What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

CPU being hogged

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
from: aBadMojo

I cleared out all Spyware & Adware. cpu is still maxing out at 100% at the slightest use and is very slow.Here is my hiJack this log. Any help will be welcomed. Thanks in advance.

Logfile of HijackThis v1.99.1
Scan saved at 12:11:55 PM, on 10/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
D:\WINDOWS\Mixer.exe
D:\PROGRA~1\mcafee.com\agent\mcagent.exe
d:\progra~1\mcafee.com\vso\mcvsescn.exe
D:\Program Files\Media Pass\MediaPassK.exe
D:\Program Files\Messenger\msmsgs.exe
D:\PROGRA~1\AIM\aim.exe
D:\Program Files\Media Pass\MediaPass.exe
D:\Program Files\Common Files\AOL\1128991434\ee\AOLHostManager.exe
D:\Program Files\Common Files\AOL\1128991434\ee\AOLServiceHost.exe
D:\WINDOWS\system32\gearsec.exe
D:\WINDOWS\system32\gearsec.exe
d:\progra~1\mcafee.com\vso\mcvsftsn.exe
d:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
d:\PROGRA~1\mcafee.com\vso\mcshield.exe
D:\Program Files\Common Files\AOL\1128991434\ee\AOLServiceHost.exe
D:\WINDOWS\System32\wuauclt.exe
D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTW05.EXE
D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTW05.EXE
D:\WINDOWS\explorer.exe
D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTC05.EXE
D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZSTW05.EXE
D:\Documents and Settings\Ken Font\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - D:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - D:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - D:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [VSOCheckTask] "d:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "d:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] d:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [Media Pass] D:\Program Files\Media Pass\MediaPassK.exe
O4 - HKLM\..\Run: [HostManager] D:\Program Files\Common Files\AOL\1128991434\ee\AOLHostManager.exe
O4 - HKLM\..\Run: [CleanUp] D:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] D:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: MA111 Configuration Utility.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - d:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://d:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://d:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://d:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://d:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - D:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: GEARSecurity - GEAR Software - D:\WINDOWS\system32\gearsec.exe
O23 - Service: GEARSecurity_BackUp - GEAR Software - D:\WINDOWS\system32\gearsec.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - d:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - D:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
Post #2
Hi Ken, Welcome to TomCoyote forum. If you still need help and are not receiving it elsewhere, please do this in the posted order:

You have some nasty adware on board and I wish to make sure nothing is hiding as we remove it.

1) Download CCleaner from this link: http://www.ccleaner.com/ Review the instructions http://www.ccleaner.com/help/tour1.asp and please do not run it until I ask you to.

2) Download, update, configure and run these two programs: http://tomcoyote.org/aawsb.php
The newest version of Ad-aware is 1.06 and Spybot 1.04. Even if you have these programs, use the link to get the newest version, update and configure them as in the link. Run Spybot first, reboot then run Ad-aware. Both programs back up what they remove so delete anything the programs say should be removed.

3) Ewido scan:
Please download Ewido Security Suite it is a trial version of the program.
  • Install ewido security suite
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will now go to the main screen
You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Then click on Start Update
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates

Once the updates are installed do the following:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • NOTE: During some scans with ewido it is finding cases of false positives.**
    • You will need to step through the process of cleaning files one-by-one.
    • If ewido detects a file you KNOW to be legitimate, select none as the action.
    • DO NOT select "Perform action on all infections"
    • If you are unsure of any entry found select none for now.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop.
Now close ewido security suite.
**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")

4) Look in Add Remove programs in the Control panel for:
D:\Program Files\Media Pass\MediaPassK.exe
D:\Program Files\Media Pass\MediaPass.exe
Uninstall the if there, if not open Task Manager then the Processes tab and end process on both.

5) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O4 - HKLM\..\Run: [Media Pass] D:\Program Files\Media Pass\MediaPassK.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: MA111 Configuration Utility.lnk = ?
(last one, if you do not know why it is there remove it)

Close all programs but HJT and all browser windows, then click on "Fix Checked"

Enable hidden files and folders:
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

RIGHT Click on Start then click on Explore. Locate and delete this item:

D:\Program Files\Media Pass\ >>> folder

6) Run CCleaner, Windows & Applications when you run the registry cleaner (Issues) you will be prompted to backup before you can remove stuff, make sure you do. Then restart the computer and post a new HJT log and the Ewido scan results in this same thread along with any feedback you have. Let me know how you are running now.

Thanks…pskelley
TomCoyote forum
Slyware Warrior
Post #3
pskelley, thanks for all the help. Unfortunately my cpu is still maxing out at the slightest use.

Here's the hjt log. I couldn't find the ewido log.

Logfile of HijackThis v1.99.1
Scan saved at 8:44:49 PM, on 10/20/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
D:\WINDOWS\Mixer.exe
D:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
D:\PROGRA~1\mcafee.com\agent\mcagent.exe
d:\progra~1\mcafee.com\vso\mcvsescn.exe
D:\Program Files\Messenger\msmsgs.exe
D:\PROGRA~1\AIM\aim.exe
D:\Program Files\Common Files\AOL\1128991434\ee\AOLHostManager.exe
D:\Program Files\Common Files\AOL\1128991434\ee\AOLServiceHost.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\ewido\security suite\ewidoguard.exe
D:\WINDOWS\system32\gearsec.exe
D:\WINDOWS\system32\gearsec.exe
d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
d:\PROGRA~1\mcafee.com\vso\mcshield.exe
d:\progra~1\mcafee.com\vso\mcvsftsn.exe
D:\Program Files\Common Files\AOL\1128991434\ee\AOLServiceHost.exe
D:\Documents and Settings\Ken Font\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - D:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - D:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - D:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [VSOCheckTask] "d:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "d:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] d:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [HostManager] D:\Program Files\Common Files\AOL\1128991434\ee\AOLHostManager.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] D:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O8 - Extra context menu item: &AOL Toolbar Search - d:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://d:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://d:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://d:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://d:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - D:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: GEARSecurity - GEAR Software - D:\WINDOWS\system32\gearsec.exe
O23 - Service: GEARSecurity_BackUp - GEAR Software - D:\WINDOWS\system32\gearsec.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - d:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - D:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
Post #4
Hello Ken (it is Ken, right?) Let me just say I have volunteered to help and I'll do my best, but I am going to need your cooperation if we are going to be successful. The ewido scan report is necessary in my first evaluation of your system, so you have given my 1/2 of the information I need. Let me try to get that report first. Open the ewido folder and if you allowed ewido to place it in the default location it will be in C:\Program Files. Open that folder then open the folder "ewido" next open security suite then the "Reports" folder. There should only be one Scan report in there. Open that Text document and copy/paste it to your next reply the same as you do the notepad for the HJT log. Thanks.

I want your help looking around a little to see what we can find out. First do this:
Open Hijackthis.
Click the "Open the Misc Tools" section Button.
Click the "Open Uninstall Manager" Button.
Click the "Save list…" Button.
Save it to your desktop. Copy and paste the contents into your reply.

Next, when you are getting this large CPU usage, open your Task Manager (right click the taskbar at the bottom and choose Task Manager) then make me a list of what is running. Then click on Processes tab and look to see what program is using all of the "Mem Usage". Next click on Performance to see what your useage is. You should be able to spot the troublemaker.

I want to ask about a few items now:

1) Is AOL your Internet Connection Service provider?

2) Even if it is do you use this Toolbar?
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - D:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - D:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O8 - Extra context menu item: &AOL Toolbar Search - d:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - D:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
You do have the Google Toolbar installed also.

3) This item, and I am not familiar with it:
O23 - Service: GEARSecurity - GEAR Software - D:\WINDOWS\system32\gearsec.exe
O23 - Service: GEARSecurity_BackUp - GEAR Software - D:\WINDOWS\system32\gearsec.exe

I find this about it: http://www.liutilities.com/products/wintas…ibrary/gearsec/
http://www.bleepingcomputer.com/startups/g…c.exe-1819.html
http://www.answersthatwork.com/Tasklist_pages/tasklist_g.htm

If you do not use the service, you can disable it, then enable it again if you ever need it. Now I want you to read through the thread in this link:
http://dvdxcopy.afterdawn.com/thread_view.cfm/21233

I especially want you to see what Turak said on 1 Feb 2003 8:31 AM with emphasis on this: If you see two entries, probably one titled 'GEARSecurity' and the other titled 'GEARSecurity_backup', then you have the problem. As I said, I have no knowledge about this product. You may want to consult the technical support before you proceed, and watch for this item when you are looking for CPU usage.
See this information: http://is-it-true.org/nt/utips/utips76.shtml

Last, we will remove a few line with HJT,
Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:


4) Close all programs but HJT and all browser windows, then click on "Fix Checked"

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab

Close all programs but HJT and all browser windows, then click on "Fix Checked"

5) Complete the above instructions then post the requested ewido scan report, a new HJT log, and the information I requested above.

Thanks…pskelley
Post #5
Hi pskelley, Yes I'm Ken. Thank You for your patients. Now let me see if I can do this!! ——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 8:14:40 PM, 10/20/2005 + Report-Checksum: 7B886A40 + Scan result: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\D:/WINDOWS/Downloaded Program Files/MediaPassX.dll\\.Owner -> Spyware.WinFavorites : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\D:/WINDOWS/Downloaded Program Files/MediaPassX.dll\\{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -> Spyware.WinFavorites : Cleaned with backup D:\Documents and Settings\Ken Font\Cookies\ken font@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup ::Report End Ad-Aware SE Personal Adobe Download Manager 1.2 (Remove Only) Adobe Photoshop Album 2.0 Starter Edition Adobe Reader 6.0.1 Ahead NeroVision Express AOL Explorer AOL Instant Messenger AOL Toolbar 2.0 ATI Display Driver CCleaner (remove only) DAO Direct Show Ogg Vorbis Filter (remove only) DivX 4.12 Codec DivX 5.0.3 Pro Bundle DVD Decrypter (Remove Only) DVD Shrink 3.2 EVEREST Home Edition v2.00 ewido security suite ffdshow (remove only) Google Toolbar for Internet Explorer HijackThis 1.99.1 hp deskjet 5550 series hp deskjet 5550 series (Remove only) hp instant support hp print screen utility Intel Application Accelerator MSN Music Assistant Nero - Burning Rom NewsBin Pro 4.22 PCI Audio Driver QuickPar 0.9 QuickTime Realtek AC'97 Audio Realtek RTL8139/810x Fast Ethernet NIC Driver Setup Registry Mechanic Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB901214) SmartPar Spybot - Search & Destroy 1.4 Update for Windows XP (KB898461) VideoLAN VLC media player 0.8.2 Viewpoint Media Player Windows Genuine Advantage v1.3.0254.0 Windows Installer 3.1 (KB893803) Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB828741 Windows XP Hotfix - KB833987 Windows XP Hotfix - KB834707 Windows XP Hotfix - KB835732 Windows XP Hotfix - KB840987 Windows XP Hotfix - KB841356 Windows XP Hotfix - KB841533 Windows XP Hotfix - KB842773 Windows XP Hotfix - KB871250 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB873376 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB889293 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891711 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893086 Windows XP Hotfix - KB896727 WinRAR archiver XviD Video Codec 24.2.2003-11:00 (uManiac's build) Applications Running: TomCoyote Forums MSN Hotmail hijackthis-Notepad uninstall_list-Notepad If I unpack movie files from Newsbin while watching a movie, the movie will freeze up & all of the cpu is taken by the decompressing & joining of the rar files. cpu spikes at usage of a folder or program. AOLServiceHost.exe 17,932k explorer.exe 23,624k msn6.exe 26,304k svchost,exe 20,100k ewidoguard.exe 20,144k I have 36 processes on the ask manager. I'm really not sure what I'm looking at. Next 1) Is AOL your Internet Connection Service provider? No. 2) Even if it is do you use this Toolbar? No. You do have the Google Toolbar installed also. Yes Next: I read all info & removed 'GEARSecurity_backup' from the registry. Now I'm going to remove items with hjt. I'm closing everything except this. I'll send another post with the scans that you request. Thanks, Ken.
Post #6
Hi pskelley, Here are the requested scans: ——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 12:09:14 PM, 10/21/2005 + Report-Checksum: 75A8B356 + Scan result: C:\WINDOWS\system32\Seagate.bin -> Heuristic.Win32.AVKiller : Cleaned with backup D:\Documents and Settings\Ken Font\Cookies\ken font@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup ::Report End Ad-Aware SE Personal Adobe Download Manager 1.2 (Remove Only) Adobe Photoshop Album 2.0 Starter Edition Adobe Reader 6.0.1 Ahead NeroVision Express AOL Explorer AOL Instant Messenger AOL Toolbar 2.0 ATI Display Driver CCleaner (remove only) DAO Direct Show Ogg Vorbis Filter (remove only) DivX 4.12 Codec DivX 5.0.3 Pro Bundle DVD Decrypter (Remove Only) DVD Shrink 3.2 EVEREST Home Edition v2.00 ewido security suite ffdshow (remove only) Google Toolbar for Internet Explorer HijackThis 1.99.1 hp deskjet 5550 series hp deskjet 5550 series (Remove only) hp instant support hp print screen utility Intel Application Accelerator MSN Music Assistant Nero - Burning Rom NewsBin Pro 4.22 PCI Audio Driver QuickPar 0.9 QuickTime Realtek AC'97 Audio Realtek RTL8139/810x Fast Ethernet NIC Driver Setup Registry Mechanic Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899588) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB901214) SmartPar Spybot - Search & Destroy 1.4 Update for Windows XP (KB898461) VideoLAN VLC media player 0.8.2 Viewpoint Media Player Windows Genuine Advantage v1.3.0254.0 Windows Installer 3.1 (KB893803) Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB828741 Windows XP Hotfix - KB833987 Windows XP Hotfix - KB834707 Windows XP Hotfix - KB835732 Windows XP Hotfix - KB840987 Windows XP Hotfix - KB841356 Windows XP Hotfix - KB841533 Windows XP Hotfix - KB842773 Windows XP Hotfix - KB871250 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB873376 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB889293 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891711 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893086 Windows XP Hotfix - KB896727 WinRAR archiver XviD Video Codec 24.2.2003-11:00 (uManiac's build) I have a 2.6 gh cpu. it was running at 90%-100% during ewido scan which took 1 hour. Thanks pskelley, Ihope this is the correct info. Thanks Ken.
Post #7
OK Ken, Ewido seems to have done all it can for us. Since it is a trial and the real time protection
that is requiring the resources will go away after two weeks. You may keep it and update it as long as you wish free from that point on or you may remove it from your computer. This is your call.

