[carnageX]

Hello all,

For the past ocuple of days, Norton was blocking a "aaa##text.exe" where the ## would be 13, and going up. Got it once a morning for a ocuple days. I did a system restore to a couple days ago, before I installed a couple programs, but it seems that the exe only occurs once a day, in the morning. I scanned with Norton, and it didn't pick anything up (I scan nightly whenever my computer is left on overnight), and Ad-Aware didn't pick anything up, either. So I was just wondering if any of you knew what this was? Because I tried googling it, and nothing came up at all. Anyway... Here's my HiJackThis log. I wanted to see if anybody sees anything in the log. Thanks a lot for any help!

Download Log

Had to give a download link b/c the log was too long to post.

[Osiris]

upload it from your computer,the link doesnt work

[carnageX]

I did upload it =\. It works fine for me... I'll try a different host...

Try this one:
http://www.freewebs.com/carnagex3/hijackthis.log

[ECTech]

remove the following,

C:\Documents and Settings\HP_Owner\Desktop\Apophysis beta.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

[Osiris]

where was the file located that norton found?

[carnageX]

Here's the error log:

The user has created a rule to "block" communications.
Outbound UDP packet.
Local address,service is (CHASE(192.168.1.100),0).
Remote address,service is (64.251.173.134,domain(53)).
Process name is "C:\Documents and Settings\HP_Owner\Policies\contrib\AAA13test.exe".

It didn't come up this morning though, after I did a system restore yesterday, so I might have gotten rid of it already, whatever it was.

C:\Documents and Settings\HP_Owner\Desktop\Apophysis beta.exe

That's nothing bad...It's a beta version of a fractal program. So nothin to worry about there.

[Osiris]

Thats nothing to worry about, just some part of HP possibly an update program of some sort

[carnageX]

Odd, because I had never seen it before, until I had installed a couple programs. Uninstalled them...and I didn't get it again (yet anyway). And it also went up an increment in the number... Like the next day it was aaa14test.exe.

Well, thanks for the help guys =).

[Osiris]

Has it come back yet?