28.03.2011 19:27:49 LSASS Exploit (E2K) attack, from 220.214.143.227:445
29.03.2011 16:41:09 LSASS Exploit (E2K) attack, from 61.170.164.27:445
30.03.2011 12:22:54 LSASS Exploit (E2K) attack, from 98.124.82.51:445
08.04.2011 18:11:50 DCOM Exploit attack, from 89.106.221.146:135
08.04.2011 22:22:18 LSASS Exploit (E2K) attack, from 186.44.182.138:445
08.04.2011 22:33:09 LSASS Exploit (E2K) attack, from 186.44.182.138:445
08.04.2011 22:51:26 LSASS Exploit (E2K) attack, from 186.44.182.138:445
09.04.2011 23:43:08 LSASS Exploit (E2K) attack, from 74.235.173.80:445
12.04.2011 23:07:45 LSASS Exploit (E2K) attack, from 95.26.252.129:445
17.04.2011 23:12:09 LSASS Exploit (E2K) attack, from 186.9.2.93:445
18.04.2011 15:26:07 LSASS Exploit (E2K) attack, from 95.27.86.76:445
19.04.2011 01:58:19 LSASS Exploit (E2K) attack, from 95.27.86.76:445
20.04.2011 13:50:34 LSASS Exploit (E2K) attack, from 65.0.115.194:445
23.04.2011 21:35:50 LSASS Exploit (E2K) attack, from 89.178.244.153:445
24.04.2011 00:14:40 LSASS Exploit (E2K) attack, from 93.120.75.218:445
24.04.2011 02:47:45 LSASS Exploit (E2K) attack, from 61.231.221.76:445
24.04.2011 09:26:40 LSASS Exploit (E2K) attack, from 74.235.175.6:445
24.04.2011 20:22:16 LSASS Exploit (E2K) attack, from 70.248.29.2:445
27.04.2011 09:43:34 LSASS Exploit (E2K) attack, from 113.252.81.203:445
27.04.2011 16:42:18 LSASS Exploit (E2K) attack, from 113.252.81.203:445
29.04.2011 02:07:48 DCOM Exploit attack, from 49.133.128.198:135
01.05.2011 14:03:01 DCOM Exploit attack, from 49.238.31.17:135
220.214.143.227:445 - Japan Sapporo Dion (kddi Corporation)
61.170.164.27:445 - China Shanghai Chinanet Shanghai Province Network
98.124.82.51:445 - United States Moncks Corner Home Telephone Company Inc
89.106.221.146:135 - Germany Sindelfingen Klinikverbund Suedwest Gmbh
186.44.182.138:445 - Trinidad And Tobago Telecommunication Services Of Trinidad And Tobago
186.44.182.138:445 - Trinidad And Tobago Telecommunication Services Of Trinidad And Tobago
186.44.182.138:445 - Trinidad And Tobago Telecommunication Services Of Trinidad And Tobago
74.235.173.80:445 - United States Charlotte Clt Adsl Cbb
95.26.252.129:445 - Russian Federation Dynamic Ip Pool For Broadband Customers
186.9.2.93:445 - Chile Santiago Entel Pcs Telecomunicaciones S.a
95.27.86.76:445 - Russian Federation Dynamic Ip Pool For Broadband Customers
95.27.86.76:445 - Russian Federation Dynamic Ip Pool For Broadband Customers
65.0.115.194:445 - United States Starkville Jan Adsl Cbb
89.178.244.153:445 - Russian Federation Moscow Broadband Customers In Moscow
93.120.75.218:445 - Romania Sc Webnet Telecom Srl
61.231.221.76:445 - Taiwan Taipei Chunghwa Telecom Data Communication Business Group
74.235.175.6:445 - United States Charlotte Clt Adsl Cbb
70.248.29.2:445 - United States Laredo Webb County
113.252.81.203:445 - Hong Kong Hong Kong Hutchison Global Communications
113.252.81.203:445 - Hong Kong Hong Kong Hutchison Global Communications
49.133.128.198:135 - Japan Nagoya Kddi Corporation
49.238.31.17:135 - Japan Oita Oita Cable Telecom Co. Ltda
Also from the log it seems you have installed some codec which is used for streaming which is trying to access the blocked ports or in this case the blacklisted ip in the firewall. Check the usage pattern in the case which applications are trying to access the internet.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 04:25:31 PM, on 01 May 2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.7930.16406)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\FastStone Capture\FSCapture.exe
C:\Program Files\K-Lite Codec Pack\Media Player Classic\mpc-hc.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Windows\System32\osk.exe
C:\Windows\system32\notepad.exe
U:\Hijack this\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [KeePass 2 PreLoad] "C:\Program Files\KeePass Password Safe 2\KeePass.exe" --preload
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [EVEREST AutoStart] C:\Program Files\Lavalys\EVEREST Ultimate Edition\everest_start.exe
O4 - HKCU\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{F0555F8E-AEF6-4867-A436-5B9A2D89D443}: NameServer = 202.148.200.3 202.148.202.3
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\Alwil Software\Avast5\afwServ.exe
O23 - Service: DU Meter Service (DUMeterSvc) - Hagel Technologies Ltd. - C:\Program Files\DU Meter\DUMeterSvc.exe
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
Thanks mate, i don't want to reinstall windows, thats the most boring part of my lifeggt said:I guess the last option would be to format your pc.
Here are some things i would like you to suggest.
Reset all your permission for the firewall in terms of the applications accessing the internet.
Set your firewall to higher firewall setting where each application will ask you for the permission to access the internet.
Use the gprs through their proxy i.e through wap.
Else format your pc.![]()
Why don't you use ESET Smart Security ?CA50 said:Thanks mate, i don't want to reinstall windows, thats the most boring part of my life
MY current selling is like that, any application that want to connect to net must be authorized by me