You sent me two uninstall lists, and no HJT log, please post a new HJT log.

I would like to remove all of the items aol was using as your ISP if you have no objections, here are what they are and I can't proceed with this until I see the new HJT log.
D:\Program Files\Common Files\AOL\1128991434\ee\AOLHostManager.exe
D:\Program Files\Common Files\AOL\1128991434\ee\AOLServiceHost.exe
D:\Program Files\Common Files\AOL\1128991434\ee\AOLServiceHost.exe
Unless you know of some reason for keeping these aol programs?

Please see this list:
AOLServiceHost.exe 17,932k <<< something you are not using??
explorer.exe 23,624k <<< understandable but you would probably not need IE and MSN 6.0 open at the same time, especially if you are trying to do this:
msn6.exe 26,304k

If I unpack movie files from Newsbin while watching a movie, the movie will freeze up & all of the cpu is taken by the decompressing & joining of the rar files.
cpu spikes at usage of a folder or program.

svchost,exe 20,100k <<< seems very high, I am using 660k and running IE/MSN9.10 may be you have a lot of running program that are not needed. I'll look in the next log. Your running processes that you are asking about are in your HJT log. You can see what you are running after this: Running processes
Use this tool: http://netsquirrel.com/msconfig/ to turn off programs you know you do not need everytime you bootup. Careful not to turn off any windows programs or security programs. Once you do this, I will be able to see what is running in the log to advise you further.

ewidoguard.exe 20,144k << this will slow you down a little, but that will go away, either when you uninstall the program, disable the service, or the trial runs out. The scanner when not running uses no resources.

While you have the uninstall list, you should look for programs you no long use and uninstall them. If you see programs you do not know, you should investigate until you do then decide if you should keep them or get rid of them.

Last, because it is becoming clear to me that the issues we have are not malware related, I would like to suggest you post here: http://forums.tomcoyote.org/index.php?showforum=83
where there are experts dealing with general computing issues who should be able to help you more with the issues you are describing. Post a link to this thread so they can see what we are trying here. Let me see that new HJT log, I will try to clean up anything I can see that may help.

Thanks…Phil
Post #8
Hi Phil. Here is the hjt log.

Logfile of HijackThis v1.99.1
Scan saved at 5:10:26 PM, on 10/21/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
D:\WINDOWS\Mixer.exe
D:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
D:\PROGRA~1\mcafee.com\agent\mcagent.exe
D:\Program Files\Messenger\msmsgs.exe
D:\PROGRA~1\AIM\aim.exe
d:\progra~1\mcafee.com\vso\mcvsescn.exe
D:\Program Files\Common Files\AOL\1128991434\ee\AOLServiceHost.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\ewido\security suite\ewidoguard.exe
D:\WINDOWS\system32\gearsec.exe
D:\WINDOWS\system32\gearsec.exe
d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
d:\progra~1\mcafee.com\vso\mcvsftsn.exe
d:\PROGRA~1\mcafee.com\vso\mcshield.exe
D:\Program Files\Common Files\AOL\1128991434\ee\AOLServiceHost.exe
D:\Program Files\MSN\MSNCoreFiles\MSN6.EXE
D:\Documents and Settings\Ken Font\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [VSOCheckTask] "d:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "d:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] d:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\System32\\NeroCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] D:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://d:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://d:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://d:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://d:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: GEARSecurity - GEAR Software - D:\WINDOWS\system32\gearsec.exe
O23 - Service: GEARSecurity_BackUp - GEAR Software - D:\WINDOWS\system32\gearsec.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - d:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - D:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

Thanks again Phil
Post #9 last edited
HI Phil, I have no idea how to move this thread to "other computer problems" PLease help me with this? Thanks, Ken
Post #10
OK Ken, since you saw your resources going up in smoke, used by aol I will show you the aol line I wish to remove so you can look at the information, then I'll give you instructions for doing this.

D:\Program Files\Common Files\AOL\1128991434\ee\AOLServiceHost.exe (aol even had it running twice)
D:\Program Files\Common Files\AOL\1128991434\ee\AOLServiceHost.exe
see this link >>> http://www.processlibrary.com/directory/fi…AOLServiceHost/

We will not need HJT for this, open your Task Manager then the Processes tab. Locate and end process on any instance of this that is running:
D:\Program Files\Common Files\AOL\1128991434\ee\AOLServiceHost.exe

now that you have stopped them it from running, RIGHT Click on Start then click on Explore. Locate and delete these items:

D:\Program Files\Common Files\AOL\1128991434\ee\AOLServiceHost.exe <<< file only
I would like to delete the AOL folder but something else may be running you need from it, like AIM?

You can use MSConfig: http://netsquirrel.com/msconfig/ to save some resources here, the 04 is the item that is running everytime you start your computer and the link under will tell you what you can do about it.

O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
http://castlecops.com/startuplist-489.html

O4 - HKCU\..\Run: [AIM] D:\PROGRA~1\AIM\aim.exe -cnetwait.odl
http://castlecops.com/startuplist-165.html

O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
http://castlecops.com/startuplist-2280.html

This item: O23 - Service: GEARSecurity_BackUp - GEAR Software - D:\WINDOWS\system32\gearsec.exe is still running in your log. You can disable it like this:

Disable the offending Service
Click Start < Run and type services.msc.
Scroll down to GEARSecurity_BackUp and right click on it.
Click Properties and under Service Status click Stop, then under Startup Type change it to Disabled.

I have instructions for deleting the item with HJT if you are ever sure it can be deleted. Just let me know.

I will draw a line now and below the line will be instructions for posting in Other Computer Problems.
________________________________________________________________

1) Click on this link: http://forums.tomcoyote.org/index.php?showforum=83
to get to the forum, then start a "New Topic". Give the topic a name and brief description like you did with the HJT topic.

2) In the box give those folks as much information as you can about your problem, then mention that your log has been cleaned in the HJT forum. Then post this link by highliting it and right clicking on it and choose copy, then point to a blank spot in your new box and right click on it and choose paste. That will put the link there in case those folks want to look at the contents of this thread. Here is that link:
http://forums.tomcoyote.org/index.php?showtopic=48645

Then at the bottom the that page click on Post New Topic. You are done, just wait for a post to your new thread. You may also still be communicating with me also? I hope this helps…Phil
Post #11 last edited
Thanks Phil for all the help. you've been great! I'm going to the other forum for futher info.Thank You very much for all your time & trouble. Ken.
Post #12
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI