- This topic has 19 replies, 5 voices, and was last updated 19 years, 5 months ago by
.
-
Posts
-
Okay this is very weird. Firstly lately things have been eating my up CPU. This would happen at random, like they would start using up 97-99% CPU and horribly slow down my comp, and I would have to close it with task manager. This happened to explorer.exe a few times already and I had to close it and bring it back up which wouldn’t fix things.
And just a few minutes ago I had a good documented case of it happening. First I was going to resize a banner for me and my friend’s website so I opened it in HP Image zone. Now Image zone has always been a slow program but this time I opened it up and it didn’t start up right it was just all white. It also started eating up my CPU like I mentioned before. So I hit the upper right hand corner X and closed it. Then my Firefox started eating up my CPU. So I had to close that. Then my explorer.exe started eating up my CPU; it was as if it was spreading, but it only hit one thing at a time. So I closed explorer in task manager.
Obviously I was left without a taskbar. But nothing was eating up my CPU now. So I decided to restart explorer.exe using my task manager and run, and I did but then it immediately after I started it up again it began eating up CPU. So much in fact that I couldn’t do anything, so I had to restart my computer with the power switch.
Another interesting thing, I’m not sure if this is related to this problem, is that when I change my wallpaper, all changes only take effect after I restart my comp. So if I change wallpaper, my current wallpaper stays until I restart my computer. I change my wallpaper by going into my wallpaper folder and right clicking the paper I want and hitting “Set as Desktop Background” if thats of any importance.
I use a Windows XP with all the latest updates and service packs. My RAM is 512 megs. I also recently did a spyware scan and deleted various spyware. I’m pretty good with knowing what processes of mine are normal and which are new so I would have been able to spot something unusual there.
So anyone have any idea what my problem could be?
Hi,
Have a look at this thread and read very carefully posts #24 and 47. You can post your HijackThis log in this thread and I’ll get back to you.
I also assume you’ve updated your antivirus/antispyware definitions, and have done complete scans of your system.
This seems like a virus issue moreso than a spyware issue. First run a free virus scan with a few different virus scanners. I recommend AVG Anti-Virus. Also, have you tried repair-installing your Windows XP install to see if that will clear up explorer.exe? If not, you may need to do that, or even just re-install Windows XP.
Philip, at the moment I’m not having CPU problems. It just happens randomly when I for instance open a program then it may, out of nowhere, just start using up my CPU like crazy, so I would close it and then another program would start doing the same thing. Its not quite the problem in the thread you showed me, although I will try the HijackThis and post the log here.
Also I just did a registry scan with Avira and found nothing.
Also I believe the first time it happened was with my ZoneAlarm so I decided to just uninstall it and install Comodo Firewall instead…which is interesting since ZoneAlarm is mentioned in that thread. Huh.
And I just realised the only way I can change my background is through display but still it just won’t work anymore the way I normally do it, well rather I have to “verify” my changes made with display by simply going into it and pressing okay as the change I make appears there.
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 4:11:31 PM, on 3/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: NormalRunning processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesAntiVir PersonalEdition Classicsched.exe
C:Program FilesAntiVir PersonalEdition Classicavguard.exe
C:PROGRA~1COMMON~1AOLACSacsd.exe
C:Program FilesComodoFirewallcmdagent.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32UStorSrv.exe
C:WINDOWSExplorer.EXE
C:Program FilesJavajre1.5.0_10binjusched.exe
C:windowssystemhpsysdrv.exe
C:WINDOWSAGRSMMSG.exe
C:WINDOWSsystem32hphmon06.exe
C:HPKBDKBD.EXE
C:WINDOWSsystem32msxct.exe
C:Program FilesMicrosoft HardwareMousepoint32.exe
C:Program FilesCommon FilesMicrosoft SharedWorks SharedWkUFind.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:Program FilesAntiVir PersonalEdition Classicavgnt.exe
C:WINDOWSsystem32rundll32.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesWinampwinampa.exe
C:Program FilesZuneZuneLauncher.exe
C:Program FilesCommon FilesInstallShieldUpdateServiceISUSPM.exe
C:WINDOWSALCXMNTR.EXE
C:Program FilesComodoFirewallCPF.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesAIM6aim6.exe
C:Program FilesAIM6aolsoftware.exe
C:Program FilesImationImationFlashDetect.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
c:program filesaim6anotify.exe
C:Process Explorerprocexp.exe
C:Program FilesInternet Exploreriexplore.exe
C:Documents and SettingsHP_OwnerLocal SettingsTemporary Internet FilesContent.IE5EVLT85JUHiJackThis_v2[1].exeR1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = Live Search
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = Sign In
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = MSN.com
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = Live Search
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=pavilion&pf=desktop
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = Live Search
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = MSN.com
O2 – BHO: AcroIEHlprObj Class – {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} – C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 – BHO: Alcohol Toolbar Helper – {52D06F97-5511-43FA-8FDA-C481864FD26E} – C:Program FilesAlcohol Toolbarv3.2.0.0Alcohol_Toolbar.dll
O2 – BHO: SSVHelper Class – {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} – C:Program FilesJavajre1.5.0_10binssv.dll
O2 – BHO: (no name) – {7E853D72-626A-48EC-A868-BA8D5E23E045} – (no file)
O2 – BHO: Google Toolbar Helper – {AA58ED58-01DD-4d91-8333-CF10577473F7} – c:program filesgooglegoogletoolbar1.dll
O2 – BHO: CNavExtBho Class – {BDF3E430-B101-42AD-A544-FADC6B084872} – c:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dll
O3 – Toolbar: HP view – {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} – c:Program FilesHPDigital ImagingbinHPDTLK02.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} – c:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dll
O3 – Toolbar: &Google – {2318C2B1-4965-11d4-9B18-009027A5CD4F} – c:program filesgooglegoogletoolbar1.dll
O3 – Toolbar: Alcohol Toolbar – {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} – C:Program FilesAlcohol Toolbarv3.2.0.0Alcohol_Toolbar.dll
O4 – HKLM..Run: [SunJavaUpdateSched] “C:Program FilesJavajre1.5.0_10binjusched.exe”
O4 – HKLM..Run: [hpsysdrv] c:windowssystemhpsysdrv.exe
O4 – HKLM..Run: [HotKeysCmds] C:WINDOWSsystem32hkcmd.exe
O4 – HKLM..Run: [AGRSMMSG] AGRSMMSG.exe
O4 – HKLM..Run: [HPHUPD06] c:Program FilesHP{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}hphupd06.exe
O4 – HKLM..Run: [HPHmon06] C:WINDOWSsystem32hphmon06.exe
O4 – HKLM..Run: [KBD] C:HPKBDKBD.EXE
O4 – HKLM..Run: [Recguard] C:WINDOWSSMINSTRECGUARD.EXE
O4 – HKLM..Run: [URLLSTCK.exe] c:Program FilesNorton Internet SecurityUrlLstCk.exe
O4 – HKLM..Run: [PS2] C:WINDOWSsystem32ps2.exe
O4 – HKLM..Run: [LSBWatcher] c:hpdrivershplsbwatcherlsburnwatcher.exe
O4 – HKLM..Run: [regcmdcons] c:hpbincloaker.exe c:hpbincmdcons.cmd
O4 – HKLM..Run: [hpfsched] C:WINDOWShpfsched.exe
O4 – HKLM..Run: [msxct] msxct.exe
O4 – HKLM..Run: [s7rg3nQ] ntstrl12.exe
O4 – HKLM..Run: [POINTER] point32.exe
O4 – HKLM..Run: [WorksFUD] C:Program FilesMicrosoft Workswkfud.exe
O4 – HKLM..Run: [Microsoft Works Portfolio] C:Program FilesMicrosoft WorksWksSb.exe /AllUsers
O4 – HKLM..Run: [Microsoft Works Update Detection] C:Program FilesCommon FilesMicrosoft SharedWorks SharedWkUFind.exe
O4 – HKLM..Run: [TkBellExe] “C:Program FilesCommon FilesRealUpdate_OBrealsched.exe” -osboot
O4 – HKLM..Run: [LogonStudio] “C:WinCustomizeLogonStudiologonstudio.exe” /RANDOM
O4 – HKLM..Run: [IgfxTray] C:WINDOWSsystem32igfxtray.exe
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [avgnt] “C:Program FilesAntiVir PersonalEdition Classicavgnt.exe” /min
O4 – HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [FreePDF Assistant] C:Program FilesFreePDF_XPfpassist.exe
O4 – HKLM..Run: [Zune Launcher] “C:Program FilesZuneZuneLauncher.exe”
O4 – HKLM..Run: [ISUSPM] “C:Program FilesCommon FilesInstallShieldUpdateServiceISUSPM.exe” -scheduler
O4 – HKLM..Run: [AlcxMonitor] ALCXMNTR.EXE
O4 – HKLM..Run: [UnlockerAssistant] “C:Documents and SettingsHP_OwnerDesktopMain BaseOther PlacesUnlockerUnlockerAssistant.exe”
O4 – HKLM..Run: [COMODO Firewall Pro] “C:Program FilesComodoFirewallCPF.exe” /background
O4 – HKCU..Run: [MsnMsgr] “C:Program FilesMSN MessengerMsnMsgr.Exe” /background
O4 – HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 – HKCU..Run: [dm2launcher.exe] “C:PROGRA~1DESKTO~1.0dm2launcher.exe” -start
O4 – HKCU..Run: [dw0mRhcEi] ntmyerxp.exe
O4 – HKCU..Run: [MSMSGS] “C:Program FilesMessengerMsmsgs.exe” /background
O4 – HKCU..Run: [updateMgr] C:Program FilesAdobeAcrobat 7.0ReaderAdobeUpdateManager.exe AcRdB7_0_0
O4 – HKCU..Run: [BitTorrent] “C:Program FilesBitTorrentbittorrent.exe” –force_start_minimized
O4 – HKCU..Run: [Aim6] “C:Program FilesAIM6aim6.exe” /d locale=en-US ee://aol/imApp
O4 – Startup: ImationFlashDetect.lnk = C:Program FilesImationImationFlashDetect.exe
O4 – Global Startup: HP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imagingbinhpqtra08.exe
O4 – Global Startup: InterVideo WinCinema Manager.lnk = C:Program FilesInterVideoCommonBinWinCinemaMgr.exe
O4 – Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O4 – Global Startup: SpySubtract.lnk = C:Program FilesInterMuteSpySubtractsslaunch.exe
O9 – Extra button: (no name) – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0_10binnpjpi150_10.dll
O9 – Extra ‘Tools’ menuitem: Sun Java Console – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0_10binnpjpi150_10.dll
O9 – Extra button: Research – {92780B25-18CC-41C8-B9BE-3C9C571A8263} – C:PROGRA~1MI1933~1OFFICE11REFIEBAR.DLL
O9 – Extra button: AIM – {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} – C:Documents and SettingsHP_OwnerDesktopMain BaseInstant MessengersAIMaim.exe
O9 – Extra button: (no name) – {e2e2dd38-d088-4134-82b7-f2ba38496583} – %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 – Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 – {e2e2dd38-d088-4134-82b7-f2ba38496583} – %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 – Extra button: Yahoo! Messenger – {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} – C:Program FilesYahoo!MessengerYahooMessenger.exe
O9 – Extra ‘Tools’ menuitem: Yahoo! Messenger – {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} – C:Program FilesYahoo!MessengerYahooMessenger.exe
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
O10 – Unknown file in Winsock LSP: c:windowssystem32nwprovau.dll
O16 – DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) – http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 – DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) – https://activatemydsl.verizon.net/sdcCommon/download/tgctlcm.cab
O16 – DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) – http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 – DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) – http://musicmix.messenger.msn.com/Medialogic.CAB
O16 – DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) – http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 – DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} – http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 – DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) – http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136228466031
O16 – DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} – http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
O16 – DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) – http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 – DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) – http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 – DPF: {BD393C14-72AD-4790-A095-76522973D6B8} – http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 – DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) – http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 – Filter hijack: text/html – (no CLSID) – (no file)
O20 – AppInit_DLLs: C:PROGRA~1GoogleGOOGLE~1GOEC62~1.DLL
O22 – SharedTaskScheduler: Browseui preloader – {438755C2-A8BA-11D1-B96B-00A0C90312E1} – C:WINDOWSsystem32browseui.dll
O22 – SharedTaskScheduler: Component Categories cache daemon – {8C7461EF-2B13-11d2-BE35-3078302C2030} – C:WINDOWSsystem32browseui.dll
O23 – Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) – Avira GmbH – C:Program FilesAntiVir PersonalEdition Classicsched.exe
O23 – Service: AntiVir PersonalEdition Classic Guard (AntiVirService) – AVIRA GmbH – C:Program FilesAntiVir PersonalEdition Classicavguard.exe
O23 – Service: AOL Connectivity Service (AOL ACS) – America Online, Inc. – C:PROGRA~1COMMON~1AOLACSacsd.exe
O23 – Service: AOL Spyware Protection Service (AOLService) – Unknown owner – C:Program FilesCommon FilesAOLAOL Spyware Protection\aolserv.exe
O23 – Service: Comodo Application Agent (CmdAgent) – COMODO – C:Program FilesComodoFirewallcmdagent.exe
O23 – Service: InstallDriver Table Manager (IDriverT) – Macrovision Corporation – C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 – Service: ISSvc (ISSVC) – Symantec Corporation – c:Program FilesNorton Internet SecurityISSVC.exe
O23 – Service: IviRegMgr – InterVideo – C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe
O23 – Service: MySQL – Unknown owner – C:Documents.exe (file missing)
O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:WINDOWSsystem32nvsvc32.exe
O23 – Service: Pml Driver HPZ12 – HP – C:WINDOWSsystem32HPZipm12.exe
O23 – Service: SAVScan – Symantec Corporation – c:Program FilesNorton Internet SecurityNorton AntiVirusSAVScan.exe
O23 – Service: StarWind iSCSI Service (StarWindService) – Rocket Division Software – C:Program FilesAlcohol SoftAlcohol 52StarWindStarWindService.exe
O23 – Service: SymWMI Service (SymWSC) – Symantec Corporation – c:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
O23 – Service: UStorage Server Service – OTi – C:WINDOWSsystem32UStorSrv.exe
O24 – Desktop Component 0: (no name) – C:Documents and SettingsHP_OwnerDesktopMain BaseThe Art GalleryThe Anime GalleryRandom .gifs + ImagesGasaraki Header.gif
O24 – Desktop Component 1: (no name) – http://content.ytmnd.com/content/e/d/ed104d90bda3580f9c9fbe8759d2868c.gif
O24 – Desktop Component 2: (no name) – C:Documents and SettingsHP_OwnerDesktopMain BaseThe Art GalleryGIFsJellyfish.gif
O24 – Desktop Component 3: (no name) – C:Documents and SettingsHP_OwnerMy DocumentsWeb ItemsGlyphRight.gif—
End of file – 13636 bytesΚασεν:
Thanks for posting your HijackThis log. Could you download HijackThis v1.99? A lot of HT analyzers don’t read HT v2 well yet.
Download CWShredder here and run it to check your system. Spybot is another good one to get.
Logfile of HijackThis v1.99.1
Scan saved at 11:25:05 PM, on 3/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesAntiVir PersonalEdition Classicsched.exe
C:Program FilesAntiVir PersonalEdition Classicavguard.exe
C:PROGRA~1COMMON~1AOLACSacsd.exe
C:Program FilesComodoFirewallcmdagent.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32UStorSrv.exe
C:WINDOWSExplorer.EXE
C:Program FilesJavajre1.5.0_10binjusched.exe
C:windowssystemhpsysdrv.exe
C:WINDOWSAGRSMMSG.exe
C:WINDOWSsystem32hphmon06.exe
C:HPKBDKBD.EXE
C:WINDOWSsystem32msxct.exe
C:Program FilesMicrosoft HardwareMousepoint32.exe
C:Program FilesCommon FilesMicrosoft SharedWorks SharedWkUFind.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:Program FilesAntiVir PersonalEdition Classicavgnt.exe
C:WINDOWSsystem32rundll32.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesWinampwinampa.exe
C:Program FilesZuneZuneLauncher.exe
C:Program FilesCommon FilesInstallShieldUpdateServiceISUSPM.exe
C:WINDOWSALCXMNTR.EXE
C:Program FilesComodoFirewallCPF.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesAIM6aim6.exe
C:Program FilesAIM6aolsoftware.exe
C:Program FilesImationImationFlashDetect.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
c:program filesaim6anotify.exe
C:Process Explorerprocexp.exe
C:Program FilesWinampwinamp.exe
C:Mozilla Firefox 2.0firefox.exe
C:Program FilesMSN Messengermsnmsgr.exe
C:Program FilesMSN Messengerusnsvc.exe
C:Program FilesHijackThisHijackThis.exeR1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = Live Search
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = Sign In
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = MSN.com
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = Live Search
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=pavilion&pf=desktop
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = Live Search
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = MSN.com
O2 – BHO: AcroIEHlprObj Class – {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} – C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 – BHO: Alcohol Toolbar Helper – {52D06F97-5511-43FA-8FDA-C481864FD26E} – C:Program FilesAlcohol Toolbarv3.2.0.0Alcohol_Toolbar.dll
O2 – BHO: SSVHelper Class – {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} – C:Program FilesJavajre1.5.0_10binssv.dll
O2 – BHO: (no name) – {7E853D72-626A-48EC-A868-BA8D5E23E045} – (no file)
O2 – BHO: Google Toolbar Helper – {AA58ED58-01DD-4d91-8333-CF10577473F7} – c:program filesgooglegoogletoolbar1.dll
O2 – BHO: CNavExtBho Class – {BDF3E430-B101-42AD-A544-FADC6B084872} – c:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dll
O3 – Toolbar: HP view – {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} – c:Program FilesHPDigital ImagingbinHPDTLK02.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} – c:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dll
O3 – Toolbar: &Google – {2318C2B1-4965-11d4-9B18-009027A5CD4F} – c:program filesgooglegoogletoolbar1.dll
O3 – Toolbar: Alcohol Toolbar – {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} – C:Program FilesAlcohol Toolbarv3.2.0.0Alcohol_Toolbar.dll
O4 – HKLM..Run: [SunJavaUpdateSched] “C:Program FilesJavajre1.5.0_10binjusched.exe”
O4 – HKLM..Run: [hpsysdrv] c:windowssystemhpsysdrv.exe
O4 – HKLM..Run: [HotKeysCmds] C:WINDOWSsystem32hkcmd.exe
O4 – HKLM..Run: [AGRSMMSG] AGRSMMSG.exe
O4 – HKLM..Run: [HPHUPD06] c:Program FilesHP{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}hphupd06.exe
O4 – HKLM..Run: [HPHmon06] C:WINDOWSsystem32hphmon06.exe
O4 – HKLM..Run: [KBD] C:HPKBDKBD.EXE
O4 – HKLM..Run: [Recguard] C:WINDOWSSMINSTRECGUARD.EXE
O4 – HKLM..Run: [URLLSTCK.exe] c:Program FilesNorton Internet SecurityUrlLstCk.exe
O4 – HKLM..Run: [PS2] C:WINDOWSsystem32ps2.exe
O4 – HKLM..Run: [LSBWatcher] c:hpdrivershplsbwatcherlsburnwatcher.exe
O4 – HKLM..Run: [regcmdcons] c:hpbincloaker.exe c:hpbincmdcons.cmd
O4 – HKLM..Run: [hpfsched] C:WINDOWShpfsched.exe
O4 – HKLM..Run: [msxct] msxct.exe
O4 – HKLM..Run: [s7rg3nQ] ntstrl12.exe
O4 – HKLM..Run: [POINTER] point32.exe
O4 – HKLM..Run: [WorksFUD] C:Program FilesMicrosoft Workswkfud.exe
O4 – HKLM..Run: [Microsoft Works Portfolio] C:Program FilesMicrosoft WorksWksSb.exe /AllUsers
O4 – HKLM..Run: [Microsoft Works Update Detection] C:Program FilesCommon FilesMicrosoft SharedWorks SharedWkUFind.exe
O4 – HKLM..Run: [TkBellExe] “C:Program FilesCommon FilesRealUpdate_OBrealsched.exe” -osboot
O4 – HKLM..Run: [LogonStudio] “C:WinCustomizeLogonStudiologonstudio.exe” /RANDOM
O4 – HKLM..Run: [IgfxTray] C:WINDOWSsystem32igfxtray.exe
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [avgnt] “C:Program FilesAntiVir PersonalEdition Classicavgnt.exe” /min
O4 – HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [FreePDF Assistant] C:Program FilesFreePDF_XPfpassist.exe
O4 – HKLM..Run: [Zune Launcher] “C:Program FilesZuneZuneLauncher.exe”
O4 – HKLM..Run: [ISUSPM] “C:Program FilesCommon FilesInstallShieldUpdateServiceISUSPM.exe” -scheduler
O4 – HKLM..Run: [AlcxMonitor] ALCXMNTR.EXE
O4 – HKLM..Run: [UnlockerAssistant] “C:Documents and SettingsHP_OwnerDesktopMain BaseOther PlacesUnlockerUnlockerAssistant.exe”
O4 – HKLM..Run: [COMODO Firewall Pro] “C:Program FilesComodoFirewallCPF.exe” /background
O4 – HKCU..Run: [MsnMsgr] “C:Program FilesMSN MessengerMsnMsgr.Exe” /background
O4 – HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 – HKCU..Run: [dm2launcher.exe] “C:PROGRA~1DESKTO~1.0dm2launcher.exe” -start
O4 – HKCU..Run: [dw0mRhcEi] ntmyerxp.exe
O4 – HKCU..Run: [MSMSGS] “C:Program FilesMessengerMsmsgs.exe” /background
O4 – HKCU..Run: [updateMgr] C:Program FilesAdobeAcrobat 7.0ReaderAdobeUpdateManager.exe AcRdB7_0_0
O4 – HKCU..Run: [BitTorrent] “C:Program FilesBitTorrentbittorrent.exe” –force_start_minimized
O4 – HKCU..Run: [Aim6] “C:Program FilesAIM6aim6.exe” /d locale=en-US ee://aol/imApp
O4 – Startup: ImationFlashDetect.lnk = C:Program FilesImationImationFlashDetect.exe
O4 – Global Startup: HP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imagingbinhpqtra08.exe
O4 – Global Startup: InterVideo WinCinema Manager.lnk = C:Program FilesInterVideoCommonBinWinCinemaMgr.exe
O4 – Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O4 – Global Startup: SpySubtract.lnk = C:Program FilesInterMuteSpySubtractsslaunch.exe
O9 – Extra button: (no name) – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0_10binnpjpi150_10.dll
O9 – Extra ‘Tools’ menuitem: Sun Java Console – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0_10binnpjpi150_10.dll
O9 – Extra button: Research – {92780B25-18CC-41C8-B9BE-3C9C571A8263} – C:PROGRA~1MI1933~1OFFICE11REFIEBAR.DLL
O9 – Extra button: AIM – {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} – C:Documents and SettingsHP_OwnerDesktopMain BaseInstant MessengersAIMaim.exe
O9 – Extra button: (no name) – {e2e2dd38-d088-4134-82b7-f2ba38496583} – %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 – Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 – {e2e2dd38-d088-4134-82b7-f2ba38496583} – %windir%Network Diagnosticxpnetdiag.exe (file missing)
O9 – Extra button: Yahoo! Messenger – {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} – C:Program FilesYahoo!MessengerYahooMessenger.exe
O9 – Extra ‘Tools’ menuitem: Yahoo! Messenger – {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} – C:Program FilesYahoo!MessengerYahooMessenger.exe
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
O11 – Options group: [INTERNATIONAL] International*
O16 – DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) – http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 – DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) – https://activatemydsl.verizon.net/sdcCommon/download/tgctlcm.cab
O16 – DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) – http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 – DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) – http://musicmix.messenger.msn.com/Medialogic.CAB
O16 – DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) – http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 – DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} – http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 – DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) – http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136228466031
O16 – DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} – http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab
O16 – DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) – http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 – DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) – http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 – DPF: {BD393C14-72AD-4790-A095-76522973D6B8} – http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 – DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) – http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 – Protocol: livecall – {828030A1-22C1-4009-854F-8E305202313F} – C:PROGRA~1MSNMES~1MSGRAP~1.DLL
O18 – Protocol: msnim – {828030A1-22C1-4009-854F-8E305202313F} – C:PROGRA~1MSNMES~1MSGRAP~1.DLL
O18 – Filter: text/html – (no CLSID) – (no file)
O20 – AppInit_DLLs: C:PROGRA~1GoogleGOOGLE~1GOEC62~1.DLL
O20 – Winlogon Notify: igfxcui – C:WINDOWSSYSTEM32igfxsrvc.dll
O20 – Winlogon Notify: WgaLogon – C:WINDOWSSYSTEM32WgaLogon.dll
O21 – SSODL: WPDShServiceObj – {AAA288BA-9A4C-45B0-95D7-94D524869DB5} – C:WINDOWSsystem32WPDShServiceObj.dll
O23 – Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) – Avira GmbH – C:Program FilesAntiVir PersonalEdition Classicsched.exe
O23 – Service: AntiVir PersonalEdition Classic Guard (AntiVirService) – AVIRA GmbH – C:Program FilesAntiVir PersonalEdition Classicavguard.exe
O23 – Service: AOL Connectivity Service (AOL ACS) – America Online, Inc. – C:PROGRA~1COMMON~1AOLACSacsd.exe
O23 – Service: AOL Spyware Protection Service (AOLService) – Unknown owner – C:Program FilesCommon FilesAOLAOL Spyware Protection\aolserv.exe
O23 – Service: Comodo Application Agent (CmdAgent) – COMODO – C:Program FilesComodoFirewallcmdagent.exe
O23 – Service: InstallDriver Table Manager (IDriverT) – Macrovision Corporation – C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 – Service: ISSvc (ISSVC) – Symantec Corporation – c:Program FilesNorton Internet SecurityISSVC.exe
O23 – Service: IviRegMgr – InterVideo – C:Program FilesCommon FilesInterVideoRegMgriviRegMgr.exe
O23 – Service: MySQL – Unknown owner – C:Documents.exe (file missing)
O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:WINDOWSsystem32nvsvc32.exe
O23 – Service: Pml Driver HPZ12 – HP – C:WINDOWSsystem32HPZipm12.exe
O23 – Service: SAVScan – Symantec Corporation – c:Program FilesNorton Internet SecurityNorton AntiVirusSAVScan.exe
O23 – Service: StarWind iSCSI Service (StarWindService) – Rocket Division Software – C:Program FilesAlcohol SoftAlcohol 52StarWindStarWindService.exe
O23 – Service: SymWMI Service (SymWSC) – Symantec Corporation – c:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
O23 – Service: UStorage Server Service – OTi – C:WINDOWSsystem32UStorSrv.exeAlso I tried CWShredder didn’t find anything.
Κασεν:
Thanks for the quick response. Run HijackThis again, and fix the following items:
C:WINDOWSsystem32msxct.exe
C:WINDOWSALCXMNTR.EXE
O2 – BHO: (no name) – {7E853D72-626A-48EC-A868-BA8D5E23E045} – (no file)
O4 – HKLM..Run: [msxct] msxct.exe
O4 – HKLM..Run: [AlcxMonitor] ALCXMNTR.EXE
O4 – HKCU..Run: [dm2launcher.exe] “C:PROGRA~1DESKTO~1.0dm2launcher.exe” -start
O16 – DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} – http://dm.screensavers.com/dm/installers/si/1/sinstaller.cabIt’s advisable to make a backup before fixing, in case you need to rollback if anything untoward happens. I’ve also noticed that you have some Symantec entries in the 023 section. If you’ve already uninstalled your Norton products, download and run the Norton Removal Tool to get rid of any Norton leftovers. Some AntiVir entries also exist in the C:Windows section. Are you using Avira now? You should have only one antivirus and one firewall program running in your system, otherwise you’re looking for trouble. However, you can have more than one antispyware program installed, but don’t have them all running at the same time.
I wasn’t able to find the first two they only appear in the logfile but I got rid of the rest.
Also I just ran the Norton Removal Tool and now I need to restart my comp. And yes I currently use Avira.
Kacen:
Do you have any wallpaper programs installed? I noticed you have WinCustomize in your HijackThis log: O4 – HKLM..Run: [LogonStudio] “C:WinCustomizeLogonStudiologonstudio.exe” /RANDOM. I wonder whether this program is causing your wallpaper problem.
Okay a bit okay it happened again, the CPU problem, it seems to have not changed at all. I had to restart my comp… *sighs*
I deleted all my temp files to see if that helps, also I’m going to delete my temporary internet files.
Kacen:
A few more suggestions that you can try:
- Uninstall any existing shockwave or flash players in your system. Download the latest Adobe Flash Player here.
- Uninstall completely your existing graphics drivers, whether it is ATI or NVidia, and download the latest drivers from their websites and install it.
- Check your paging file size by right-clicking on My Computer > Properties. Go to the Advanced tab, click Settings in Performance. In the Performance Options box that opens, click on the Advanced tab. Make sure Processor scheduling and Memory usage are for Programs. For Virtual Memory click Change. Make sure the No paging file is not on. I’d recommend the System managed size. Click OK to close the window.
Please post back and let me know how it goes. By the way, if step 1 solves your problem, don’t go on to 2 and 3. If it doesn’t, go to step 2 and then step 3.
- You must be logged in to reply to this topic.