MyTechSupport.ca :: Your Computer Technical Resource Headquarters! MyTechSupport.ca :: Your Computer Technical Resource Headquarters!
HOME FORUMS RESOURCES & TOOLS ARTICLES ONLINE STORE ABOUT US
Computer Support Forums arrow Internet & Network Support arrow Security & Viruses arrow Topic: HJT log here -- cpu usage always 100%
June 05, 2020, 12:11:03 AM
 

Home Forum Rules Help Search Mobile Version Login Register

Welcome, Guest. Please login or register.
Did you miss your activation email?
June 05, 2020, 12:11:03 AM

Login with username, password and session length
 Featured Sites:
News
Welcome to MyTechSupport.ca! - Registration is FREE, so why not join our friendly community today?
  0 Members and 1 Guest are viewing this topic.
Pages: [1] Go Down Print
Author Topic: HJT log here -- cpu usage always 100%  (Read 2421 times)
vegajoel
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 1


Bookmark and Share

View Profile
« on: June 08, 2004, 04:59:54 PM »

PLEASE SUPPLY RELEVANT INFORMATION:
Operating System Version: Windows XP
Problem Application Name & Version:
Problem Hardware Make & Model:
Error Messages:



A friend's Dell computer is running abnormally slow, and when you control-alt-delete to see the computer's processes, the CPU usage is nearly always 100%. The percentage of cpu usage seems to fluctuate between the various processes, but it always stays at 100%. Nearly all the superfluous applications have been removed from the computer. Is this a virus/trojan? Or just a bum CPU? The following is the "hijack this" log. Please HELP!!!

Logfile of HijackThis v1.97.7
Scan saved at 11:27:28 AM, on 5/31/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\syscfg.exe
C:\WINDOWS\System32\sysmon32.exe
C:\WINDOWS\System32\dllhost32.exe
C:\WINDOWS\System32\lsas.exe
C:\WINDOWS\System32\MSDN.exe
C:\WINDOWS\System32\s3serv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\spoolsvc.exe
C:\WINDOWS\System32\drivers\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\taskmanagr.exe
C:\Program Files\EarthLink 5.0\ConMgr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\windates.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\SlimBrowser\sbrowser.exe
C:\Documents and Settings\scott\My Documents\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.locators.com/sidebar/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {6ACD11BD-4CA0-4283-A8D8-872B9BA289B6} - C:\PROGRA~1\ACCELE~1\StopSign\WEBCBR~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [System Loader] syscfg.exe
O4 - HKLM\..\Run: [System Monitor] sysmon32.exe
O4 - HKLM\..\Run: [Index Service] dllhost32.exe
O4 - HKLM\..\Run: [COM+ System Applications] lsas.exe
O4 - HKLM\..\Run: [Ynfdn+[jh`n+Hj{~yn] FXOE%nsn
O4 - HKLM\..\Run: [S3 Internal Chip] s3serv.exe
O4 - HKLM\..\Run: [Windows Vptray] spoolsvc.exe
O4 - HKLM\..\Run: [Microsoft Windows Updater] windates.exe
O4 - HKLM\..\Run: [Microsoft Windows Task Manager] taskmanagr.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\mcupdate.exe
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Index Service] dllhost32.exe
O4 - HKLM\..\RunServices: [Configuration Loader] bckup32.exe
O4 - HKLM\..\RunServices: [Windows Vptray] spoolsvc.exe
O4 - HKLM\..\RunServices: [Device Configuration Loader] msdv32.exe
O4 - HKLM\..\RunServices: [COM+ System Applications] lsas.exe
O4 - HKLM\..\RunServices: [S3 Internal Chip] s3serv.exe
O4 - HKLM\..\RunServices: [System Monitor] sysmon32.exe
O4 - HKLM\..\RunServices: [System Loader] syscfg.exe
O4 - HKLM\..\RunServices: [Service Host Process] scvhost.exe
O4 - HKLM\..\RunServices: [Ynfdn+[jh`n+Hj{~yn] FXOE%nsn
O4 - HKLM\..\RunServices: [Microsoft Windows Task Manager] taskmanagr.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Updater] windates.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Windows Task Manager] taskmanagr.exe
O4 - HKCU\..\Run: [Microsoft Windows Updater] windates.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra 'Tools' menuitem: Block This Page (HKLM)
O9 - Extra button: Locators.com Search Bar (HKLM)
O9 - Extra 'Tools' menuitem: Locators.com Search Bar (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: MoneySide (HKLM)
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/download/0/5/c/05c905f4-dd30-427d-a3de-373c3e5552fc/msSecAdv.cab?1082084274906
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab
O16 - DPF: {2119776A-F1AD-4FCD-9548-F1E1C615350C} - http://www.stop-sign.com/pub/download/stop-sign_stp.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,81/mcinsctl.cab
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://D:\Content\include\msSecUcd.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4360/mcfscan.cab

Logged

 
rtty
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 17


Bookmark and Share

View Profile
« Reply #1 on: June 09, 2004, 12:54:29 AM »

That's quite a mess Shocked.  No wonder, I don't see your friend running an AV Angry.

Please do the following:

Run Hijack This again and put a check by these. Close all windows except HijackThis and click "Fix checked"

O4 - HKLM\..\Run: [System Loader] syscfg.exe

O4 - HKLM\..\Run: [System Monitor] sysmon32.exe

O4 - HKLM\..\Run: [Index Service] dllhost32.exe

O4 - HKLM\..\Run: [COM+ System Applications] lsas.exe

O4 - HKLM\..\Run: [Ynfdn+[jh`n+Hj{~yn] FXOE%nsn

O4 - HKLM\..\Run: [S3 Internal Chip] s3serv.exe

O4 - HKLM\..\Run: [Windows Vptray] spoolsvc.exe

O4 - HKLM\..\Run: [Microsoft Windows Updater] windates.exe

O4 - HKLM\..\Run: [Microsoft Windows Task Manager] taskmanagr.exe

O4 - HKLM\..\RunServices: [Index Service] dllhost32.exe

O4 - HKLM\..\RunServices: [Configuration Loader] bckup32.exe

O4 - HKLM\..\RunServices: [Windows Vptray] spoolsvc.exe

O4 - HKLM\..\RunServices: [Device Configuration Loader] msdv32.exe

O4 - HKLM\..\RunServices: [COM+ System Applications] lsas.exe

O4 - HKLM\..\RunServices: [S3 Internal Chip] s3serv.exe

O4 - HKLM\..\RunServices: [System Monitor] sysmon32.exe

O4 - HKLM\..\RunServices: [System Loader] syscfg.exe

O4 - HKLM\..\RunServices: [Service Host Process] scvhost.exe

O4 - HKLM\..\RunServices: [Ynfdn+[jh`n+Hj{~yn] FXOE%nsn

O4 - HKLM\..\RunServices: [Microsoft Windows Task Manager] taskmanagr.exe

O4 - HKLM\..\RunServices: [Microsoft Windows Updater] windates.exe

O4 - HKCU\..\Run: [Microsoft Windows Task Manager] taskmanagr.exe

O4 - HKCU\..\Run: [Microsoft Windows Updater] windates.exe



Restart to safe mode.

How to start your computer in safe mode by following instructions here http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

First in safe mode click on My Computer. Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and "Hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Find and delete:

The C:\WINDOWS\System32\syscfg.exe file
The C:\WINDOWS\System32\sysmon32.exe file
The C:\WINDOWS\System32\dllhost32.exe file
The C:\WINDOWS\System32\lsas.exe file (DO NOT delete lsass.exe in the same foler)
The C:\WINDOWS\System32\taskmanagr.exe file
The C:\WINDOWS\System32\windates.exe file
The C:\WINDOWS\System32\spoolsvc.exe file (DO NOT delete spoolsv.exe in the same folder)
The C:\WINDOWS\System32\msdv32.exe file
The C:\WINDOWS\System32\bckup32.exe file
The C:\WINDOWS\System32\scvhost.exe file (DO NOT delete svchost.exe in the same folder)
The C:\WINDOWS\System32\s3serv.exe file


Also in safe mode click Start -> Run and type in %temp% to open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Empty the Recycle Bin

Now navigate to the C:\Windows\System32\drivers\etc folder. Locate the HOSTS file. Open the HOSTS file in notepad by clicking on it to open it. It will ask you what program you want to use to open it. Tick "Select the program from a list" and click OK. In the menu of programs that opens find and select notepad and click OK. The HOSTS file will open in notepad. Look for a list like this:

127.0.0.1 www.symantec.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 symantec.com
127.0.0.1 www.sophos.com
127.0.0.1 sophos.com
127.0.0.1 sophos.com
127.0.0.1 www.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 liveupdate.symantecliveupdate.com
127.0.0.1 www.viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 viruslist.com
127.0.0.1 f-secure.com
127.0.0.1 www.f-secure.com
127.0.0.1 kaspersky.com
127.0.0.1 www.avp.com
127.0.0.1 www.kaspersky.com
127.0.0.1 avp.com
127.0.0.1 www.networkassociates.com
127.0.0.1 networkassociates.com
127.0.0.1 www.ca.com
127.0.0.1 ca.com
127.0.0.1 mast.mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 www.my-etrust.com
127.0.0.1 download.mcafee.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 secure.nai.com
127.0.0.1 nai.com
127.0.0.1 www.nai.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com

Delete all those lines leaving only this one:

127.0.0.1 localhost

Now close the file and answer Yes to confirm the changes.

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Restart your computer.

When you are sure you are clean turn it back on and create a restore point.


Go here http://www.ravantivirus.com or here http://housecall.trendmicro.com preferebly both and do an online virus scan:


Be sure and put a check in the box by "Auto Clean" before you do the scan. If it finds anything that it cannot clean have it delete it or make a note of the file location so you can delete it yourself.

Run Hijack This again and post another log.


Logged

 
benditup
Hero Member
*****

Karma: +2/-0
Offline Offline

Gender: Male
Posts: 2105


Bookmark and Share

View Profile
« Reply #2 on: June 09, 2004, 01:01:28 AM »

Friends got a few problems, one being he should of been running an
Anti-Virus --- yes there is visible signs of trojans and other malware
I'll give you links to Free AV's later, let's get you clean first

Download Stinger from McAfee and save to desktop
http://download.nai.com/products/mcafee-avert/stinger.exe
Run this later---It should help with at least one of your problems

Download Ad-Aware
Install and CHECK FOR UPDATES
Run this later

You may want to disable system restore, perform an Online virus
scan and then enable system restore

First do this---Not sure how your friend is connected to the Net but
if he/she is connected directly thru a modem and not thru a Router
you should see if XP's firewall is enabled
http://www.microsoft.com/windowsxp/pro/using/howto/networking/icf.asp

Next would you enter your Task Manager and End Process on these

syscfg.exe
sysmon32.exe
dllhost32.exe
lsas.exe <---notice the spelling
MSDN.exe
s3serv.exe
spoolsvc.exe <--notice spelling
taskmanagr.exe
windates.exe
svchost.exe <---If you can determine which is related to This process
C:\WINDOWS\System32\drivers\svchost.exe

The other svchost.exe are OK---leave them alone, there will be more than one

Visit HouseCall's and do a Scan
Set to Autoclean----delete what it Can't fix if you can
http://housecall.trendmicro.com/

Next would you Please Disconnect from the NET
and Restart in SAFE MODE

While in Safe Mode Run Stinger----Fix all problems

RESTART your computer---stay disconnected from the NET
Open an updated Ad-Aware and Set these
click the gear wheel at the top and check these options:

General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."

Click "Proceed" to save your settings, then click "Start", make sure "Activate in-depth scan" is ticked green then scan your system. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

RESTART your computer one more time and post back with a FRESH hijackthis log..
I know this may take some time, depending on your Internet connection
but without any AV installed this is the best way to start cleaning you out.... Even if you had an AV you are still safe to do these steps.
Post back---let me know how it's going
Remember to post a log....

I just noticed you have Zone Alarm installed---no need to enable XP's firewall
« Last Edit: June 09, 2004, 01:20:59 AM by benditup » Logged

 
benditup
Hero Member
*****

Karma: +2/-0
Offline Offline

Gender: Male
Posts: 2105


Bookmark and Share

View Profile
« Reply #3 on: June 09, 2004, 01:10:57 AM »

I think I was typing well you were posting RTTY
Now he has lots of options.... Smiley

Logged

 
Pages: [1] Go Up Print 
 
Jump to:  

Powered by MySQL Powered by PHP

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines

Valid XHTML 1.0! Valid CSS!

Disclaimer
This site is NOT responsible for any damage that the information on this site may cause to your system. Everything you try, whether inspired by the response given from this site or not, is entirely at your own risk. All product names and company names used herein are for identification purpose only and may be trademarks or registered trademarks of their respective owners. We are in no way affiliated or representing any of the companies on this site unless specified.
Back to Top
Stop Spam Harvesters, Join Project Honey Pot Fight Back Against Spammers! Get Firefox! Get Thunderbird! View Sylvain Amyots profile on LinkedIn
Back to Top
Google visited last this page July 30, 2017, 07:42:40 AM