This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HELP! CPU USEAGE 100% ON BOTH MY COMPUTORS

32 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software Run date: 2012-01-15 06:06:47 —————————– 06:06:47.718 OS Version: Windows 5.1.2600 Service Pack 3 06:06:47.718 Number of processors: 1 586 0x209 06:06:47.718 ComputerName: SOUTHERN-T3F8GF UserName: Administrator 06:06:49.250 Initialize success 06:10:41.765 AVAST engine defs: 12011500 06:11:12.078 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 06:11:12.078 Disk 0 Vendor: Maxtor_6Y080L0 YAR41BW0 Size: 76293MB BusType: 3 06:11:12.125 Disk 0 MBR read successfully 06:11:12.125 Disk 0 MBR scan 06:11:12.171 Disk 0 Windows XP default MBR code 06:11:12.171 Disk 0 Partition 1 00 DE Dell Utility Dell 4.1 31 MB offset 63 06:11:12.203 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 76253 MB offset 64260 06:11:12.218 Disk 0 scanning sectors +156232125 06:11:12.328 Disk 0 scanning C:\WINDOWS\system32\drivers 06:11:38.609 Service scanning 06:11:39.843 Modules scanning 06:11:53.218 Disk 0 trace - called modules: 06:11:53.265 ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS 06:11:53.796 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87380ab8] 06:11:53.796 3 CLASSPNP.SYS[f76e5fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x87351d98] 06:11:54.281 AVAST engine scan C:\WINDOWS 06:12:39.000 AVAST engine scan C:\WINDOWS\system32 06:17:41.390 AVAST engine scan C:\WINDOWS\system32\drivers 06:18:23.453 AVAST engine scan C:\Documents and Settings\Administrator 06:21:51.109 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat" 06:21:51.140 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR Scan 01 15 2012.txt"
MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x0001001d Kernel Drivers (total 131): 0x804D7000 \WINDOWS\system32\ntoskrnl.exe 0x806EF000 \WINDOWS\system32\hal.dll 0xF7BA5000 \WINDOWS\system32\KDCOM.DLL 0xF7AB5000 \WINDOWS\system32\BOOTVID.dll 0xF7656000 ACPI.sys 0xF7BA7000 \WINDOWS\System32\DRIVERS\WMILIB.SYS 0xF7645000 pci.sys 0xF76A5000 isapnp.sys 0xF7C6D000 pciide.sys 0xF7925000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS 0xF7BA9000 intelide.sys 0xF76B5000 MountMgr.sys 0xF7626000 ftdisk.sys 0xF7BAB000 dmload.sys 0xF7600000 dmio.sys 0xF792D000 PartMgr.sys 0xF76C5000 VolSnap.sys 0xF75E8000 atapi.sys 0xF76D5000 disk.sys 0xF76E5000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS 0xF75C8000 fltmgr.sys 0xF75B6000 sr.sys 0xF76F5000 PxHelp20.sys 0xF759F000 KSecDD.sys 0xF7512000 Ntfs.sys 0xF74E5000 NDIS.sys 0xF74CB000 Mup.sys 0xF7765000 \SystemRoot\System32\DRIVERS\intelppm.sys 0xF6B83000 \SystemRoot\System32\DRIVERS\ialmnt5.sys 0xF6B6F000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS 0xF7A4D000 \SystemRoot\System32\DRIVERS\usbuhci.sys 0xF6B4B000 \SystemRoot\System32\DRIVERS\USBPORT.SYS 0xF7A55000 \SystemRoot\System32\DRIVERS\usbehci.sys 0xF7775000 \SystemRoot\System32\DRIVERS\bcm4sbxp.sys 0xF7A5D000 \SystemRoot\System32\DRIVERS\fdc.sys 0xF7785000 \SystemRoot\System32\DRIVERS\i8042prt.sys 0xF7A65000 \SystemRoot\System32\DRIVERS\kbdclass.sys 0xF7795000 \SystemRoot\System32\DRIVERS\serial.sys 0xF7B99000 \SystemRoot\System32\DRIVERS\serenum.sys 0xF6B37000 \SystemRoot\System32\DRIVERS\parport.sys 0xF77A5000 \SystemRoot\System32\DRIVERS\cdrom.sys 0xF77B5000 \SystemRoot\System32\DRIVERS\redbook.sys 0xF6B14000 \SystemRoot\System32\DRIVERS\ks.sys 0xF7A6D000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0xF77C5000 \SystemRoot\system32\drivers\InCDPass.sys 0xF77D5000 \SystemRoot\system32\drivers\InCDRm.sys 0xF77E5000 \SystemRoot\System32\DRIVERS\imapi.sys 0xF6AD4000 \SystemRoot\system32\drivers\smwdm.sys 0xF6AB0000 \SystemRoot\system32\drivers\portcls.sys 0xF77F5000 \SystemRoot\system32\drivers\drmk.sys 0xF69FD000 \SystemRoot\system32\drivers\senfilt.sys 0xF7DF3000 \SystemRoot\System32\DRIVERS\audstub.sys 0xF7805000 \SystemRoot\System32\DRIVERS\rasl2tp.sys 0xF748E000 \SystemRoot\System32\DRIVERS\ndistapi.sys 0xF69E6000 \SystemRoot\System32\DRIVERS\ndiswan.sys 0xF7815000 \SystemRoot\System32\DRIVERS\raspppoe.sys 0xF7825000 \SystemRoot\System32\DRIVERS\raspptp.sys 0xF7A75000 \SystemRoot\System32\DRIVERS\TDI.SYS 0xF69D5000 \SystemRoot\System32\DRIVERS\psched.sys 0xF7835000 \SystemRoot\System32\DRIVERS\msgpc.sys 0xF7A7D000 \SystemRoot\System32\DRIVERS\ptilink.sys 0xF7A85000 \SystemRoot\System32\DRIVERS\raspti.sys 0xF697D000 \SystemRoot\System32\DRIVERS\rdpdr.sys 0xF7845000 \SystemRoot\System32\DRIVERS\termdd.sys 0xF7A8D000 \SystemRoot\System32\DRIVERS\mouclass.sys 0xF7BE7000 \SystemRoot\System32\DRIVERS\swenum.sys 0xF691F000 \SystemRoot\System32\DRIVERS\update.sys 0xF7472000 \SystemRoot\System32\DRIVERS\mssmbios.sys 0xF78E5000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF7905000 \SystemRoot\System32\DRIVERS\usbhub.sys 0xF7BFD000 \SystemRoot\System32\DRIVERS\USBD.SYS 0xF794D000 \SystemRoot\System32\DRIVERS\flpydisk.sys 0xF7C07000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7CD1000 \SystemRoot\System32\Drivers\Null.SYS 0xF7C09000 \SystemRoot\System32\Drivers\Beep.SYS 0xEE6A3000 \SystemRoot\system32\DRIVERS\ehdrv.sys 0xF795D000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xF7965000 \SystemRoot\System32\drivers\vga.sys 0xF7C0B000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF7C0D000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF7B79000 \SystemRoot\system32\drivers\InCDRec.sys 0xEE664000 \SystemRoot\system32\drivers\InCDFs.sys 0xF796D000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF7975000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF7B7D000 \SystemRoot\System32\DRIVERS\rasacd.sys 0xEE651000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xEE5F8000 \SystemRoot\System32\DRIVERS\tcpip.sys 0xEE5D0000 \SystemRoot\System32\DRIVERS\netbt.sys 0xEE5B6000 \SystemRoot\system32\DRIVERS\epfwtdir.sys 0xF7B81000 \SystemRoot\System32\drivers\ws2ifsl.sys 0xEE594000 \SystemRoot\System32\drivers\afd.sys 0xF7715000 \SystemRoot\System32\DRIVERS\netbios.sys 0xEE569000 \SystemRoot\System32\DRIVERS\rdbss.sys 0xF7B91000 \SystemRoot\SYSTEM32\DRIVERS\OMCI.SYS 0xEE4D1000 \SystemRoot\System32\DRIVERS\mrxsmb.sys 0xF6CB9000 \SystemRoot\System32\Drivers\Fips.SYS 0xEE4AB000 \SystemRoot\System32\DRIVERS\ipnat.sys 0xF69BD000 \SystemRoot\System32\DRIVERS\hidusb.sys 0xF6C99000 \SystemRoot\System32\DRIVERS\HIDCLASS.SYS 0xF69B9000 \SystemRoot\System32\DRIVERS\mouhid.sys 0xF6C89000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xEE493000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xF7C11000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xF6767000 \SystemRoot\System32\drivers\Dxapi.sys 0xF797D000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xF7D70000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF020000 \SystemRoot\System32\ialmdnt5.dll 0xBF012000 \SystemRoot\System32\ialmrnt5.dll 0xBF03F000 \SystemRoot\System32\ialmdev5.DLL 0xBF06B000 \SystemRoot\System32\ialmdd5.DLL 0xF7745000 \SystemRoot\System32\DRIVERS\wanarp.sys 0xBF148000 \SystemRoot\System32\ATMFD.DLL 0xEE288000 \SystemRoot\system32\DRIVERS\eamon.sys 0xEE39F000 \SystemRoot\system32\DRIVERS\Sftvolxp.sys 0xEE443000 \SystemRoot\System32\DRIVERS\ndisuio.sys 0xEDF03000 \SystemRoot\system32\drivers\wdmaud.sys 0xEE090000 \SystemRoot\system32\drivers\sysaudio.sys 0xEDCF0000 \SystemRoot\System32\DRIVERS\mrxdav.sys 0xF7BF1000 \SystemRoot\System32\Drivers\ParVdm.SYS 0xEDBA8000 \SystemRoot\System32\DRIVERS\srv.sys 0xEDA32000 \SystemRoot\system32\DRIVERS\Sftfsxp.sys 0xED937000 \SystemRoot\system32\DRIVERS\Sftplayxp.sys 0xED66B000 \SystemRoot\system32\DRIVERS\Sftredirxp.sys 0xF79FD000 \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys 0xF7C65000 \??\C:\WINDOWS\system32\Drivers\PROCEXP113.SYS 0xED32E000 \SystemRoot\System32\Drivers\HTTP.sys 0xED0F3000 \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\aswMBR.sys 0xECEC5000 \SystemRoot\system32\drivers\kmixer.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 61): 0 System Idle Process 4 System 412 C:\WINDOWS\system32\smss.exe 568 csrss.exe 604 C:\WINDOWS\system32\winlogon.exe 716 C:\WINDOWS\system32\services.exe 728 C:\WINDOWS\system32\lsass.exe 888 C:\WINDOWS\system32\svchost.exe 964 svchost.exe 1056 C:\WINDOWS\system32\svchost.exe 1176 svchost.exe 1496 svchost.exe 1656 C:\WINDOWS\system32\LEXBCES.EXE 1676 C:\WINDOWS\system32\brss01a.exe 1696 C:\WINDOWS\system32\spoolsv.exe 640 svchost.exe 680 C:\WINDOWS\system32\svchost.exe 692 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 1012 C:\Program Files\Bonjour\mDNSResponder.exe 1052 C:\WINDOWS\system32\Brmfrmps.exe 1132 C:\WINDOWS\system32\CTSVCCDA.EXE 1216 C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe 1312 C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe 1272 C:\Program Files\Java\jre6\bin\jqs.exe 1456 C:\MSSQL7\Binn\sqlservr.exe 1884 C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe 2008 C:\Program Files\Pervasive Software\PSQL\bin\w3dbsmgr.exe 504 C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe 912 C:\WINDOWS\system32\svchost.exe 2012 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe 2088 C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe 3064 C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE 3660 alg.exe 3252 C:\WINDOWS\system32\wscntfy.exe 3872 C:\WINDOWS\explorer.exe 248 C:\WINDOWS\system32\hkcmd.exe 3296 C:\Program Files\Common Files\Java\Java Update\jusched.exe 2480 C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe 1112 C:\Program Files\Nero\Nero8\InCD\NBHGui.exe 3260 C:\Program Files\Nero\Nero8\InCD\InCD.exe 3948 C:\Program Files\Analog Devices\Core\smax4pnp.exe 2280 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2712 C:\Program Files\iTunes\iTunesHelper.exe 3860 C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe 1044 C:\WINDOWS\system32\LEXPPS.EXE 2412 C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe 1420 C:\PROGRA~1\MICROS~2\wcescomm.exe 1348 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe 3128 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe 2096 C:\Documents and Settings\Administrator\Local Settings\Application Data\Akamai\netsession_win.exe 2040 C:\WINDOWS\system32\ctfmon.exe 3904 C:\PROGRA~1\MICROS~2\rapimgr.exe 1836 C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe 3328 C:\MSSQL7\Binn\sqlmangr.exe 3632 C:\Documents and Settings\Administrator\Local Settings\Application Data\Akamai\netsession_win.exe 3012 C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe 3200 C:\Program Files\iPod\bin\iPodService.exe 688 C:\Program Files\Internet Explorer\iexplore.exe 3708 C:\Program Files\Internet Explorer\iexplore.exe 3364 1740 C:\Documents and Settings\Administrator\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`01f60800 (NTFS) \\.\Q: –> error 5 PhysicalDrive0 Model Number: Maxtor6Y080L0, Rev: YAR41BW0 Size Device Name MBR Status ——————————————– 74 GB \\.\PhysicalDrive0 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A Done!
Good morning' Things seem to be running smooth. When & if all done I guess I need to get some type of protections to prevent this in future. I'm a complete idiot when it comes to this stuff. U r absolutely amazing!
Do u l know by all these things(logs etc) if any of my programs, files got corrupted or ruined? Also in regard to proections can you tell me what all protection programs for malware, virus, & what ever else I should need & where to get them. And do u think it is safe to use my wifi now? I wouldn't let my household members connect to it. In regard to my laptop to get all those viruses etc off it, can I just follow everything on this we did safely and do it through wifi because that's how I log on with laptop?
Hi,

You have ESET Antivirus installed, its a good program, keep it updated and run regular scans.

We used Malwarebytes, this is another good program, if you upgrade to the Pro Version it has a Protection Moduale that will block access to most known bad sites, the cost is minimal but this of course is up to you.


This is what I would like you to do, you should try to reset your router again, push in that little pin on the rear of the unit with a pen or a paper clip, hold it in for at least 10 seconds, then use the CD that came with it to set up your wireless access again, the reason for this is that when you first posted you said both your desktop and laptop where experiencing the same thing which leads be to believe the router could be infected.



As far as this computer, lets get rid of the programs we used. Any programs still on your desktop after you run this clean up you can just drag to the trash.






Open OTL and click on Clean Up and it will remove programs we used to clean your system along with there backups, any programs that where not removed you can just drag to the trash.


Malwarebytes is the free version and yours to keep and will not be removed


  • How did I get infected in the first place ?
    Read these links and find out how to prevent getting infected again.
  • Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
  • WhattheTech
  • Grinler BleepingComputer
  • GeeksTo Go
  • Dslreports



So, do this, run the above clean ups, reset your router, run the CD in reinstall your wireless access and then go to the other infected computer we have not worked on and run DDS on it and post the log please
I've tried to reset router & nothing happens. I've held it in even way over 10 secones. It is a pretty old router. Like maybe 5 or 6 yrs. but it's always worked fine! Any thoughts as to what now?
Let let it be for the moment, lets close this thread and start a New Topic for the infected computer, I will keep an eye open for it but if I miss it one of our other capable staff will pick it up.

Post these logs in your new post, be sure to title it My Other Computer



Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]





Download DDS from one of the links below to your desktop

Link 1
Link 2

  • Double click the tool to run it.
  • A black Screen will open, just read the contents and do nothing.
  • When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
  • Copy/Paste the contents of 'DDS.txt' into your post.
  • 'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI