What is this internet activity on my HP?

[pclaptop23]

On a HP desk top at screwy times of the day and night this activity is recorded. And what is this IP address that is referred to? It is not MY Modems IP adress 24.0.187.75

Starting: hpslpsvc32.dll
20120511225823:0003B91E4:0001(0000-0000)(2204)+++ From: c:\program files\hp\digital imaging\bin
20120511225823:0003B97F2:0001(0000-0000)(2204)+++Command Line: C:\Windows\system32\svchost.exe -k HPService
20120511225823:0003B9D38:0001(0000-0000)(2204)+++ File Size: 634880
20120511225823:0003BA22D:0001(0000-0000)(2204)+++ Version: hpslpsvc32.dll 120.0.194.0 Release
20120511225823:0003BA7FF:0001(0000-0000)(2204)+++ Built on: Oct 16 2008 18:22:43
20120511225823:0003BAE4D:0101(0000-0000)(2204)+++ PID: 2196 HPSLPSVC0182.log (C:\Windows\system32\svchost.exe )
20120511225823:0003E0D19:0001(0000-0000)(2204){Loaded 0 devices}
20120511225823:00042526D:0201(0000-0000)(2356)<Using adapter at index A for [Local Area Connection](NVIDIA nForce 10/100 Mbps Ethernet ) IP=192.168.2.5 Type=6>
20120511225823:000427B5B:0101(0000-0000)(2356)<FOUND 1 connected adapter(s), error=0>
20120511225823:0004460F5:0001(0000-0000)(2356)<Monitoring adapter ip=192.168.2.5, subnet=192.168.2.0/24 at index A for NVIDIA nForce 10/100 Mbps Ethernet [status=1, flags=3e5] type=6>
20120511225823:000450A8A:0001(0000-0000)(2528)Heartbeat event initialized for subnet=192.168.2.0/24
20120511225823:000459F0C:0101(0000-0000)(2356)<STARTED manager for(192.168.2.0/24)>
20120511225823:00045CBDE:0101(0000-0000)(2356)<FOUND 1 connected adapter(s)>
20120511225823:00045EC26:0001(0000-0000)(2532)<MONITORING subnet 192.168.2.0/24 on LOCAL ADDRESS 192.168.2.5>
20120511225823:0004613DD:0101(0000-0000)(2356)<STARTED MANAGER FOR OFF-SUBNET 2560>
20120511225823:000462AD3:0001(0000-0000)(2560)<MONITORING OFF-SUBNET>
20120511225823:0004639C5:0101(0000-0000)(2532)[SENDING MULTICAST REQUEST->192.168.2.0/24]
20120511225823:00046435C:0101(0000-0000)(2532)<FINISHED STARTUP for 192.168.2.5>
20120511225823:000470D8B:0001(0000-0000)(2548)Heartbeat event initialized for subnet=
20120511225824:0005659B1:0101(0001-0001)(2560)<FINISHED STARTUP for OFF_SUBNET>
20120511225824:000566635:0101(0001-0000)(2560)<SERVICE STARTUP FINISHED in 1700 mSec>
20120511225829:0000976E9:0101(0006-0004)(2532)[SENDING MULTICAST REQUEST->192.168.2.0/24]
20120512004422:00030AF67:0101(6369-0002)(2356)<IP ADDRESS TABLE CHANGED>
20120512004422:00030CF87:0101(6369-0000)(2356)<IP CHANGE NOTIFICATION SCHEDULED>
20120512004422:00031ACA3:0101(6369-0000)(2356)<RESCAN SUBNETS> S=1, R=0
20120512014735:000777FE4:0001(0162-3792)(5452)<MONITORING OFF-SUBNET>
20120512014739:0001D6701:0001(0166-0000)(2204)Media sense re-started
20120512014739:0001FE678:0101(0166-0000)(2356)<RESUMING>
20120512014739:00022BB9E:0101(0166-0000)(2356)<RESCAN SUBNETS> S=0, R=1
20120512014739:00024148B:0001(0166-0000)(2204)Already awake

 

[pclaptop23]

Also, there is actually two other IP adresses that this mysterious activity uses. I don't have them to paste right now but i will later. And the above c/p is one of 200+ logged activities of this type!

If this is an "UP and UP" activity( as compared to someone hacking into my machine I don't know either way that is why I'm asking?) of an HP machine why is it an HP acivity at all?

 

[pclaptop23]

additional info

OK here is some additional info:

these are the IP's I mentioned . . . .
my IP: 174.57.91.xxx last three octets are deleted on purpose

suspicious #2 IP: 68.37.228.207 (text c/p below shows location also see attached pic 205)

suspicious #3 IP: 69.248.177.14

This comes from a windows temp directory, and it seems as though it is automatically recorded in files like this HPSLPSVC0205.log c/p

20120614150401:0003CCB01:0001(0000-0000)(2320)+++ Starting: hpslpsvc32.dll
20120614150401:0003E5381:0001(0000-0000)(2320)+++ From: c

program files\hp\digital imaging\bin
20120614150401:0003FA6E8:0001(0000-0000)(2320)+++Command Line: C

Windows\system32\svchost.exe -k HPService
20120614150401:00040FB03:0001(0000-0000)(2320)+++ File Size: 634880
20120614150401:00041C6EC:0001(0000-0000)(2320)+++ Version: hpslpsvc32.dll 120.0.194.0 Release
20120614150401:000427EF4:0001(0000-0000)(2320)+++ Built on: Oct 16 2008 18:22:43
20120614150401:000435E39:0101(0000-0000)(2320)+++ PI

2312 HPSLPSVC0205.log (C

Windows\system32\svchost.exe )
20120614150401:00044EA1A:0001(0000-0000)(2320){Loaded 0 devices}
20120614150401:00046EAC3:0201(0000-0000)(3012)<Using adapter at index A for [Local Area Connection](NVIDIA nForce 10/100 Mbps Ethernet ) IP=68.37.228.207 Type=6>
20120614150401:00047CBF3:0101(0000-0000)(3012)<FOUND 1 connected adapter(s), error=0>
20120614150401:000482D41:0001(0000-0000)(3012)<Monitoring adapter ip=68.37.228.207, subnet=68.37.228.0/23 at index A for NVIDIA nForce 10/100 Mbps Ethernet [status=1, flags=3e5] type=6>
20120614150401:0004905B7:0101(0000-0000)(3012)<STARTED manager for(68.37.228.0/23)>
20120614150401:000499B13:0001(0000-0000)(3016)Heartbeat event initialized for subnet=68.37.228.0/23
20120614150402:0004A5405:0001(0000-0000)(3020)<MONITORING subnet 68.37.228.0/23 on LOCAL ADDRESS 68.37.228.207>
20120614150402:0004B10E5:0101(0000-0000)(3012)<FOUND 1 connected adapter(s)>
20120614150402:0004B1909:0101(0000-0000)(3020)[SENDING MULTICAST REQUEST->68.37.228.0/23]
20120614150402:0004B24CF:0101(0000-0000)(3020)<FINISHED STARTUP for 68.37.228.207>
20120614150402:0004B2CBA:0001(0000-0000)(3024)Heartbeat event initialized for subnet=
20120614150402:0004B3526:0001(0000-0000)(3028)<MONITORING OFF-SUBNET>
20120614150402:0004B3CC4:0101(0000-0000)(3012)<STARTED MANAGER FOR OFF-SUBNET 3028>
20120614150403:0005A8612:0101(0001-0001)(3028)<FINISHED STARTUP for OFF_SUBNET>
20120614150403:0005AA263:0101(0001-0000)(3028)<SERVICE STARTUP FINISHED in 1467 mSec>
20120614150408:0000E5C1

0101(0006-0005)(3020)[SENDING MULTICAST REQUEST->68.37.228.0/23]

that was only part of a 27kb log file.

see attached screen shot logrecords.jpg of temp files (hplog files) and see the screen shot 205log.jpg of the section of that log file pasted above from HPSLPSVC0205.log.

 

[Layback Bear]

Host name:
c-24-0-187-75.hsd1.nj.comcast.net


Country:
United States



B Class:
24.0.0.0 - 24.0.255.255


Region:
NJ


City:
Franklinville


Latitude:
39.6193

Some people report that its also HP checking and calling home.

 

[pclaptop23]

OK, but why would HP digital imaging be going OUT of my HOME network 174.57.91.xxx to the internet to other IP addresses (24.0.187.75, 68.37.228.207, 69.248.177.14)to see if there were new printers on the network?

How many different "HP" homes is MY computer calling out to? and how come they are all in Franklinville, about 5 miles from where I actually live?

 

[pclaptop23]

Is it possible that someone(unknown to me) has added these IP addys as networked stations/clients/VPN and the HP query is including them as well regardless of the distance/location??

 

[Layback Bear]

Any thing is possible. If it was me I would go into msconfig Start Up and make sure nothing is checked except my security, keyboard, and mouse. Then go into Services lower left corner and put a check mark in Hide All Microsoft Services. What ever is left only have your Security checked. Reboot. This should stop HP calling home except when you tell it to.
All this does to all those things you have un-checked is telling them not to start at boot and run in the background. They will start up when you or Windows choose them to. i.e. tick on them.
Then go int the HP photo program and make sure nothing is set to auto do anything. You will tell it when and what to do.Reboot. Then check again in msconfig and HP to make sure your new setting stayed as you made them.

 

[Layback Bear]

If you really want to clean up that HP mess we got people here that can guide you through this.

http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

 

[pclaptop23]

Thanks Layback, I believe I have had an intrusion and a backdoor hack of my computer. Some files were removed and others were hidden and I'm trying to eliminate possibilities.

Indeed, if this is just HP "PHONING HOME" then I have to look elsewhere! I just wish there was a way that a whois or IPtrace could take me farther than JUST the internet provider of that/those IP addresses!

thanks again, PCLaptop

 

[Layback Bear]

To check for a back door hacker.
http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

To remove a virus and to get rid of all that HP garbage my post #8
What security programs do you use?

 

[pclaptop23]

Eset System Security V 5.0, Malwarebytes and (not installed but as a Portable app) Super Anti-Spyware.

To give you an idea how I've come to this point, I've got a 320 gb hd and windows is only seeing 50 gb! I was getting a message "HD is full"! Can't be! I opened the PC case, looked at HD, and it is printed on HD case label "320 gb"

I used Paragon Partition Mgr and Ontrack Data Recovery to find out that 236gb has been un-partitioned to something other than NTFS or FAT, (Win 7 doesn't even see this 236gb) and that Ontrack found 671 files in there that pertain to evidence and documents and pictures and mpg videos for a current ongoing MAJOR LAWSUIT!

Now I'm pretty damn sure this HD did NOT come from the factory with 236 gb un-accessable, and I'm just as sure that those 671 files weren't there from the factory as well!

thanks pcplatop

 

[Layback Bear]

Does somebody else have access to your computer? Do you use a encryption program?

 

[pclaptop23]

OK, thanks. I've d/led the windows defender offline, and I've already salvaged the logfiles, and reformatted drive.

I believe I have stopped the intrusions and what is ongoing now is pointing to where the intrusions camefrom/wentto!

 

[pclaptop23]

Does somebody else have access to your computer? Do you use a encryption program?

I'm pretty sure I have stopped ALL OUTSIDE access.

Encryption in what way? For stored data or online interaction?

 

[Layback Bear]

I was just wondering if you had those valuable files encrypted. Another option would be to transfer them to external media hard drive/DVD and put in safe place. That way if your computer in access from in house or externally that information won't be there.

 

[pclaptop23]

I did not expect the people/persons I suspect to do this. The files were not encrypted.

Hind sight is always 20-20!

What I not sure of is whether or not the partioining and movement was done remotely (Remote access was enabled) or right at my desk!

I've moved all pertinent data and log files to secure sources and locations.

I've reformatted the HD and reloaded Win 7 Ult, tightened up all access , restricted outside access , disabled RemoteAccess, went into router and restricted unknown mac machines, put what I deem to be a good(BEST) Av and malware proggies.

The worst thing is I have no choice but to find out how and where these events have unfolded there ia a major lawsuit at stake!

thanks once more.

 

[Layback Bear]

All I'm able to give from where I'm located is hind sight suggestions. Wish you well.

 

[pclaptop23]

thanks appreciate the input can you recieve PM's? I'll try

 

[Layback Bear]

I have received one and answered twice. Check in your User CP to make sure of your settings.
Try Visitors Message also.