Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

View previous topic View next topic Go down

Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by ohdeucey on 2nd September 2010, 12:09 am

My PC has been steadily going downhill over the last day or two.........CPU usage is at 100% with no applications running.

Before hitting the Restore Point option, I'd like to take a crack a fixing it with your help.

In any case, HiJackThis log is attached.

Thanks in advance.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:39:59 PM, on 9/1/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CFdesign 2010\CFdServ.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\WINDOWS\system32\CBA\pds.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\WINDOWS\system32\mfevtps.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\StandAloneSlv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Common Files\SolidWorks Installation Manager\Scheduler\sldIMScheduler.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [SolidWorks_CheckForUpdates] "C:\Program Files\Common Files\SolidWorks Installation Manager\Scheduler\sldIMScheduler.exe" /scheduler
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\communicator.exe" /fromrunkey
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SolidWorks Task Scheduler Engine.lnk = C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\swBOEngine.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - [You must be registered and logged in to see this link.] Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - [You must be registered and logged in to see this link.] Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - [You must be registered and logged in to see this link.] Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - [You must be registered and logged in to see this link.] Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: corpid02.polycom.com
O15 - Trusted Zone: corpprdapp30.polycom.com
O15 - Trusted Zone: corpprdapp31.polycom.com
O15 - Trusted Zone: corpsbltest10.milpitas.polycom.com
O15 - Trusted Zone: fdm.polycom.com
O15 - Trusted Zone: sololearning.polycom.com
O15 - Trusted Zone: sso.polycom.com
O15 - Trusted Zone: corpid02.polycom.com (HKLM)
O15 - Trusted Zone: corpprdapp30.polycom.com (HKLM)
O15 - Trusted Zone: corpprdapp31.polycom.com (HKLM)
O15 - Trusted Zone: corpsbltest10.milpitas.polycom.com (HKLM)
O15 - Trusted Zone: fdm.polycom.com (HKLM)
O15 - Trusted Zone: sololearning.polycom.com (HKLM)
O15 - Trusted Zone: sso.polycom.com (HKLM)
O16 - DPF: {1ED48504-8834-11D5-AC75-0008C73FD642} (ProductView Express) - [You must be registered and logged in to see this link.] Files\proeWildfire 2.0\i486_nt\obj\pvx_install.exe
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupControlXP Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = andover.polycom.com
O17 - HKLM\Software\..\Telephony: DomainName = andover.polycom.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = andover.polycom.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = andover.polycom.com,milpitas.polycom.com,austin.polycom.com,emea.polycom.com,asia.polycom.com,atlanta.polycom.com,westminster.polycom.com,polycom.com,spectralink.com,polycom.sqa
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = andover.polycom.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = andover.polycom.com,milpitas.polycom.com,austin.polycom.com,emea.polycom.com,asia.polycom.com,atlanta.polycom.com,westminster.polycom.com,polycom.com,spectralink.com,polycom.sqa
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = andover.polycom.com,milpitas.polycom.com,austin.polycom.com,emea.polycom.com,asia.polycom.com,atlanta.polycom.com,westminster.polycom.com,polycom.com,spectralink.com,polycom.sqa
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: 051D6553 - Unknown owner - C:\WINDOWS\system32\051D6553.exe (file missing)
O23 - Service: A8F0BA2C - Unknown owner - C:\WINDOWS\system32\A8F0BA2C.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: BES Client (BESClient) - BigFix Inc. - C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CFdesign 2010 Server - Blue Ridge Numerics, Inc. - C:\Program Files\CFdesign 2010\CFdServ.exe
O23 - Service: SW Distributed TS Coordinator Service (CoordinatorServiceHost) - Dassault Systèmes SolidWorks Corp. - C:\Program Files\SolidWorks Corp\SolidWorks (2)\swScheduler\DTSCoordinatorService.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\CBA\pds.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: Dimension 3D Printers Service (ModelServerWinServiceP) - Stratasys, Inc. - C:\Program Files\Dimension\CatalystEX 4.0\nt\ModelServer.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Solver for Flow Simulation 2010 - Mentor Graphics Corporation - C:\Program Files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\StandAloneSlv.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: Viewpoint Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 14630 bytes

ohdeucey
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2010-01-28
Gender Gender : Male
OS OS : Windows XP
Points Points : 25979
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by Belahzur on 2nd September 2010, 11:52 pm

Hello.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O23 - Service: 051D6553 - Unknown owner - C:\WINDOWS\system32\051D6553.exe (file missing)
    O23 - Service: A8F0BA2C - Unknown owner - C:\WINDOWS\system32\A8F0BA2C.exe


  • Press "Fix Checked"
  • Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by ohdeucey on 3rd September 2010, 2:04 am

Hi....

No infections found.......log below.

Thanks.




Malwarebytes' Anti-Malware 1.46
[You must be registered and logged in to see this link.]

Database version: 4532

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

9/2/2010 9:58:16 PM
mbam-log-2010-09-02 (21-58-16).txt

Scan type: Quick scan
Objects scanned: 161387
Time elapsed: 1 hour(s), 40 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

ohdeucey
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2010-01-28
Gender Gender : Male
OS OS : Windows XP
Points Points : 25979
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by Belahzur on 3rd September 2010, 11:34 pm

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by ohdeucey on 5th September 2010, 6:03 pm

ComboFix 10-09-04.06 - flabuski 09/05/2010 12:52:10.5.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1442 [GMT -4:00]
Running from: c:\documents and settings\flabuski\Desktop\Combo-Fix.exe
AV: VirusScan Enterprise + AntiSpyware Enterprise *On-access scanning enabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.

((((((((((((((((((((((((( Files Created from 2010-08-05 to 2010-09-05 )))))))))))))))))))))))))))))))
.

2010-09-01 12:26 . 2010-09-01 12:26 86680 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-09-01 12:20 . 2010-09-01 12:21 -------- d-----w- c:\documents and settings\Administrator\Tracing
2010-09-01 12:20 . 2010-09-01 12:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\Apple Computer
2010-09-01 12:20 . 2010-09-01 12:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\Dell
2010-09-01 12:19 . 2010-09-01 12:22 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2010-09-01 12:19 . 2010-09-01 12:20 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer
2010-09-01 12:18 . 2010-09-01 12:18 -------- d-----w- c:\documents and settings\Administrator\Application Data\McAfee
2010-09-01 12:18 . 2010-09-01 12:18 -------- d-----w- c:\documents and settings\Administrator\Application Data\IM
2010-09-01 12:16 . 2008-04-14 12:00 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-08-24 14:15 . 2010-08-24 14:15 -------- d-----w- C:\NVIDIA
2010-08-24 01:42 . 2010-08-24 01:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-08-24 01:42 . 2010-08-24 01:42 -------- d-----w- c:\documents and settings\flabuski\Application Data\Office Genuine Advantage
2010-08-17 12:01 . 2010-08-17 12:01 -------- d-----w- c:\documents and settings\flabuski\Application Data\SolidWorks 2009
2010-08-16 11:12 . 2010-08-16 11:12 -------- d-----w- c:\program files\iPod
2010-08-08 21:59 . 2010-08-08 22:07 -------- d-----w- c:\windows\SxsCaPendDel

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-05 16:34 . 2009-10-23 02:17 460031 ----a-w- c:\windows\system32\nvModes.dat
2010-09-05 16:22 . 2009-10-27 16:48 -------- d-----w- c:\documents and settings\flabuski\Application Data\IM
2010-09-05 16:22 . 2010-01-08 21:03 -------- d-----w- c:\program files\CFdesign 2010
2010-09-01 13:50 . 2009-10-27 19:40 -------- d-----w- c:\program files\CCleaner
2010-09-01 10:13 . 2009-10-28 17:02 -------- d-----w- c:\documents and settings\flabuski\Application Data\SolidWorks
2010-08-31 22:11 . 2010-06-28 20:14 479960 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-08-26 01:44 . 2010-01-21 18:06 -------- d-----w- c:\program files\Microsoft Office Communicator
2010-08-16 11:15 . 2010-07-08 14:11 -------- d-----w- c:\program files\iTunes
2010-08-16 11:12 . 2009-10-28 18:48 -------- d-----w- c:\program files\Common Files\Apple
2010-08-16 10:59 . 2010-08-16 10:59 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-08-12 20:10 . 2009-10-27 14:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-11 21:36 . 2009-11-02 17:29 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-11 11:22 . 2010-05-03 17:18 -------- d-----w- c:\program files\Google
2010-08-08 21:59 . 2010-06-14 12:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-08-04 14:49 . 2010-08-04 14:49 503808 ----a-w- c:\documents and settings\flabuski\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-2b1bb0d1-n\msvcp71.dll
2010-08-04 14:49 . 2010-08-04 14:49 499712 ----a-w- c:\documents and settings\flabuski\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-2b1bb0d1-n\jmc.dll
2010-08-04 14:49 . 2010-08-04 14:49 61440 ----a-w- c:\documents and settings\flabuski\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-69e32332-n\decora-sse.dll
2010-08-04 14:49 . 2010-08-04 14:49 348160 ----a-w- c:\documents and settings\flabuski\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-2b1bb0d1-n\msvcr71.dll
2010-08-04 14:49 . 2010-08-04 14:49 12800 ----a-w- c:\documents and settings\flabuski\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-69e32332-n\decora-d3d.dll
2010-07-20 18:38 . 2009-11-23 21:45 -------- d-----w- c:\documents and settings\flabuski\Application Data\DassaultSystemes
2010-07-08 14:03 . 2010-07-08 14:03 -------- d-----w- c:\program files\Bonjour
2010-07-08 13:58 . 2010-02-08 15:14 65408 ---ha-w- c:\windows\system32\mlfcache.dat
2010-06-30 17:53 . 2009-10-27 16:37 86680 ----a-w- c:\documents and settings\flabuski\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-30 12:31 . 2008-04-14 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:10 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-06-24 12:10 . 2008-04-14 12:00 667136 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2008-04-14 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2008-04-14 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-18 20:37 . 2010-06-18 20:37 6656 ----a-w- c:\windows\system32\249ADED0.exe
2010-06-18 11:45 . 2010-06-18 11:45 6656 ----a-w- c:\windows\system32\A8F0BA2C.exe
2010-06-17 14:03 . 2008-04-14 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2009-10-23 01:02 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 13:03 . 2010-06-14 13:03 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-06-14 07:41 . 2008-04-14 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-10 09:09 . 2010-06-10 09:09 503808 ----a-w- c:\documents and settings\flabuski\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-17755af4-n\msvcp71.dll
2010-06-10 09:09 . 2010-06-10 09:09 499712 ----a-w- c:\documents and settings\flabuski\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-17755af4-n\jmc.dll
2010-06-10 09:09 . 2010-06-10 09:09 348160 ----a-w- c:\documents and settings\flabuski\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-17755af4-n\msvcr71.dll
2010-06-10 09:09 . 2010-06-10 09:09 61440 ----a-w- c:\documents and settings\flabuski\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5e79882d-n\decora-sse.dll
2010-06-10 09:09 . 2010-06-10 09:09 12800 ----a-w- c:\documents and settings\flabuski\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5e79882d-n\decora-d3d.dll
2010-06-10 09:08 . 2010-06-10 09:08 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-01-07 00:07 . 2010-01-18 18:48 23864 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
2010-06-29 15:01 . 2010-06-29 15:01 101760 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-07 13529088]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SolidWorks_CheckForUpdates"="c:\program files\Common Files\SolidWorks Installation Manager\Scheduler\sldIMScheduler.exe" [2009-07-29 7320872]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2010-01-07 124240]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"nwiz"="nwiz.exe" [2008-05-07 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-07 86016]
"NVHotkey"="nvHotkey.dll" [2008-05-07 86016]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2009-09-25 136512]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-05-26 1468296]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-02-20 1191936]
"Communicator"="c:\program files\Microsoft Office Communicator\communicator.exe" [2010-07-01 5143904]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2010-04-04 38840]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-04-03 640440]

c:\documents and settings\flabuski\Start Menu\Programs\Startup\
SolidWorks Task Scheduler Engine.lnk - c:\program files\SolidWorks Corp\SolidWorks\swScheduler\swBOEngine.exe [2009-7-29 869672]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2722\Scripts\Logoff\0\0]
"Script"=lo1.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2722\Scripts\Logon\0\0]
"Script"=bigfixclient.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2722\Scripts\Logon\1\0]
"Script"=evclient.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2722\Scripts\Logon\2\0]
"Script"=li1.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2924\Scripts\Logoff\0\0]
"Script"=lo1.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2924\Scripts\Logon\0\0]
"Script"=\\andover.polycom.com\sysvol\andover.polycom.com\scripts\LDInstall.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2924\Scripts\Logon\1\0]
"Script"=evclient.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2924\Scripts\Logon\2\0]
"Script"=li1.cmd

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LANDesk Policy Invoker"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Dimension\\CatalystEX 4.0\\nt\\CatalystEX.exe"=
"c:\\Program Files\\proeWildfire 2.0\\i486_nt\\nms\\nmsd.exe"=
"c:\\Program Files\\proeWildfire 2.0\\i486_nt\\obj\\pro_comm_msg.exe"=
"c:\\Program Files\\proeWildfire 2.0\\i486_nt\\obj\\xtop.exe"=
"c:\\Program Files\\CFdesign 2010\\SMPD.EXE"=
"c:\\Program Files\\Polycom\\Polycom CMA Desktop\\vvsys.exe"=
"c:\\Program Files\\SolidWorks Corp\\SolidWorks\\SLDWORKS.exe"=
"c:\\Program Files\\SolidWorks Corp\\SolidWorks (2)\\SLDWORKS.exe"=
"c:\\Program Files\\SolidWorks Corp\\SolidWorks (2)\\swScheduler\\DTSMonitor.exe"=
"c:\\Program Files\\Microsoft Office Communicator\\communicator.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 CFdesign 2010 Server;CFdesign 2010 Server;c:\program files\CFdesign 2010\CFdServ.exe [6/17/2010 9:24 AM 426352]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [10/27/2009 10:03 AM 70728]
R2 Remote Solver for Flow Simulation 2010;Remote Solver for Flow Simulation 2010;c:\program files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\StandAloneSlv.exe [9/11/2009 8:46 PM 144680]
S0 cerc6;cerc6; [x]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/3/2010 1:18 PM 136176]
S2 McAfeeEngineService;McAfee Engine Service;c:\program files\McAfee\VirusScan Enterprise\engineserver.exe [1/6/2010 8:07 PM 22816]
S2 ModelServerWinServiceP;Dimension 3D Printers Service;c:\program files\Dimension\CatalystEX 4.0\nt\ModelServer.exe [1/16/2009 3:11 PM 442368]
S3 051D6553;051D6553;c:\windows\system32\051D6553.exe --> c:\windows\system32\051D6553.exe [?]
S3 A8F0BA2C;A8F0BA2C;c:\windows\system32\A8F0BA2C.exe [6/18/2010 7:45 AM 6656]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;c:\program files\SolidWorks Corp\SolidWorks (2)\swScheduler\DTSCoordinatorService.exe [1/20/2010 1:59 AM 87336]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [6/17/2009 12:55 PM 40720]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [6/17/2009 12:55 PM 10384]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [10/27/2009 10:03 AM 66600]
S4 LANDesk Policy Invoker;LANDesk Policy Invoker;c:\program files\LANDesk\LDClient\policy.client.invoker.exe [10/27/2009 9:42 AM 139264]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [9/23/2005 7:01 AM 2799808]
.
Contents of the 'Scheduled Tasks' folder

2010-08-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-03 17:18]

2010-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-03 17:18]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: authoria.net\polycomatm
Trusted Zone: force.com
Trusted Zone: intuit.com\ttlc
Trusted Zone: polycom.com\corpid02
Trusted Zone: polycom.com\corpprdapp30
Trusted Zone: polycom.com\corpprdapp31
Trusted Zone: polycom.com\corpsbltest10.milpitas
Trusted Zone: polycom.com\fdm
Trusted Zone: polycom.com\jira
Trusted Zone: polycom.com\sololearning
Trusted Zone: polycom.com\sso
Trusted Zone: salesforce.com
Trusted Zone: authoria.net\polycomatm
Trusted Zone: force.com
Trusted Zone: polycom.com\corpid02
Trusted Zone: polycom.com\corpprdapp30
Trusted Zone: polycom.com\corpprdapp31
Trusted Zone: polycom.com\corpsbltest10.milpitas
Trusted Zone: polycom.com\fdm
Trusted Zone: polycom.com\jira
Trusted Zone: polycom.com\sololearning
Trusted Zone: polycom.com\sso
Trusted Zone: salesforce.com
DPF: {1ED48504-8834-11D5-AC75-0008C73FD642} - [You must be registered and logged in to see this link.] files\proeWildfire 2.0\i486_nt\obj\pvx_install.exe
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\flabuski\Application Data\Mozilla\Firefox\Profiles\eaiicgw0.default\
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\flabuski\Application Data\Mozilla\Firefox\Profiles\eaiicgw0.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\documents and settings\flabuski\Application Data\Move Networks\plugins\npqmp071505000011.dll
FF - plugin: c:\documents and settings\flabuski\Application Data\Mozilla\Firefox\Profiles\eaiicgw0.default\extensions\ietab@ip.cn\plugins\npCoralIETab.dll
FF - plugin: c:\program files\eMusic Download Manager\plugin\npemusic.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-09-05 13:39
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2608)
c:\windows\system32\nview.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
.
Completion time: 2010-09-05 13:58:14
ComboFix-quarantined-files.txt 2010-09-05 17:57

Pre-Run: 45,628,112,896 bytes free
Post-Run: 45,613,010,944 bytes free

- - End Of File - - DE6A6DFD15AAE1897FC66CB557A74FD2

ohdeucey
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2010-01-28
Gender Gender : Male
OS OS : Windows XP
Points Points : 25979
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by Belahzur on 5th September 2010, 9:23 pm

Hello.

  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:
    Code:

    KILLALL::

    Driver::
    051D6553
    A8F0BA2C
    cerc6
  4. Save this as CFScript.txt, in the same location as ComboFix.exe



  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by ohdeucey on 6th September 2010, 12:22 am

ComboFix 10-09-04.06 - flabuski 09/05/2010 18:57:34.6.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1464 [GMT -4:00]
Running from: c:\documents and settings\flabuski\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\flabuski\Desktop\CFScript.txt
AV: VirusScan Enterprise + AntiSpyware Enterprise *On-access scanning enabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_051D6553
-------\Legacy_A8F0BA2C
-------\Service_051D6553
-------\Service_A8F0BA2C
-------\Service_cerc6


((((((((((((((((((((((((( Files Created from 2010-08-05 to 2010-09-05 )))))))))))))))))))))))))))))))
.

2010-09-01 12:20 . 2010-09-01 12:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\Apple Computer
2010-09-01 12:20 . 2010-09-01 12:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\Dell
2010-09-01 12:18 . 2010-09-01 12:18 -------- d-----w- c:\documents and settings\Administrator\Application Data\McAfee
2010-09-01 12:18 . 2010-09-01 12:18 -------- d-----w- c:\documents and settings\Administrator\Application Data\IM
2010-09-01 12:14 . 2009-10-27 11:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\Intel
2010-08-24 01:42 . 2010-08-24 01:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-08-24 01:42 . 2010-08-24 01:42 -------- d-----w- c:\documents and settings\flabuski\Application Data\Office Genuine Advantage
2010-08-17 12:01 . 2010-08-17 12:01 -------- d-----w- c:\documents and settings\flabuski\Application Data\SolidWorks 2009

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-05 23:38 . 2009-10-27 16:48 -------- d-----w- c:\documents and settings\flabuski\Application Data\IM
2010-09-05 23:27 . 2010-01-08 21:03 -------- d-----w- c:\program files\CFdesign 2010
2010-09-05 22:27 . 2009-10-23 02:17 460007 ----a-w- c:\windows\system32\nvModes.dat
2010-09-01 13:50 . 2009-10-27 19:40 -------- d-----w- c:\program files\CCleaner
2010-09-01 12:26 . 2010-09-01 12:26 86680 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-09-01 10:13 . 2009-10-28 17:02 -------- d-----w- c:\documents and settings\flabuski\Application Data\SolidWorks
2010-08-31 22:11 . 2010-06-28 20:14 479960 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-08-26 01:44 . 2010-01-21 18:06 -------- d-----w- c:\program files\Microsoft Office Communicator
2010-08-16 11:15 . 2010-07-08 14:11 -------- d-----w- c:\program files\iTunes
2010-08-16 11:12 . 2010-08-16 11:12 -------- d-----w- c:\program files\iPod
2010-08-16 11:12 . 2009-10-28 18:48 -------- d-----w- c:\program files\Common Files\Apple
2010-08-12 20:10 . 2009-10-27 14:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-11 21:36 . 2009-11-02 17:29 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-11 11:22 . 2010-05-03 17:18 -------- d-----w- c:\program files\Google
2010-08-08 21:59 . 2010-06-14 12:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-07-20 18:38 . 2009-11-23 21:45 -------- d-----w- c:\documents and settings\flabuski\Application Data\DassaultSystemes
2010-07-08 14:03 . 2010-07-08 14:03 -------- d-----w- c:\program files\Bonjour
2010-07-08 13:58 . 2010-02-08 15:14 65408 ---ha-w- c:\windows\system32\mlfcache.dat
2010-06-30 17:53 . 2009-10-27 16:37 86680 ----a-w- c:\documents and settings\flabuski\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-30 12:31 . 2008-04-14 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:10 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-06-24 12:10 . 2008-04-14 12:00 667136 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2008-04-14 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2008-04-14 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-18 20:37 . 2010-06-18 20:37 6656 ----a-w- c:\windows\system32\249ADED0.exe
2010-06-18 11:45 . 2010-06-18 11:45 6656 ----a-w- c:\windows\system32\A8F0BA2C.exe
2010-06-17 14:03 . 2008-04-14 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2009-10-23 01:02 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 13:03 . 2010-06-14 13:03 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-06-14 07:41 . 2008-04-14 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-10 09:08 . 2010-06-10 09:08 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-01-07 00:07 . 2010-01-18 18:48 23864 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
2010-06-29 15:01 . 2010-06-29 15:01 101760 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-07 13529088]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SolidWorks_CheckForUpdates"="c:\program files\Common Files\SolidWorks Installation Manager\Scheduler\sldIMScheduler.exe" [2009-07-29 7320872]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2010-01-07 124240]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"nwiz"="nwiz.exe" [2008-05-07 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-07 86016]
"NVHotkey"="nvHotkey.dll" [2008-05-07 86016]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2009-09-25 136512]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-05-26 1468296]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-02-20 1191936]
"Communicator"="c:\program files\Microsoft Office Communicator\communicator.exe" [2010-07-01 5143904]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2010-04-04 38840]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-04-03 640440]

c:\documents and settings\flabuski\Start Menu\Programs\Startup\
SolidWorks Task Scheduler Engine.lnk - c:\program files\SolidWorks Corp\SolidWorks\swScheduler\swBOEngine.exe [2009-7-29 869672]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2722\Scripts\Logoff\0\0]
"Script"=lo1.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2722\Scripts\Logon\0\0]
"Script"=bigfixclient.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2722\Scripts\Logon\1\0]
"Script"=evclient.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2722\Scripts\Logon\2\0]
"Script"=li1.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2924\Scripts\Logoff\0\0]
"Script"=lo1.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2924\Scripts\Logon\0\0]
"Script"=\\andover.polycom.com\sysvol\andover.polycom.com\scripts\LDInstall.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2924\Scripts\Logon\1\0]
"Script"=evclient.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2924\Scripts\Logon\2\0]
"Script"=li1.cmd

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LANDesk Policy Invoker"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Dimension\\CatalystEX 4.0\\nt\\CatalystEX.exe"=
"c:\\Program Files\\proeWildfire 2.0\\i486_nt\\nms\\nmsd.exe"=
"c:\\Program Files\\proeWildfire 2.0\\i486_nt\\obj\\pro_comm_msg.exe"=
"c:\\Program Files\\proeWildfire 2.0\\i486_nt\\obj\\xtop.exe"=
"c:\\Program Files\\CFdesign 2010\\SMPD.EXE"=
"c:\\Program Files\\Polycom\\Polycom CMA Desktop\\vvsys.exe"=
"c:\\Program Files\\SolidWorks Corp\\SolidWorks\\SLDWORKS.exe"=
"c:\\Program Files\\SolidWorks Corp\\SolidWorks (2)\\SLDWORKS.exe"=
"c:\\Program Files\\SolidWorks Corp\\SolidWorks (2)\\swScheduler\\DTSMonitor.exe"=
"c:\\Program Files\\Microsoft Office Communicator\\communicator.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [6/17/2009 12:55 PM 40720]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [6/17/2009 12:55 PM 10384]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [10/27/2009 10:03 AM 66600]
.
Contents of the 'Scheduled Tasks' folder

2010-08-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-03 17:18]

2010-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-03 17:18]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: authoria.net\polycomatm
Trusted Zone: force.com
Trusted Zone: intuit.com\ttlc
Trusted Zone: polycom.com\corpid02
Trusted Zone: polycom.com\corpprdapp30
Trusted Zone: polycom.com\corpprdapp31
Trusted Zone: polycom.com\corpsbltest10.milpitas
Trusted Zone: polycom.com\fdm
Trusted Zone: polycom.com\jira
Trusted Zone: polycom.com\sololearning
Trusted Zone: polycom.com\sso
Trusted Zone: salesforce.com
Trusted Zone: authoria.net\polycomatm
Trusted Zone: force.com
Trusted Zone: polycom.com\corpid02
Trusted Zone: polycom.com\corpprdapp30
Trusted Zone: polycom.com\corpprdapp31
Trusted Zone: polycom.com\corpsbltest10.milpitas
Trusted Zone: polycom.com\fdm
Trusted Zone: polycom.com\jira
Trusted Zone: polycom.com\sololearning
Trusted Zone: polycom.com\sso
Trusted Zone: salesforce.com
DPF: {1ED48504-8834-11D5-AC75-0008C73FD642} - [You must be registered and logged in to see this link.] files\proeWildfire 2.0\i486_nt\obj\pvx_install.exe
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\flabuski\Application Data\Mozilla\Firefox\Profiles\eaiicgw0.default\
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\flabuski\Application Data\Mozilla\Firefox\Profiles\eaiicgw0.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\documents and settings\flabuski\Application Data\Move Networks\plugins\npqmp071505000011.dll
FF - plugin: c:\documents and settings\flabuski\Application Data\Mozilla\Firefox\Profiles\eaiicgw0.default\extensions\ietab@ip.cn\plugins\npCoralIETab.dll
FF - plugin: c:\program files\eMusic Download Manager\plugin\npemusic.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-09-05 19:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1884)
c:\windows\system32\nview.dll
c:\program files\McAfee\Common Framework\McTrayLegacySupportPlugin.dll
c:\program files\McAfee\Common Framework\McTrayInterfaceLib.dll
c:\program files\McAfee\Common Framework\McAfeeWin32GUISupportDLL.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\BigFix Enterprise\BES Client\BESClient.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\CFdesign 2010\CFdServ.exe
c:\program files\Juniper Networks\Common Files\dsNcService.exe
c:\windows\system32\CBA\pds.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\McAfee\VirusScan Enterprise\engineserver.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\VirusScan Enterprise\vstskmgr.exe
c:\windows\system32\mfevtps.exe
c:\program files\Dell\QuickSet\NICCONFIGSVC.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\StandAloneSlv.exe
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\program files\Viewpoint\Common\ViewpointService.exe
c:\program files\McAfee\VirusScan Enterprise\mcshield.exe
c:\program files\McAfee\VirusScan Enterprise\mfeann.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\Microsoft IntelliPoint\dpupdchk.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Apoint\HidFind.exe
c:\program files\Apoint\Apntex.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\McAfee\Common Framework\McTray.exe
c:\docume~1\flabuski\LOCALS~1\Temp\SolidWorksLicTemp.0001
c:\program files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
c:\windows\system32\ssstars.scr
.
**************************************************************************
.
Completion time: 2010-09-05 20:11:55 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-06 00:11
ComboFix2.txt 2010-09-05 17:58

Pre-Run: 45,619,765,248 bytes free
Post-Run: 45,603,442,688 bytes free

- - End Of File - - 3E31DB74FB94B4E24CB530BFC5E33117

ohdeucey
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2010-01-28
Gender Gender : Male
OS OS : Windows XP
Points Points : 25979
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by Belahzur on 6th September 2010, 8:43 am

Hello.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

Run ESET Online Scan
Please do an online scan with [You must be registered and logged in to see this link.]. Please use Internet Explorer as it uses ActiveX.

  • Check (tick) this box: YES, I accept the Terms of Use.
  • Click on the Start button next to it.
  • When prompted to run ActiveX. click Yes.
  • You will be asked to install an ActiveX. Click Install.
  • Once installed, the scanner will be initialized.
  • After the scanner is initialized, click Start.
  • Check (tick) Remove found threats box.
  • Check (tick) Scan unwanted applications.
  • Click on Scan.
  • It will start scanning. Please be patient.
  • Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by ohdeucey on 9th September 2010, 11:15 am

ESET Log Below......



ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
esets_scanner_update returned -1 esets_gle=0
# version=7
# IEXPLORE.EXE=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=80319f75d9beb741805e01a4fbb25eef
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-06-08 10:04:49
# local_time=2010-06-08 06:04:49 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 11238312 11238312 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=0
# found=0
# cleaned=0
# scan_time=0
esets_scanner_update returned -1 esets_gle=0
# version=7
# IEXPLORE.EXE=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=80319f75d9beb741805e01a4fbb25eef
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-06-08 10:21:44
# local_time=2010-06-08 06:21:44 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 11239327 11239327 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=0
# found=0
# cleaned=0
# scan_time=0
esets_scanner_update returned -1 esets_gle=0
# version=7
# IEXPLORE.EXE=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=80319f75d9beb741805e01a4fbb25eef
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-06-08 10:29:22
# local_time=2010-06-08 06:29:22 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 11239785 11239785 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=0
# found=0
# cleaned=0
# scan_time=0
esets_scanner_update returned -1 esets_gle=53251
# version=7
# IEXPLORE.EXE=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=80319f75d9beb741805e01a4fbb25eef
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-06-09 02:27:21
# local_time=2010-06-09 10:27:21 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 11292637 11292637 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=20656
# found=0
# cleaned=0
# scan_time=4628
esets_scanner_update returned -1 esets_gle=53251
# version=7
# IEXPLORE.EXE=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=80319f75d9beb741805e01a4fbb25eef
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-06-09 05:29:04
# local_time=2010-06-09 01:29:04 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 11297511 11297511 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=171960
# found=0
# cleaned=0
# scan_time=10658
# version=7
# IEXPLORE.EXE=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=80319f75d9beb741805e01a4fbb25eef
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-06-10 08:03:24
# local_time=2010-06-10 04:03:24 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 11386868 11386868 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=21865
# found=0
# cleaned=0
# scan_time=16960
DLL:pipe not connected. attempts=120
DLL:pipe not connected. attempts=120
DLL:pipe not connected. attempts=120
DLL:pipe not connected. attempts=120
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=80319f75d9beb741805e01a4fbb25eef
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-09-09 10:53:16
# local_time=2010-09-09 06:53:16 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 19190863 19190863 0 0
# compatibility_mode=8192 67108863 100 0 7041950 7041950 0 0
# scanned=149003
# found=0
# cleaned=0
# scan_time=42381

ohdeucey
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2010-01-28
Gender Gender : Male
OS OS : Windows XP
Points Points : 25979
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by Belahzur on 9th September 2010, 1:18 pm

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by ohdeucey on 9th September 2010, 3:05 pm

same problem........I've uninstalled a bunch of programs I didn't need anymore and I'm defragging now, but it's still @ 100% and seriously lagging.

Any other suggestions? Do you think a system restore is a good idea?

Thanks.


ohdeucey
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2010-01-28
Gender Gender : Male
OS OS : Windows XP
Points Points : 25979
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by Belahzur on 9th September 2010, 10:23 pm

What process is hogging the CPU? Can you check that for me in the Task Manager.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by ohdeucey on 10th September 2010, 12:45 am

seems like services.exe is the worst.

ohdeucey
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2010-01-28
Gender Gender : Male
OS OS : Windows XP
Points Points : 25979
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by ohdeucey on 13th September 2010, 2:26 am

Still acting flakey....new MBAM log below. 1 infection found

Malwarebytes' Anti-Malware 1.46
[You must be registered and logged in to see this link.]

Database version: 4602

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

9/12/2010 10:12:03 PM
mbam-log-2010-09-12 (22-12-03).txt

Scan type: Full scan (C:\|)
Objects scanned: 299234
Time elapsed: 6 hour(s), 22 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{B934BBDF-D646-4A9B-BAB0-18E5A77AC001}\RP265\A0392242.rbf (Spyware.Passwords) -> Quarantined and deleted successfully.

ohdeucey
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2010-01-28
Gender Gender : Male
OS OS : Windows XP
Points Points : 25979
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by Belahzur on 13th September 2010, 9:02 pm

Just a restore point.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.


Is your CPU still spiking at 100%?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by ohdeucey on 14th September 2010, 5:57 pm

Yeah......still at 100%, not quite sure what's going on at this point. I'm not even able to go back to a restore point.

Maybe a hardware issue?

Thanks.


ohdeucey
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2010-01-28
Gender Gender : Male
OS OS : Windows XP
Points Points : 25979
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by ohdeucey on 15th September 2010, 1:52 pm

Update for the day.......

I opened up my laptop and realized there was a faulty connection on the CPU fan. I fixed it and lo and behold, everything seems to be working fine.

Thanks for the help.


ohdeucey
Intermediate
Intermediate

Posts Posts : 66
Joined Joined : 2010-01-28
Gender Gender : Male
OS OS : Windows XP
Points Points : 25979
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Computer Slowly Running SLower, Task Manager @ 100% CPU Usage

Post by Belahzur on 16th September 2010, 12:16 am

Yay, good work. Smile

If everything is working correct now, you are free to go.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245111
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum