 2001
    OriginalFilename   : hpgs2wnd.exe
    Scanning Module:C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe...
    Scanning Module:C:\Program Files\Hewlett-Packard\HP Share-to-Web\S2WNSRES.DLL...
    Scanning Module:C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnfps.dll...

#:24 [wkufind.exe]
    ModuleName         : C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    Command Line       : "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe"
    ProcessID          : 336
    ThreadCreationTime : 2/28/2006 4:22:44 PM
    BasePriority       : Normal
    FileVersion        : 7.00.0716.0
    ProductVersion     : 7.00.0716.0
    ProductName        : Update Detection Module
    CompanyName        : Microsoft® Corporation
    FileDescription    : Microsoft® Works Update Detection
    InternalName       : WkUFind
    LegalCopyright     : Copyright © 1987-2002 Microsoft Corporation.
    OriginalFilename   : WkUFind.exe
    Scanning Module:C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe...
    Scanning Module:C:\WINDOWS\system32\MSVCR70.dll...

#:25 [cavtray.exe]
    ModuleName         : C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
    Command Line       : "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
    ProcessID          : 344
    ThreadCreationTime : 2/28/2006 4:22:44 PM
    BasePriority       : Normal
    FileVersion        : Version 11.0.5.3
    ProductVersion     : Version 11.0.5.3
    ProductName        : Computer Associates Antivirus
    CompanyName        : Computer Associates International, Inc.
    FileDescription    : CA Antivirus System Tray Application
    InternalName       : CAVTray
    LegalCopyright     : © 2004 Computer Associates International, Inc.
    LegalTrademarks    : Trademark of Computer Associates International, Inc.
    OriginalFilename   : CAVTray.exe
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe...
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVScan.dll...
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\DriverIf.dll...
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVFrm.dll...
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\EZAVLic.dll...
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVProd.dll...
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVres.dll...

#:26 [cavrid.exe]
    ModuleName         : C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
    Command Line       : "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
    ProcessID          : 332
    ThreadCreationTime : 2/28/2006 4:22:45 PM
    BasePriority       : Normal
    FileVersion        : Version 11.0.5.3
    ProductVersion     : Version 11.0.5.3
    ProductName        : Computer Associates Antivirus
    CompanyName        : Computer Associates International, Inc.
    FileDescription    : CA Antivirus Realtime Infection Report
    InternalName       : CAVRid
    LegalCopyright     : © 2004 Computer Associates International, Inc.
    LegalTrademarks    : Trademark of Computer Associates International, Inc.
    OriginalFilename   : CAVRid.exe
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe...

#:27 [hpcmpmgr.exe]
    ModuleName         : C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    Command Line       : "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    ProcessID          : 436
    ThreadCreationTime : 2/28/2006 4:22:45 PM
    BasePriority       : Normal
    FileVersion        : 2.1.1.0
    ProductVersion     : 2.1.6.2
    ProductName        : hp coretech  (COmponent REuse TECHnology)
    CompanyName        : Hewlett-Packard Company
    FileDescription    : HP Framework Component Manager Service
    InternalName       : HPComponentManagerService module
    LegalCopyright     : Copyright (C) Hewlett-Packard. 2002-2005
    OriginalFilename   : HpCmpMgr.exe
    Scanning Module:C:\Program Files\HP\hpcoretech\hpcmpmgr.exe...
    Scanning Module:C:\Program Files\HP\hpcoretech\HPVCR70.dll...
    Scanning Module:C:\WINDOWS\system32\MSXML4.dll...

#:28 [hpwuschd2.exe]
    ModuleName         : C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
    Command Line       : "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
    ProcessID          : 448
    ThreadCreationTime : 2/28/2006 4:22:45 PM
    BasePriority       : Normal
    FileVersion        : 50.0.146.000
    ProductVersion     : 050.000.146.000
    ProductName        : hp digital imaging - hp all-in-one series
    CompanyName        : Hewlett-Packard Co.
    FileDescription    : Hewlett-Packard Product Assistant
    InternalName       : hpwuSchd2
    LegalCopyright     : Copyright (C) Hewlett-Packard Co. 1995-2004
    OriginalFilename   : hpwuSchd2.exe
    Comments           : Hewlett-Packard Product Assistant
    Scanning Module:C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe...

#:29 [zlclient.exe]
    ModuleName         : C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    Command Line       : n/a
    ProcessID          : 700
    ThreadCreationTime : 2/28/2006 4:22:45 PM
    BasePriority       : Normal
    FileVersion        : 6.1.737.000
    ProductVersion     : 6.1.737.000
    ProductName        : Zone Labs Client
    CompanyName        : Zone Labs, LLC
    FileDescription    : Zone Labs Client
    InternalName       : zlclient
    LegalCopyright     : Copyright © 1998-2005, Zone Labs, LLC
    OriginalFilename   : zlclient.exe
    Scanning Module:C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe...
    Scanning Module:C:\WINDOWS\system32\VSUTIL.dll...
    Scanning Module:C:\WINDOWS\system32\VSINIT.dll...
    Scanning Module:C:\WINDOWS\system32\VSPUBAPI.dll...
    Scanning Module:C:\Program Files\Zone Labs\ZoneAlarm\framewrk.dll...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\dbghelp.dll...
    Scanning Module:C:\WINDOWS\system32\vsdata.dll...
    Scanning Module:C:\WINDOWS\system32\vsmonapi.dll...
    Scanning Module:C:\WINDOWS\system32\zlcomm.dll...
    Scanning Module:C:\WINDOWS\system32\ZLCommDB.dll...
    Scanning Module:C:\WINDOWS\system32\vsxml.dll...
    Scanning Module:C:\Program Files\Zone Labs\ZoneAlarm\alert.zap...
    Scanning Module:C:\Program Files\Zone Labs\ZoneAlarm\cam.zap...
    Scanning Module:C:\Program Files\Zone Labs\ZoneAlarm\email.zap...
    Scanning Module:C:\Program Files\Zone Labs\ZoneAlarm\filter.zap...
    Scanning Module:C:\Program Files\Zone Labs\ZoneAlarm\firewall.zap...
    Scanning Module:C:\Program Files\Zone Labs\ZoneAlarm\idlock.zap...
    Scanning Module:C:\Program Files\Zone Labs\ZoneAlarm\privacy.zap...
    Scanning Module:C:\Program Files\Zone Labs\ZoneAlarm\programs.zap...
    Scanning Module:C:\Program Files\Zone Labs\ZoneAlarm\scan.zap...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\camupd.dll...
    Scanning Module:C:\Program Files\Zone Labs\ZoneAlarm\security.zap...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\zlsre.dll...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\scheduler.dll...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\zlparser.dll...

#:30 [hpgs2wnf.exe]
    ModuleName         : C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    Command Line       : "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe" -Embedding
    ProcessID          : 596
    ThreadCreationTime : 2/28/2006 4:22:45 PM
    BasePriority       : Normal
    FileVersion        : 2, 6, 0, 162
    ProductVersion     : 2, 6, 0, 162
    ProductName        : hpgs2wnf Module
    FileDescription    : hpgs2wnf Module
    InternalName       : hpgs2wnf
    LegalCopyright     : Copyright 2001
    OriginalFilename   : hpgs2wnf.EXE
    Scanning Module:C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe...

#:31 [vsmon.exe]
    ModuleName         : C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    Command Line       : n/a
    ProcessID          : 1688
    ThreadCreationTime : 2/28/2006 4:22:48 PM
    BasePriority       : Normal
    FileVersion        : 6.1.737.000
    ProductVersion     : 6.1.737.000
    ProductName        : TrueVector Service
    CompanyName        : Zone Labs, LLC
    FileDescription    : TrueVector Service
    InternalName       : vsmon
    LegalCopyright     : Copyright © 1998-2005, Zone Labs, LLC
    OriginalFilename   : vsmon.exe
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\vsmon.exe...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\SSLEAY32.dll...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\vsdb.dll...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\VSRULEDB.DLL...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\vsvault.dll...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\zlquarantine.dll...
    Scanning Module:C:\WINDOWS\System32\wbem\wbemprox.dll...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\qrbase.dll...
    Scanning Module:C:\WINDOWS\System32\wbem\wbemsvc.dll...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\srescan.dll...
    Scanning Module:C:\WINDOWS\system32\ZoneLabs\vsavpro.dll...

#:32 [hpqgalry.exe]
    ModuleName         : C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe
    Command Line       : "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe" -s
    ProcessID          : 1980
    ThreadCreationTime : 2/28/2006 4:22:49 PM
    BasePriority       : Normal

    Scanning Module:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqgalry.exe...
    Scanning Module:C:\WINDOWS\system32\mscoree.dll...
    Scanning Module:C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll...
    Scanning Module:C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSVCR71.dll...
    Scanning Module:C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll...
    Scanning Module:c:\windows\microsoft.net\framework\v1.1.4322\mscorlib.dll...
    Scanning Module:c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_5ba70e32\mscorlib.dll...
    Scanning Module:C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll...
    Scanning Module:c:\windows\assembly\gac\hpqiface\3.0.0.0__a53cf5803f4c3827\hpqiface.dll...
    Scanning Module:c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll...
    Scanning Module:c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_d2a4ad6a\system.windows.forms.dll...
    Scanning Module:C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSCORJIT.DLL...
    Scanning Module:c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll...
    Scanning Module:c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_40bfd671\system.dll...
    Scanning Module:c:\windows\assembly\gac\hpqutils\3.0.0.0__a53cf5803f4c3827\hpqutils.dll...
    Scanning Module:c:\windows\assembly\gac\hpqfmrsc\3.0.0.0__a53cf5803f4c3827\hpqfmrsc.dll...
    Scanning Module:c:\windows\assembly\gac\hpqgldlg\3.0.0.0__a53cf5803f4c3827\hpqgldlg.dll...
    Scanning Module:c:\windows\assembly\gac\hpqtray\3.0.0.0__a53cf5803f4c3827\hpqtray.dll...
    Scanning Module:c:\windows\assembly\gac\hpqgskin\3.0.0.0__a53cf5803f4c3827\hpqgskin.dll...
    Scanning Module:c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll...
    Scanning Module:c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_68397558\system.drawing.dll...
    Scanning Module:c:\program files\hewlett-packard\digital imaging\bin\en\hpqgalry.resources.dll...
    Scanning Module:C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\gdiplus.dll...
    Scanning Module:c:\windows\assembly\gac\hpqptfnd\3.0.0.0__a53cf5803f4c3827\hpqptfnd.dll...
    Scanning Module:c:\windows\assembly\gac\interop.hpqcxm08\3.0.0.0__a53cf5803f4c3827\interop.hpqcxm08.dll...
    Scanning Module:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcxm08.dll...
    Scanning Module:c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll...
    Scanning Module:c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_b1c1ec75\system.xml.dll...
    Scanning Module:c:\windows\assembly\gac\lead\13.0.0.66__9cf889f53ea9b907\lead.dll...
    Scanning Module:c:\windows\assembly\gac\lead.wrapper\13.0.0.66__9cf889f53ea9b907\lead.wrapper.dll...
    Scanning Module:C:\Program Files\Hewlett-Packard\Digital Imaging\bin\ltkrn13n.dll...
    Scanning Module:c:\windows\assembly\gac\hpqimgrc\3.0.0.0__a53cf58
Logged

Offline Finch

  • Newbie
  • *
  • Posts: 7
Re: tracking device
« Reply #3 on: February 28, 2006, 10:27:17 PM »
This is the rermainder of the log.

 Scanning Module:C:\WINDOWS\system32\MSVCP71.dll...
    Scanning Module:C:\WINDOWS\system32\MFC71ENU.DLL...
    Scanning Module:c:\windows\assembly\gac\hpqasset\3.0.0.0__a53cf5803f4c3827\hpqasset.dll...
    Scanning Module:c:\windows\assembly\gac\hpqccrsc\3.0.0.0__a53cf5803f4c3827\hpqccrsc.dll...
    Scanning Module:c:\windows\assembly\gac\accessibility\1.0.5000.0__b03f5f7f11d50a3a\accessibility.dll...
    Scanning Module:c:\program files\hewlett-packard\digital imaging\bin\hpqmirsc.dll...
    Scanning Module:c:\program files\hewlett-packard\digital imaging\bin\en\hpqmirsc.resources.dll...
    Scanning Module:c:\windows\assembly\gac\hpqietpz\3.0.0.0__a53cf5803f4c3827\hpqietpz.dll...
    Scanning Module:c:\windows\assembly\gac\hpqcprsc\3.0.0.0__a53cf5803f4c3827\hpqcprsc.dll...
    Scanning Module:c:\windows\assembly\gac\hpqcprsc.resources\3.0.0.0_en_a53cf5803f4c3827\hpqcprsc.resources.dll...
    Scanning Module:c:\windows\assembly\gac\hpqisrtb\4.0.0.0__a53cf5803f4c3827\hpqisrtb.dll...
    Scanning Module:c:\windows\assembly\gac\hpqthumb\3.0.0.0__a53cf5803f4c3827\hpqthumb.dll...

#:33 [vetmsg.exe]
    ModuleName         : C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
    Command Line       : "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe"
    ProcessID          : 3064
    ThreadCreationTime : 2/28/2006 4:29:35 PM
    BasePriority       : Normal
    FileVersion        : Version 11.0.5.3
    ProductVersion     : Version 11.0.5.3
    ProductName        : Computer Associates Antivirus
    CompanyName        : Computer Associates International, Inc.
    FileDescription    : CA Antivirus Realtime Messaging Service
    InternalName       : vetmsg
    LegalCopyright     : © 2004 Computer Associates International, Inc.
    LegalTrademarks    : Trademark of Computer Associates International, Inc.
    OriginalFilename   : vetmsg.exe
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe...
    Scanning Module:C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetNtMsg.dll...

#:34 [cidaemon.exe]
    ModuleName         : C:\WINDOWS\system32\cidaemon.exe
    Command Line       : "cidaemon.exe" DownLevelDaemon "c:\system volume information\catalog.wci" 196672l 1260l
    ProcessID          : 3316
    ThreadCreationTime : 2/28/2006 4:30:13 PM
    BasePriority       : Idle
    FileVersion        : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion     : 5.1.2600.0
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Indexing Service filter daemon
    InternalName       : cidaemon.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : cidaemon.exe
    Scanning Module:C:\WINDOWS\system32\cidaemon.exe...
    Scanning Module:C:\WINDOWS\system32\LangWrbk.dll...
    Scanning Module:C:\WINDOWS\system32\cabview.dll...
    Scanning Module:C:\WINDOWS\System32\mstask.dll...

#:35 [ad-aware.exe]
    ModuleName         : C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Aware.exe
    Command Line       : "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Aware.exe"
    ProcessID          : 3420
    ThreadCreationTime : 2/28/2006 4:31:10 PM
    BasePriority       : Normal
    FileVersion        : 6.2.0.238
    ProductVersion     : SE 106
    ProductName        : Lavasoft Ad-Aware SE
    CompanyName        : Lavasoft Sweden
    FileDescription    : Ad-Aware SE Core application
    InternalName       : Ad-Aware.exe
    LegalCopyright     : Copyright © Lavasoft AB Sweden
    OriginalFilename   : Ad-Aware.exe
    Comments           : All Rights Reserved
    Scanning Module:C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Aware.exe...
    Scanning Module:C:\WINDOWS\system32\olepro32.dll...
    Scanning Module:C:\WINDOWS\system32\RICHED32.DLL...
    Scanning Module:C:\WINDOWS\system32\RICHED20.dll...

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12



Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 12




Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12

11:46:04 AM Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:09:10.109
Objects scanned:142280
Objects identified:0
Objects ignored:0
New critical objects:0
Logged

Offline GR@PH;<'S

  • Administrator
  • Hero Member
  • *****
  • Posts: 15651
    • http://www.taktmobiles.co.uk
Re: tracking device
« Reply #4 on: March 01, 2006, 05:26:47 PM »
Finch,
You may want to give
"Process Explorer"
from SysInternals a try
Quote
Ever wondered which program has a particular file or directory open? Now you can find out. Process Explorer shows you information about which handles and DLLs processes have opened or loaded.
The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you’ll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you’ll see the DLLs and memory-mapped files that the process has loaded. Process Explorer also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded.
The unique capabilities of Process Explorer make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way Windows and applications work.
and you may also wish to download and try Ewido 
 it is a trial version of the program. 
once installed please update ewido to the latest definition files.
click the left hand side of the main screen click update.
Then click on Start UpdateThe update will start and a progress bar will show the updates being installed.
See this excellent Ewido Quick Guide by Die Hard.

Also can you please download
HijackThis
 After you have downloaded  it and Unzipped it, doubleclick HijackThis.exe, and hit "Scan".
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log somewhere, and then can you please post you Logfile in the
HijackThis Logs  forum.
Call it some ting like "my HijachThis log" in the Topic Title
and then put "referred by GR@PH;<'S" as the Topic Description
Also Please can you include a link to this post for reference

GR@PH;<'S  :breakkie:
Logged
press Enter then have a Brandy then if the problem is still there have another Brandy
Q: does it work
A: It does seem to for a few hours at least.

Offline Finch

  • Newbie
  • *
  • Posts: 7
Re: tracking device
« Reply #5 on: March 02, 2006, 05:25:17 PM »
Thanks, Process Explorer caught it. Turns out not to be to exciting these are the command lines.

"C:\Program Files\HP\hpcoretech\soln\HPOSM.exe" -Embedding  command line   (solution manger)
"C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe" -Embedding  command line  (task manger)

It appears as a new object then deletes itself, the suspend function will not hold it, "not enough storage is avaliable to process this command" comes up when I try it.

I saved the Property text document in PE but could not get it to copy and paste here. Can I use [Kill Process] on this or will this cease to make my HP Scanner, Printer and Copier unable to function? Could something else be using these files to function like this, reason being it never misses a chance to appear on the start bar. Since this is all very new to me I don't even have anything to draw on for probability source material.

Thanks GR@PH;<'S
Logged

Online Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11542
  • "Stronger than the past, united in our goal."
    • Security Garden
Re: tracking device
« Reply #6 on: March 03, 2006, 01:36:12 AM »
Finch, I don't think you realized it, but you have two firewalls operating.  In addition to Zone Alarm Pro, you have the Microsoft Firewall activated. 

#:20 [alg.exe]
    ModuleName         : C:\WINDOWS\System32\alg.exe
    Command Line       : C:\WINDOWS\System32\alg.exe
    ProcessID          : 228
    ThreadCreationTime : 2/28/2006 4:22:44 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Application Layer Gateway Service
    InternalName       : ALG.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : ALG.exe
    Scanning Module:C:\WINDOWS\System32\alg.exe...

You can locate the "Security Center" from Start > Control Panel and turn off the Windows Firewall from there. 
Logged
,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline Finch

  • Newbie
  • *
  • Posts: 7
Re: tracking device
« Reply #7 on: March 03, 2006, 04:21:12 PM »
Hi Corrine

I did check that and found that the Security Center recognized my ZAlm so I went to  Windows Firewall,  off was still checked. So I started Process Explorer and sure enough it is listed as a (service) alg.exe it is located above vsmon.exe which is my ZA TrueVector Service (mind you I know not what any of this means) only that it never draws any CPU while the latter does. So I used the pull down and Goggled it_ as someone reminded another on a different site that this is the least any dummy should do for themselves, Well!!... I said,  thank you for that. The results are below.

Note: The alg.exe file is located in the C:\Windows\System32 folder. In other cases, alg.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.

 1456 users ask for this file. 26 users didn't rate it ("don't know"). 93 users rated it as not dangerous. 17 users rated it as not so dangerous. 59 users rated it as neutral. 30 users rated it as little bit dangerous. 40 users rated it as dangerous.

What are you thinking, that maybe this is running undetected. This security task manger mentioned above looked like an interesting tool. the comments above came from
http://www.neuber.com/taskmanager/process/alg.exe.html

I appreciate all the help here very much, since I don't believe in free lunch rather that others time of life is labor maybe you could suggest how to support the site.

Finch


Logged

Offline GR@PH;<'S

  • Administrator
  • Hero Member
  • *****
  • Posts: 15651
    • http://www.taktmobiles.co.uk
Re: tracking device
« Reply #8 on: March 03, 2006, 04:47:43 PM »
Finch,
Quote
I appreciate all the help here very much, since I don't believe in free lunch rather that others time of life is labor maybe you could suggest how to support the site

You could recommend us to all your friends and that way you and they are all support the site needs as we find that friendship goes a long way

GR@PH;<'S   :breakkie:
Logged
press Enter then have a Brandy then if the problem is still there have another Brandy
Q: does it work
A: It does seem to for a few hours at least.

Online Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11542
  • "Stronger than the past, united in our goal."
    • Security Garden
Re: tracking device
« Reply #9 on: March 04, 2006, 12:35:30 AM »
Hi, Finch.  It looks like we are both learning something here.  I knew that was part of the Windows Firewall, and when I see it in a logfile without another firewall, know that the user at least has one-way protection. 

I just ran a scan (which I don't do very often because I spend most of my time on the forums).  Sure enough, here it is on my system:

#:32 [alg.exe]
    FilePath           : C:\WINDOWS\System32\
    ProcessID          : 2336
    ThreadCreationTime : 3-3-2006 11:01:48 PM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Application Layer Gateway Service
    InternalName       : ALG.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : ALG.exe

from http://www.liutilities.com/products/wintaskspro/processlibrary/alg/ :
Quote
alg.exe is a part of the Microsoft Windows operating system. It is a core process for Microsoft Windows Internet Connection sharing and Internet connection firewall. This program is important for the stable and secure running of your computer and should not be terminated
and from http://www.dslreports.com/faq/5559 :
Quote
Alg.exe   Application layer gateway   

Part of WinXP that provides support for ICS and Internet connection firewall (ICF)   

If a third party firewall warns you that Alg.exe wants to access, check to make sure you're not double firewalled. If you are disable ICF. If you are using neither ICF or ICS and are warned that Alg.exe is trying to access the internet, deny it. A Trojan or worm is trying to use it as a backdoor

As to our help, Finch, we are all volunteers, sharing what we can to help others and you helped me learn something new tonight.  You are most welcome to stick around, play some games in the Lounge, subscribe to update thread(s), share jokes, etc.  We enjoy making and keeping new online friends here at LzD Forum.  :rose:
Logged
,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline SpiritWind

  • Jr. Member
  • **
  • Posts: 81
Application Layer Gateway Service
« Reply #10 on: March 04, 2006, 06:54:32 AM »
 :D The "Services" Guides of both "Black Viper" at http://majorgeeks.com/page?id=12
     and "Tweakhound" at www.tweakhound.com/xp/xptweaks/supertweaks6.htm
     recommend the "Application Layer Gateway Service" be set to "Manual" .
Logged
For the BEST in what counts in Life :

www.tacf.org

Offline Finch

  • Newbie
  • *
  • Posts: 7
Re: tracking device
« Reply #11 on: March 04, 2006, 10:29:36 AM »
Sure appreciate everyones kind remarks along with the help. I checked System Config utility Services Corrine and it has  Windows Firewall/Intern... MS Corp   running  suppose that makes sense in light of your first quote. The problem I have with things being labled as "running" and yet not being recognized as "running" by Security Center and Windows Firewall is all the monitoring that has to take place in order to know, I suppose that was why you included the second quote. Once you start delving into this stuff you truly have to stay on top of the game, this is where in the past I have gotten into trouble, I move on and forget what I switched on and off and even where it was located. I had to laugh SpiritWind after reading the advice you posted because it sounds so appealing,... Yes! control it all!!! but reason came riding up and reminded me of reality.....son you can't do it all, choices must be made, while I enjoy the beauty of all your logical minds. I truly must confess that the quotes at the end left by the both of you are to me much more fascinating.

Goatie: "A chosen family has a flavour of it's own, it is not given, it is hand picked one member at a time and earned!"

 I could be wrong, I'd say your a Philosophic Naturalist/Pantheist


For the BEST in what counts in Life : This phrase presupposes a moral law and with a name like SpiritWind and the fact you didn't ground it,

 I could be wrong,  I'd say you hold to some form of Rleativism/Pluralism


I can't help it I always change the subject. I never come to these forums unless I need help. Inevitably someone makes a comment or qoute as an apologist I just can't resist, So sue me!!  Straighten out my kninks that I put in your life and world view, point to the place where you'd like to discuss. After all you did expect someone to read them didn't you. Have a wonderful day, Finch says "not everthing can be true"   

G'day
Logged

Offline Finch

  • Newbie
  • *
  • Posts: 7
Re: tracking device
« Reply #12 on: March 29, 2006, 05:23:43 PM »
Here is the solution to the two little devils from Hp that was my problem in the very first post. In the eventuality that someone may need to know. This comes directly from Hewlett Packard themselves and it worked. Thanks for your help on this everyone, without Process Explorer I would never have caught it. I will post the two files here that caused all the problems to save the reading.

"C:\Program Files\HP\hpcoretech\soln\HPOSM.exe" -Embedding  command line
"C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe" -Embedding  command line


ftp://ftp.hp.com/pub/softlib/software2/COL4788/dj-16758-1/hpslnmgr_disable.exe

1. Click Start and Run.
2. Type MSCONFIG and press Enter.
3. Click the Startup tab.
4. Clear the checkboxes for hpcmpmgr.exe.
5. Click OK.
6. Restart the system.
Maverick: Please uncheck the boxes as stated above .
Maverick: And then restart the PC and down load and run the above utility.
Maverick: This should resolve the issue.

Adieu
Logged

Offline GR@PH;<'S

  • Administrator
  • Hero Member
  • *****
  • Posts: 15651
    • http://www.taktmobiles.co.uk
Re: tracking device
« Reply #13 on: March 29, 2006, 06:48:02 PM »
Finch,
Glad you have got it sorted thaks for letting us know

GR@PH;<'S   :breakkie:
Logged
press Enter then have a Brandy then if the problem is still there have another Brandy
Q: does it work
A: It does seem to for a few hours at least.
Pages: [1]   Go Up
« previous next »