What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Explorer.exe taking over cpu Start button disabled

35 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
No change. it seems the second OTL didn't work. I did mbam anyway and it found nothing. I did hit the wrong button (cleanup) on OTL b4 the second scan and had to close it and restart it. I don't think it did anything and no log was generated. here are the logs All processes killed ========== SERVICES/DRIVERS ========== ========== FILES ========== C:\Users\Public\Documents\Server folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Dad2 ->Temp folder emptied: 37680993 bytes ->Temporary Internet Files folder emptied: 46396771 bytes ->Java cache emptied: 0 bytes ->Google Chrome cache emptied: 12173135 bytes ->Flash cache emptied: 798 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public User: User ->Temp folder emptied: 5384319 bytes ->Temporary Internet Files folder emptied: 16805060 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Google Chrome cache emptied: 7873938 bytes ->Flash cache emptied: 872 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 95958 bytes RecycleBin emptied: 41875323 bytes Total Files Cleaned = 160.00 mb OTL by OldTimer - Version 3.2.17.3 log created on 12052010_232559 Files\Folders moved on Reboot… C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PQY00EYR\bf_new[1].gif moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PQY00EYR\ButtonTransparent[1].png moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PQY00EYR\sad[1].gif moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EE0R6UWS\gender_female[1].png moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EE0R6UWS\lastpost[1].gif moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EE0R6UWS\stats[1].gif moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\EE0R6UWS\user[1].gif moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\bc_new[1].gif moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\CommentsListHeading[1].png moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\favicon[1].ico moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\favicon[2].ico moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\iframeCA10DF75.htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\iframeCA91Z1C4.htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\iframeCABM605U.htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\iframeCAKD37TS.htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\iframeCAM1ZF8A.htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\iframe[10].htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\iframe[11].htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\iframe[7].htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\iframe[8].htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\iframe[9].htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\index[2].htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4GD01CMF\like[2].htm moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0QJD4D89\CommentsFormHeading[1].png moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0QJD4D89\img-resized[1].png moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0QJD4D89\post_snapback[1].gif moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0QJD4D89\pullhair[1].gif moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0QJD4D89\RelatedPostsHeading[1].png moved successfully. C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully. File move failed. C:\Windows\temp\CLML_AGENT_LOG1.txt scheduled to be moved on reboot. File\Folder C:\Windows\temp\sqlite_sBzytbFvic6icRa not found! Registry entries deleted on Reboot… Error: Unable to interpret in the current context! OTL by OldTimer - Version 3.2.17.3 log created on 12052010_234134 Malwarebytes' Anti-Malware 1.50 www.malwarebytes.org Database version: 5253 Windows 6.0.6000 Internet Explorer 7.0.6000.16982 05/12/2010 11:55:53 PM mbam-log-2010-12-05 (23-55-53).txt Scan type: Quick scan Objects scanned: 144187 Time elapsed: 6 minute(s), 6 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #17
Hi ray260,

Looks like you may have clicked "Run Fix" when you ran OTL the 2nd time. No matter, we need to go deeper.

This next tool will not run if AVG is installed. Your AVG is an older version and should be updated anyway.

Since we don't know how many times we will need to use the tool I'll give you the link to another free antivirus program that you can use while we are cleaning your computer. You can always uninstall it and reinstall AVG after your computer is clean.


note-you may need to right click the link and choose "Save target as"


Download the free version of Avast Home and save it your desktop.

Avast


You will also need this tool to assist with the removal of AVG

Avg Removal tool


And the tool we are going to use,

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

You may want to print out or copy and paste the rest of these instuctions into a notepad for reference as you will be off line.

  • Disconnect completely from the internet, uplug the modem if necessary
  • Uninstall AVG
  • Run the AVG removal tool with a right click and "Run as Adminstrator"
  • Run combofix with the following instructions

  • Right click on ComboFix.exe, click Run as Administrator & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


After you have saved the combofix log please install Avast by right clicking the Avast file you previously downloaded and selecting "run as Adminstrator"

Connect to the internet and post the combofix log.

Thanks

Thanks
Post #18
Followed all instructions. Thanks.

ComboFix 10-12-04.06 - User 06/12/2010 16:28:41.1.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.2.1033.18.1014.343 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\INSTALL.LOG
c:\users\User\AppData\Roaming\inst.exe
D:\install.exe

.
((((((((((((((((((((((((( Files Created from 2010-11-06 to 2010-12-06 )))))))))))))))))))))))))))))))
.

2010-12-06 21:38 . 2010-12-06 21:39 ——– d—–w- c:\users\User\AppData\Local\temp
2010-12-06 04:41 . 2010-12-06 04:41 ——– d—–w- C:\_OTL
2010-12-05 20:09 . 2010-12-05 21:29 ——– d—–w- C:\Temp
2010-12-05 20:02 . 2010-12-05 20:02 ——– d—–w- c:\program files\DVDStyler
2010-12-04 23:47 . 2010-12-06 21:15 ——– d—–w- c:\users\Dad2
2010-11-15 17:27 . 2009-08-24 12:47 378368 —-a-w- c:\windows\system32\winhttp.dll
2010-11-15 17:27 . 2009-11-03 10:37 396800 —-a-w- c:\windows\system32\drivers\http.sys
2010-11-15 17:27 . 2009-11-03 13:01 24064 —-a-w- c:\windows\system32\nshhttp.dll
2010-11-15 17:27 . 2009-11-03 12:57 31232 —-a-w- c:\windows\system32\httpapi.dll
2010-11-13 19:21 . 2009-03-17 03:16 14848 —-a-w- c:\windows\system32\apilogen.dll
2010-11-13 19:21 . 2009-03-17 03:16 25600 —-a-w- c:\windows\system32\amxread.dll
2010-11-13 19:21 . 2009-09-10 15:29 1418240 —-a-w- c:\program files\Windows Media Player\setup_wm.exe
2010-11-13 19:21 . 2009-09-10 15:29 311296 —-a-w- c:\windows\system32\unregmp2.exe
2010-11-13 19:20 . 2009-09-10 17:40 4096 —-a-w- c:\windows\system32\msdxm.ocx
2010-11-13 19:20 . 2009-09-10 17:40 4096 —-a-w- c:\windows\system32\dxmasf.dll
2010-11-13 19:20 . 2009-09-10 17:39 7680 —-a-w- c:\windows\system32\spwmp.dll
2010-11-13 19:20 . 2009-09-10 15:29 107520 —-a-w- c:\program files\Windows Media Player\wmpconfig.exe
2010-11-13 19:20 . 2009-09-10 15:29 168960 —-a-w- c:\program files\Windows Media Player\wmplayer.exe
2010-11-13 19:20 . 2009-09-10 15:29 107520 —-a-w- c:\program files\Windows Media Player\wmpshare.exe
2010-11-13 19:20 . 2009-09-10 15:29 8147968 —-a-w- c:\windows\system32\wmploc.DLL
2010-11-13 19:18 . 2009-08-14 16:40 103936 —-a-w- c:\windows\system32\netiohlp.dll
2010-11-13 19:18 . 2009-08-14 14:25 9728 —-a-w- c:\windows\system32\TCPSVCS.EXE
2010-11-13 19:18 . 2009-08-14 14:25 17920 —-a-w- c:\windows\system32\ROUTE.EXE
2010-11-13 19:18 . 2009-08-14 14:25 11264 —-a-w- c:\windows\system32\MRINFO.EXE
2010-11-13 19:18 . 2009-08-14 14:25 27136 —-a-w- c:\windows\system32\NETSTAT.EXE
2010-11-13 19:18 . 2009-08-14 14:25 8704 —-a-w- c:\windows\system32\HOSTNAME.EXE
2010-11-13 19:18 . 2009-08-14 14:25 19968 —-a-w- c:\windows\system32\ARP.EXE
2010-11-13 19:18 . 2009-08-14 14:25 10240 —-a-w- c:\windows\system32\finger.exe
2010-11-13 19:18 . 2009-08-14 16:40 15360 —-a-w- c:\windows\system32\netevent.dll
2010-11-13 19:17 . 2009-07-11 19:32 297984 —-a-w- c:\windows\system32\wlansec.dll
2010-11-13 19:17 . 2009-07-11 19:32 290816 —-a-w- c:\windows\system32\wlanmsm.dll
2010-11-13 19:17 . 2009-07-11 19:26 123904 —-a-w- c:\windows\system32\L2SecHC.dll
2010-11-13 19:17 . 2009-07-11 19:32 502272 —-a-w- c:\windows\system32\wlansvc.dll
2010-11-13 19:17 . 2009-07-11 19:32 67584 —-a-w- c:\windows\system32\wlanhlp.dll
2010-11-13 19:17 . 2009-07-11 19:32 47104 —-a-w- c:\windows\system32\wlanapi.dll
2010-11-13 19:15 . 2010-03-04 19:24 434176 —-a-w- c:\windows\system32\vbscript.dll
2010-11-13 19:15 . 2009-07-17 14:52 71680 —-a-w- c:\windows\system32\atl.dll
2010-11-13 19:15 . 2008-06-05 04:50 30208 —-a-w- c:\windows\system32\xolehlp.dll
2010-11-13 19:15 . 2008-06-05 04:50 500736 —-a-w- c:\windows\system32\msdtcprx.dll
2010-11-13 19:15 . 2009-06-10 12:16 156160 —-a-w- c:\windows\system32\wkssvc.dll
2010-11-13 19:15 . 2009-10-14 15:02 10922496 —-a-w- c:\program files\Movie Maker\MOVIEMK.dll
2010-11-13 19:15 . 2009-10-14 15:06 195072 —-a-w- c:\program files\Movie Maker\WMM2AE.dll
2010-11-13 19:15 . 2009-10-14 15:06 23040 —-a-w- c:\program files\Movie Maker\WMM2EXT.dll
2010-11-13 19:15 . 2009-10-14 12:54 150016 —-a-w- c:\program files\Movie Maker\MOVIEMK.exe
2010-11-13 19:15 . 2009-10-23 17:54 713728 —-a-w- c:\windows\system32\timedate.cpl
2010-11-13 19:14 . 2009-06-04 12:43 1871872 —-a-w- c:\windows\system32\mstscax.dll
2010-11-13 19:14 . 2009-06-04 12:47 36352 —-a-w- c:\windows\system32\tsgqec.dll
2010-11-13 19:14 . 2009-06-04 12:36 116736 —-a-w- c:\windows\system32\aaclient.dll
2010-11-13 19:14 . 2010-01-23 08:05 2048 —-a-w- c:\windows\system32\tzres.dll
2010-11-13 19:13 . 2009-04-23 12:56 696832 —-a-w- c:\windows\system32\localspl.dll
2010-11-13 19:12 . 2009-06-15 15:29 175104 —-a-w- c:\windows\system32\wdigest.dll
2010-11-13 19:12 . 2009-06-15 15:23 494592 —-a-w- c:\windows\system32\kerberos.dll
2010-11-13 19:12 . 2009-06-15 18:12 408136 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2010-11-13 19:12 . 2009-06-15 15:28 272384 —-a-w- c:\windows\system32\schannel.dll
2010-11-13 19:12 . 2009-06-15 15:23 1233920 —-a-w- c:\windows\system32\lsasrv.dll
2010-11-13 19:12 . 2009-06-15 15:28 72704 —-a-w- c:\windows\system32\secur32.dll
2010-11-13 19:12 . 2009-06-15 13:10 7680 —-a-w- c:\windows\system32\lsass.exe
2010-11-13 19:07 . 2009-08-14 14:01 2031104 —-a-w- c:\windows\system32\win32k.sys
2010-11-13 19:07 . 2009-07-14 13:02 313344 —-a-w- c:\windows\system32\wmpdxm.dll
2010-11-13 19:07 . 2009-07-14 09:54 43520 —-a-w- c:\windows\system32\msdxm.tlb
2010-11-13 19:07 . 2009-07-14 09:54 18432 —-a-w- c:\windows\system32\amcompat.tlb
2010-11-13 19:06 . 2010-01-25 12:58 473088 —-a-w- c:\windows\system32\secproc_isv.dll
2010-11-13 19:06 . 2010-01-25 12:58 472576 —-a-w- c:\windows\system32\secproc.dll
2010-11-13 19:06 . 2010-01-25 08:36 435712 —-a-w- c:\windows\system32\RMActivate_ssp.exe
2010-11-13 19:06 . 2010-01-25 08:36 515584 —-a-w- c:\windows\system32\RMActivate.exe
2010-11-13 19:06 . 2010-01-25 08:36 431104 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-11-13 19:06 . 2010-01-25 08:35 523776 —-a-w- c:\windows\system32\RMActivate_isv.exe
2010-11-13 19:06 . 2010-01-25 12:58 154624 —-a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-11-13 19:06 . 2010-01-25 12:58 154112 —-a-w- c:\windows\system32\secproc_ssp.dll
2010-11-13 19:06 . 2010-01-25 12:56 312320 —-a-w- c:\windows\system32\msdrm.dll
2010-11-13 19:06 . 2009-08-29 03:41 1686528 —-a-w- c:\windows\system32\gameux.dll
2010-11-13 19:06 . 2009-08-29 03:40 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2010-11-13 19:06 . 2009-08-28 23:31 4247552 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-11-13 19:05 . 2009-09-04 12:38 60928 —-a-w- c:\windows\system32\msasn1.dll
2010-11-13 19:05 . 2009-04-23 13:01 788992 —-a-w- c:\windows\system32\rpcrt4.dll
2010-11-13 18:34 . 2009-09-14 09:50 130048 —-a-w- c:\windows\system32\drivers\srv2.sys
2010-11-13 18:34 . 2009-10-07 12:47 232960 —-a-w- c:\windows\system32\rastls.dll
2010-11-13 18:34 . 2009-10-07 12:47 274432 —-a-w- c:\windows\system32\raschap.dll
2010-11-13 18:34 . 2009-08-10 13:08 321536 —-a-w- c:\windows\system32\WSDApi.dll
2010-11-13 18:32 . 2009-12-28 12:35 1327616 —-a-w- c:\windows\system32\quartz.dll
2010-11-13 18:32 . 2009-12-28 12:36 11776 —-a-w- c:\windows\system32\tsbyuv.dll
2010-11-13 18:32 . 2009-12-28 12:34 22528 —-a-w- c:\windows\system32\msyuv.dll
2010-11-13 18:32 . 2009-12-28 12:34 31232 —-a-w- c:\windows\system32\msvidc32.dll
2010-11-13 18:32 . 2009-12-28 12:34 13312 —-a-w- c:\windows\system32\msrle32.dll
2010-11-13 18:32 . 2009-12-28 12:32 50176 —-a-w- c:\windows\system32\iyuv_32.dll
2010-11-13 18:32 . 2009-12-28 12:33 82944 —-a-w- c:\windows\system32\mciavi32.dll
2010-11-13 18:32 . 2009-12-28 12:30 88576 —-a-w- c:\windows\system32\avifil32.dll
2010-11-13 18:32 . 2009-12-28 12:34 123904 —-a-w- c:\windows\system32\msvfw32.dll
2010-11-13 18:32 . 2009-12-28 12:30 65024 —-a-w- c:\windows\system32\avicap32.dll
2010-11-13 18:32 . 2009-04-02 11:50 604672 —-a-w- c:\windows\system32\WMSPDMOD.DLL
2010-11-13 18:26 . 2009-12-23 12:45 171520 —-a-w- c:\windows\system32\wintrust.dll
2010-11-13 18:26 . 2010-01-13 18:23 97792 —-a-w- c:\windows\system32\cabview.dll
2010-11-07 20:28 . 2010-11-18 17:58 ——– d—–w- c:\program files\VideoLAN
2010-11-07 19:27 . 2010-11-18 18:19 ——– d—–w- c:\programdata\eMule
2010-11-07 19:25 . 2010-11-18 18:22 ——– d—–w- c:\users\User\AppData\Local\eMule

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-29 22:42 . 2009-10-30 01:35 38224 ——w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-29 22:42 . 2009-10-30 01:35 20952 ——w- c:\windows\system32\drivers\mbam.sys
2010-11-18 18:23 . 2007-02-12 07:31 47360 —-a-w- c:\users\User\AppData\Roaming\pcouffin.sys
2010-09-15 08:50 . 2010-04-24 16:41 472808 —-a-w- c:\windows\system32\deployJava1.dll
2010-09-08 13:09 . 2007-04-18 21:52 108032 —-a-w- c:\windows\system32\ff_vfw.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-03-11 1232896]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-07-07 160328]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-06 81920]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-11-28 614400]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 464168]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-20 4018176]
"PCMService"="c:\program files\Acer\Acer Arcade\PCMService.exe" [2006-11-18 151552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideFastUserSwitching"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideFastUserSwitching"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-06-17 02:22 136176 —-atw- c:\users\User\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-10-12 20:33 328568 —-a-w- c:\program files\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 gupdate1c9d2764cb4ff90;Google Update Service (gupdate1c9d2764cb4ff90);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-11 133104]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936]
R3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\system32\DRIVERS\SMSCirda.sys [2006-10-18 31232]
R3 WSVD;WSVD;c:\windows\system32\drivers\WSVD.sys [2006-09-19 80744]
S2 {2FF8D163-C3C2-46ce-BD8D-D85AC1BC56DD};{2FF8D163-C3C2-46ce-BD8D-D85AC1BC56DD};c:\program files\Acer\Acer Arcade\000.fcl [2006-11-18 6656]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contents of the 'Scheduled Tasks' folder

2010-12-06 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-14 03:20]

2010-12-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-11 20:22]

2010-12-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-11 20:22]

2010-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1948978850-1265731506-4122968266-1000Core.job
- c:\users\User\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-16 02:22]

2010-12-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1948978850-1265731506-4122968266-1000UA.job
- c:\users\User\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-16 02:22]

2010-12-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1948978850-1265731506-4122968266-1001Core.job
- c:\users\Dad2\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-05 18:04]

2010-12-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1948978850-1265731506-4122968266-1001UA.job
- c:\users\Dad2\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-05 18:04]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.ca/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://en.ca.acer.yahoo.com
uSearchURL,(Default) = hxxp://ca.rd.yahoo.com/customize/ycomp/defaults/su/*http://ca.yahoo.com
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: {{D85B4BE2-07C3-422f-ADE9-B1A2C7D25224} - c:\program files\WPT\WPTPoker\RunApp.exe
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
DPF: {0A706A23-DEF4-4C4B-B1F6-96AAB61F2257} - hxxps://techinline.net/Expert/TIEXpert.cab
DPF: {9D67EBF0-AF1A-4BCE-BAC9-C84A9383E0B3} - hxxp://service.samsungportal.com/EP/web/common/cabfiles/UniSSOCheck.cab
DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} - hxxp://service.samsungportal.com/EP/web/common/cabfiles/ActiveXSetup.cab
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\mh903aau.default\
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - component: c:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\User\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - Extension: Hide My IP: [removed] - c:\program files\Mozilla Firefox\extensions\[removed]
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Extension: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\program files\Real\RealPlayer\browserrecord
FF - Extension: AI Roboform Toolbar for Firefox: {22119944-ED35-4ab1-910B-E619EA06A115} - c:\program files\Siber Systems\AI RoboForm\Firefox

—- FIREFOX POLICIES —-
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
MSConfigStartUp-ClickPotatoLiteSA - c:\program files\ClickPotatoLite\bin\10.0.536.0\ClickPotatoLiteSA.exe
AddRemove-Noble Poker - c:\poker\Noble Poker\_SetupPoker_8d854c.exe
AddRemove-William Hill Poker - c:\poker\William Hill Poker\_SetupPoker_c6838e_en[1].exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-06 16:38
Windows 6.0.6000 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{2FF8D163-C3C2-46ce-BD8D-D85AC1BC56DD}]
"ImagePath"="\??\c:\program files\Acer\Acer Arcade\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-12-06 16:42:00
ComboFix-quarantined-files.txt 2010-12-06 21:41

Pre-Run: 14,192,664,576 bytes free
Post-Run: 14,037,172,224 bytes free

- - End Of File - - DFDCA0665B8F267F935DCC4498F28A60
Post #21
Hi ray260,

Let's see if we can find something with this scanner.

Plese note as a Vista user you must run your browser differently to do this scan
  • Right click your browser icon and choose "Run as Administrator"
  • Follow the instructions listed below
  • Do note browse any where else with this browser as it will have Administrator rights
  • When the scan is commplete and the log saved, please close that instance of your browser
  • Open a new browser in the usual way and return to this topic and post the log

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Go here to run an online scannner from
ESET

(Note: You must use Internet Explorer for this scan.)

  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  • Click Start
  • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
  • Click Scan.
  • Wait for the scan to finish.
  • Re-enable your Antivirus software.
  • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.
Please post back with the ESET log.
Post #22
Here it is ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=7.00.6000.16386 (vista_rtm.061101-2205) # OnlineScanner.ocx=1.0.0.6415 # api_version=3.0.2 # EOSSerial=2850a5885e8aa042809923ec0f54c0cc # end=stopped # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2010-12-08 04:50:58 # local_time=2010-12-07 11:50:58 (-0500, Eastern Standard Time) # country="Canada" # lang=9 # osver=6.0.6000 NT # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=770 16774141 100 100 15958 67563173 0 0 # compatibility_mode=1026 16777214 0 2 33070682 33070682 0 0 # compatibility_mode=5892 16776574 100 100 0 128386073 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=184386 # found=3 # cleaned=0 # scan_time=5359 C:\Poker Application\Absolute Poker\apbrowser.dll probably a variant of Win32/Adware.SearchAid.KYKHOJQ application (unable to clean) 00000000000000000000000000000000 I C:\Users\Dad2\Desktop\Casinos\set ups\7Sultans.exe a variant of Win32/PrimeCasino application (unable to clean) 00000000000000000000000000000000 I C:\Users\User\Desktop\Casinos\set ups\7Sultans.exe a variant of Win32/PrimeCasino application (unable to clean) 00000000000000000000000000000000 I
Post #23
Hi ray260,

Let's see some other opinions of those files.

We need some file informantion
  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path, one at a time if more than file is listed, into the "Suspicious files to scan" box on the top of the page:


    C:\Poker Application\Absolute Poker\apbrowser.dll
    C:\Users\Dad2\Desktop\Casinos\set ups\7Sultans.exe
    C:\Users\User\Desktop\Casinos\set ups\7Sultans.exe

  • Click on the Upload button
  • Please ensure the scan is complete and the results saved before submitting the next.
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.


Next

We'll see what happens when we close explorer and restart it. Your desktop and taskbar will disappear when we do this but will reappear when we restart explorer.

Open Task Manager with ctrl,alt,del
  • In Task Manager, click the Options button
    check mark Always on Top
  • This will keep Taskmanager from disappearing when you click on anything else.

Make sure there is only one instance of explorer.exe. Let me know if there is more than one.
  • locate explorer.exe
  • click on it and click End process
Look at the System Idle process, what is the usage?

In taskmanger
  • click file
  • click New Task(Run…)
  • type the following line into the open: field

    explorer.exe
  • click ok
Explorer should now start and your desktop and taskbar should reappear. Please check the usage for explorer.exe.

Please post back with
  • Virscan results
  • explorer usage
Thanks
Post #24
Followed instructions. The sultans file is an old one that I don't even remember if I ever used or not. The one under dad2 is just in a directory that I had to make a copy of under my new user. I will shred both as soon as you get back to me. When stopping explorer process cpu went down to 3-4%. It returned to 50% when I restarted. here are the logs, only did the sultan under user as i cant access the dad2 one from this user setting.

VirSCAN.org Scanned Report :
Scanned time : 2010/12/10 12:00:14 (CST)
Scanner results: 44% Scanner(s) (16/36) found malware!
File Name : apbrowser.dll
File Size : 28672 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : 9e7b5419b08f331cb58d7df7c26c6ad6
SHA1 : fd2b303cd9c73be96011a3404da9bb648b2b887c
Online report : http://virscan.org/report/327b467973e566b9…35b1bf2b97.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.1.0.1 20101210010847 2010-12-10 15.26 Riskware.AdWare.Win32.NewWeb!IK
AhnLab V3 2010.12.09.00 2010.12.09 2010-12-09 40.09 -
AntiVir 8.2.4.122 7.10.14.253 2010-12-10 0.28 ADSPY/Newweb.X.16
Antiy 2.0.18 20101207.6186214 2010-12-07 0.02 -
Arcavir 2010 201012110108 2010-12-11 0.05 Adware.Newweb.X
Authentium 5.1.1 201012100237 2010-12-10 1.31 W32/Adware.LVJ (Exact)
AVAST! 4.7.4 101210-0 2010-12-10 0.01 Win32:Adware-gen [Adw]
AVG 8.5.850 271.1.1/3299 2010-12-06 0.25 Toolbar.AB
BitDefender 7.90123.6393895 7.35009 2010-12-11 9.20 Adware.Generic.40632
ClamAV 0.96.3 12372 2010-12-10 0.18 -
Comodo 4.0 7014 2010-12-10 0.96 -
CP Secure 1.3.0.5 2010.12.10 2010-12-10 0.05 -
Dr.Web 5.0.2.3300 2010.12.11 2010-12-11 11.26 -
F-Prot 4.4.4.56 20101210 2010-12-10 1.34 W32/Adware.LVJ (exact)
F-Secure 7.02.73807 2010.12.10.09 2010-12-10 8.90 -
Fortinet 4.2.254 12.653 2010-12-09 1.55 -
GData 21.1256/21.532 20101210 2010-12-10 40.10 -
ViRobot 20101210 2010.12.10 2010-12-10 0.90 -
Ikarus T3.1.32.15.0 2010.12.10.77327 2010-12-10 5.54 not-a-virus:AdWare.Win32.NewWeb
JiangMin 13.0.900 2010.11.30 2010-11-30 1.47 -
Kaspersky 5.5.10 2010.12.10 2010-12-10 0.09 not-a-virus:AdWare.Win32.NewWeb.x
KingSoft 2009.2.5.15 2010.12.10.18 2010-12-10 0.86 -
McAfee 5400.1158 6193 2010-12-10 18.02 -
Microsoft 1.6402 2010.12.10 2010-12-10 14.98 -
Norman 6.06.11 6.06.00 2010-12-07 10.01 W32/Newweb.OL
Panda 9.05.01 2010.12.10 2010-12-10 12.19 -
Trend Micro 9.120-1004 7.692.13 2010-12-10 0.03 TROJ_Gen.MZ40M2
Quick Heal 11.00 2010.12.09 2010-12-09 6.09 AdWare.NewWeb.x (Not a Virus)
Rising 20.0 22.77.03.08 2010-12-09 1.67 -
Sophos 3.14.1 4.60 2010-12-11 2.97 -
Sunbelt 3.9.2459.2 7584 2010-12-09 1.11 Adware.NewWeb
Symantec 1.3.0.24 20101210.002 2010-12-10 1.28 -
nProtect 20101210.01 9299033 2010-12-10 40.09 -
The Hacker 6.7.0.1 v00097 2010-12-08 1.12 Adware/NewWeb.x (Unwanted)
VBA32 3.12.14.2 20101210.1339 2010-12-10 3.29 AdWare.Win32.NewWeb.x
VirusBuster 4.5.11.10 10.130.42/2008276 2010-12-09 2.56 -


VirSCAN.org Scanned Report :
Scanned time : 2010/12/10 12:09:04 (CST)
Scanner results: 11% Scanner(s) (4/36) found malware!
File Name : 7Sultans.exe
File Size : 462432 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 2e4200908258ddd82bdad4bb0ec3f42a
SHA1 : cbd32de91dd3ed10a553dd0510fa8e464f69da4a
Online report : http://virscan.org/report/11eeb9455aa0be7d…a6d9b814db.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.1.0.1 20101210010847 2010-12-10 5.12 -
AhnLab V3 2010.12.09.00 2010.12.09 2010-12-09 1.60 -
AntiVir 8.2.4.122 7.10.14.253 2010-12-10 0.28 GAME/Casino.Gen
Antiy 2.0.18 20101207.6186214 2010-12-07 0.02 -
Arcavir 2010 201012110108 2010-12-11 0.14 -
Authentium 5.1.1 201012100237 2010-12-10 2.66 -
AVAST! 4.7.4 101210-0 2010-12-10 0.03 -
AVG 8.5.850 271.1.1/3299 2010-12-06 0.27 -
BitDefender 7.90123.6393895 7.35009 2010-12-11 5.90 -
ClamAV 0.96.3 12372 2010-12-10 0.04 Adware.Casino-22
Comodo 4.0 7014 2010-12-10 0.98 -
CP Secure 1.3.0.5 2010.12.10 2010-12-10 0.09 AdWare.W32.Casino.W
Dr.Web 5.0.2.3300 2010.12.11 2010-12-11 10.20 -
F-Prot 4.4.4.56 20101210 2010-12-10 1.63 W32/Casino.F.gen!Eldorado (generic, not disinfectable)
F-Secure 7.02.73807 2010.12.10.09 2010-12-10 11.52 -
Fortinet 4.2.254 12.653 2010-12-09 0.20 -
GData 21.1256/21.532 20101210 2010-12-10 9.42 -
ViRobot 20101210 2010.12.10 2010-12-10 0.38 -
Ikarus T3.1.32.15.0 2010.12.10.77327 2010-12-10 5.63 -
JiangMin 13.0.900 2010.11.30 2010-11-30 1.41 -
Kaspersky 5.5.10 2010.12.10 2010-12-10 0.15 -
KingSoft 2009.2.5.15 2010.12.10.18 2010-12-10 0.73 -
McAfee 5400.1158 6193 2010-12-10 18.23 -
Microsoft 1.6402 2010.12.10 2010-12-10 3.75 -
Norman 6.06.11 6.06.00 2010-12-07 12.01 -
Panda 9.05.01 2010.12.10 2010-12-10 2.06 -
Trend Micro 9.120-1004 7.692.13 2010-12-10 0.04 -
Quick Heal 11.00 2010.12.09 2010-12-09 1.17 -
Rising 20.0 22.77.03.08 2010-12-09 2.08 -
Sophos 3.14.1 4.60 2010-12-11 3.00 -
Sunbelt 3.9.2459.2 7584 2010-12-09 0.57 -
Symantec 1.3.0.24 20101210.002 2010-12-10 0.22 -
nProtect 20101210.01 9299033 2010-12-10 10.58 -
The Hacker 6.7.0.1 v00098 2010-12-10 40.09 -
VBA32 3.12.14.2 20101210.1339 2010-12-10 3.87 -
VirusBuster 4.5.11.10 10.130.42/2008276 2010-12-09 2.87 -
Post #25
Hi ray260,

When you killed explorer did you take note of the System Idle Process number? It's on the process tab usually listed last. It should have been up around 90-95% or higher without explorer running.

The files you submitted come back as adware not particularly malicious. If you don't need or want the program they belong to uninstall the program(s).

Let's do a bit of troubleshooting and see if we can find what is causing this.

Somethings may not function correctly or at all when we do this. It's only temporary and the effects will be reversed when we re-enable things. This procedure will stop non MS background programs and services. I'll give you the steps to re-enable everything at the end of this post so you can post your findings.

Since your antivirus program will not be running when doing this please disconnect completely from the internet, unplug the modem if necessary.

Copy and paste these instructions into a notepad so you can refer to them while offline.
  • Click Start
  • type msconfig in the Search box, and then press ENTER.
  • In the System Configuration Utility dialog box, click Selective Startup on the General tab.
  • Click to clear the Load Startup Items check box.
  • Click the Services tab.
  • Click to select the Hide All Microsoft Services check box.
  • Click Disable All, and then click OK.
  • When you are prompted, click Restart

Please follow these steps to return the computer to normal before accessing the internet.

  • Click the Start button
  • in the Start Search box, type msconfig and then press ENTER.
  • on the General tab, click Normal Startup- load all device drivers and services , and then click OK.
    When you are prompted, click Restart.

Let us know how you make out.

Thanks
Post #26
. First off, the system idle did go up to the 90% levels when explorer was disabled and it was the only explorer.exe. However when I tried to to the system configuration there were no changes that I could see. No changes at all. Nothing was disabled and the anti-virus program stayed active. Curiously I got a warning saying windows had blocked the system config program from running and when I clicked on allow it to run, it said I was in selective or diagnostic startup mode and to click normal startup to return to normal, problem is it kept doing this even after I clicked normal starup and rebooted. I have a feeling that none of the hide/disable intructions worked. I've attached a screenshot to show the system config window as it looked first time I opened it and every time I went back no matter what I clicked. Ray

Attachments:

Post #27 last edited
Hi ray260,

Sorry about that. I gave you generic instructions. Since you have unchecked items on the startup tab your computer would all ready have been in selective startup. It will also remain this way even after you have re-enabled the services.

That's ok as windows will change it to selective on it's own if even one item is unchecked. Just follow the rest of the below. I added a little more detail on restarting the services.

How far into this set of instructions did you get? Disabling the services should have stopped the non MS servics from running.

  • Click Start
  • type msconfig in the Search box, and then press ENTER.
  • In the System Configuration Utility dialog box, click Selective Startup on the General tab.
  • Click to clear the Load Startup Items check box.
  • Click the Services tab.
  • Click to select the Hide All Microsoft Services check box.
  • Click Disable All, and then click apply, click ok
  • When you are prompted, click Restart

After you have checked to see if explorer is still using 50%, re-enter System Configuration Utility.
  • Click the box next to Load Startup Items to re-enable
  • On the services tab click enable all and then click apply click ok
  • When you are prompted, click Restart
📎screenshot1.JPG
Post #28
No matter what I do on reboot I get "windows has blocked some programs from starting…." system config message and when I click allow program to run it says I am in selective mode. During the disable all, everything says stop except for the avast programs. On reboot they are all running again as if nothing was done. When I click normal startup I still get selective starup message. Can this be due to using other startup managers in the past to disable some startup items?Software explorer shows system config utility as permited in startup.
Post #29
Hi ray260,

Software explorer shows system config utility as permited in startup.

Any other programs listed in Software Explorer?

When I click normal startup I still get selective starup message. Can this be due to using other startup managers in the past to disable some startup items?

Yes you will always get that message when clicking Normal Startup because you have previously disabled items from starting up in msconfig. Things like uTorrent, Adobe and google update. There is no need to click Normal startup when following these instructions.

For avast before you disable the services in msconfig,
  • right click on the "a" icon near the click and click Settings
  • click on Troubleshooting
  • Uncheck Enable Avast Self protection module
  • click Ok
  • Accept any warnings
Post #30
Avast did get turned off following instuctions. There was no change in cpu usage when it was all turned off. On restart everything was back to normal. Is this right? Or are the processes supposed to stay off till I re-enable them. Getting same message windows is blocking system configuration from opening. This is the only one it says it is blocking.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI