What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Firefox slugglish, CPU usage pushing 100 percent too often

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'm running XP SP2, P4 2 Ghz processor, and have 1 gigabite of RAM and equally sized virtual memory.
I regularly run a registry cleaning and repair tool called Registry Medic. I run Kerio for a firewall, AVG for an antivirus, use Microsoft Anti-Spyware, and scan regularly with Ad-Aware, Spy-Bot Search and Destroy, Spyware Blaster, A2, and Ewido. Those that have active scanning in the backround available I have shut off, except for Microsoft Anti spyware and Win Patrol, just can't have half a dozen different things running in the backround all ostensibly trying to do the same thing.

Just completed scans with all of the above, and caught another 20 items or so. All of my programs are set up per this forum's suggested parameters. This just leaves another 10 items or so that Spyware Doctor says I still have on my computer, and a few dubious running processes in Task manager that I am suspicious of. Spyware Doctor of course won't remove those nasties unless you pay the price, maintaining the precedent of the medical profession, I suppose, so being destitute I turn to the Mother Teresas of the Computer World here at TCF.

I also have over 50 running processes and lord knows how many modules loaded, what ever they are, and this can't be helping things any. I can find any number of places that will tell me whats necessary and what's not, and what's malicious- for fifty bucks, but nary a soul from the kindness of their hearts.

One last odd glitch, occasionally as I'm clicking my mouse on something, the curssor will jump to some far corner of the screen while simultaniously the Start Box opens up. Weird, and any suggestions appreciated. Oh yeah, and one last thing. I noticed that the infamous KonTiki is still hiding in my Programs folder, does anyone know how to remove this and all it's bits and pieces safely and securely? Thanks!

Here's my HJT logfile:




Logfile of HijackThis v1.99.1
Scan saved at 5:08:06 PM, on 10/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\ups.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe
C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\OpenOffice.org1.1.1\program\soffice.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\Donald Schneider\My Documents\My Downloads\hijackthis1\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost
O2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: OpenOffice.org 1.1.1.lnk = C:\Program Files\OpenOffice.org1.1.1\program\quickstart.exe
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Download all by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Toolbar &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0B72CCA4-5F11-11D0-9CB5-0000C0EC9FDB} (Street Technologies ActiveX Control Object) - http://www.netgear.com/education/mentor/static/streetno.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.gocyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/29eae2c98a9146…ip/RdxIE601.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {7CF052DE-C74F-421B-B04A-3B3037EF5887} (CCMPGui Class) - http://64.124.45.181/chaincast/proxy/CCMP.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B} (WebResponseAttachments Control) - https://webresponse.one.microsoft.com/oas/A…eX/FileXfer.cab
O16 - DPF: {AB294EC6-7ADA-11D4-9D5F-00B0D04BBD07} (msichat50 Client Control) - http://www.talkaboutsleep.com:4080/chat/msichat.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup144.cab
O16 - DPF: {F5820AD3-9B20-423E-B2AA-7AF2B4055746} (CRegistryDownload Class) - http://download.paltalk.com/download/0.x/regdload.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE
Post #2
As an addendum, I have also done a regisrty cleaning an repair. deleted my restore points, rebooted and did another scan with Spyware Doctor. I got a result of 31 items of various spy-mal-adware, several of wich it considers serious. Here is a log of those results: Scan Results: scan start: 10/23/2005 4:22:37 PM scan stop: 10/23/2005 4:38:11 PM scanned items: 110795 found items: 31 found and ignored: 0 tools used: General Scanner, Process Scanner, Hosts scanner, LSP Scanner, Registry Scanner, Browser Defaults, Favorites and ZoneMap Scanner, ActiveX Scanner, Browser Activity Scanner, Disk Scanner Infection Name Location Risk AdDestroyer HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\AdDestroyer Medium AdDestroyer HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\AdDestroyer## Medium Virtual Bouncer HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Virtual Bouncer High Virtual Bouncer HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Virtual Bouncer## High Overpro.com HKCR\CLSID\{19185FCC-75B5-11D5-89D3-000086120FE4} High Overpro.com HKCR\CLSID\{19185FCC-75B5-11D5-89D3-000086120FE4}\InprocServer32 High Overpro.com HKCR\CLSID\{19185FCC-75B5-11D5-89D3-000086120FE4}\ProgID High Overpro.com HKCR\CLSID\{19185FCC-75B5-11D5-89D3-000086120FE4}\TypeLib High Overpro.com HKCR\CLSID\{19185FCC-75B5-11D5-89D3-000086120FE4}\VERSION High Overpro.com HKLM\Software\Classes\CLSID\{19185FCC-75B5-11D5-89D3-000086120FE4} High Overpro.com HKLM\Software\Classes\CLSID\{19185FCC-75B5-11D5-89D3-000086120FE4}\InprocServer32 High Overpro.com HKLM\Software\Classes\CLSID\{19185FCC-75B5-11D5-89D3-000086120FE4}\ProgID High Overpro.com HKLM\Software\Classes\CLSID\{19185FCC-75B5-11D5-89D3-000086120FE4}\TypeLib High Overpro.com HKLM\Software\Classes\CLSID\{19185FCC-75B5-11D5-89D3-000086120FE4}\VERSION High Overpro.com HKCR\CLSID\{1CCED66A-75B5-11D5-89D3-000086120FE4} High Overpro.com HKCR\CLSID\{1CCED66A-75B5-11D5-89D3-000086120FE4}\InprocServer32 High Overpro.com HKCR\CLSID\{1CCED66A-75B5-11D5-89D3-000086120FE4}\ProgID High Overpro.com HKCR\CLSID\{1CCED66A-75B5-11D5-89D3-000086120FE4}\TypeLib High Overpro.com HKCR\CLSID\{1CCED66A-75B5-11D5-89D3-000086120FE4}\VERSION High Overpro.com HKLM\Software\Classes\CLSID\{1CCED66A-75B5-11D5-89D3-000086120FE4} High Overpro.com HKLM\Software\Classes\CLSID\{1CCED66A-75B5-11D5-89D3-000086120FE4}\InprocServer32 High Overpro.com HKLM\Software\Classes\CLSID\{1CCED66A-75B5-11D5-89D3-000086120FE4}\ProgID High Overpro.com HKLM\Software\Classes\CLSID\{1CCED66A-75B5-11D5-89D3-000086120FE4}\TypeLib High Overpro.com HKLM\Software\Classes\CLSID\{1CCED66A-75B5-11D5-89D3-000086120FE4}\VERSION High Tracking Cookie(s) C:\Documents and Settings\Donald Schneider\Cookies\donald [removed][1].txt Medium Tracking Cookie(s) C:\Documents and Settings\Donald Schneider\Cookies\donald schneider@mobileplanet[1].txt Medium Specific911 Hijack C:\Documents and Settings\Donald Schneider\Cookies\donald schneider@intelius[2].txt High Specific911 Hijack C:\Documents and Settings\Donald Schneider\Cookies\donald [removed][1].txt High Overpro.com C:\Program Files\Common Files\SWF Studio High Overpro.com C:\Program Files\Common Files\SWF Studio\GetURL.dll High Overpro.com C:\Program Files\Common Files\SWF Studio\Registry.dll High These are the same 31 items that I got before I scanned with Adaware and SBSAD, which together found and removed 20 items. Registry Medic didn't find any baddies associated with the registry, Spyware Doctor didn't find any that the other two did, and the other two didn't find any that Spyware Doctor did. Obviously Microsoft's entry in the field didn't catch any of them, what's it going to take before someone comes up with a truely comprehensive scanner. A daunting task, I know! All help appreciated. Yours, imnadja
Post #3
hi imnadja,

those items you posted (spyware doctor) look like harmless leftover entries. its also possible for malware apps to have false positives

you have several malware apps.(5!) mores not better, i would keep and use only 1 or 2 of them along with ewido and uninstall the others via add/remove programs panel

from the spyware doctor log, take a look here: C:\Program Files\Common Files and delete the folder: SWF Studio

some optional items to have hjt "fix" first temporiarly disable Spybots tea timer before using hjt. enable after the "fix"

start HJT, click on "none of the above, just start the program" next click the "Scan" button. Check these items, then close all windows and click "Fix Checked"

O2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - (no file)
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/29eae2c98a9146…ip/RdxIE601.cab
——————————————
also do this:


Empty your Temp folders. Go to Start > Run and type:cleanmgr. Windows will scan. When done check these 3 and press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin
—————————————–
shelf life
Post #4
Shelf Life, Thank you so much for your help. I would highly respect your opinion on which malware apps are keepers and which I should get rid of. Also, I really need to pare down these running processes, typically I have well over 50 running at any one time, and over 1900 modules loaded. Where can I go for help on what I can safely shut down? All advice greatly appreciated. Yours, imnadja
Post #5
hi imnadja

sorry for the delay

which malware apps are keepers and which I should get rid of

did you pay for any of them? the ones you have are good, but 5 is overkill. i use spybot and lavasofts ad aware. iam not really familiar with the others.

heres a informative link:
http://www.spywarewarrior.com/rogue_anti-s…htm#trustworthy

also keep either a2 perrsonal or ewido.

might try this to dump some files:
http://www.ccleaner.com/
—————————————————–
start hjt, click on "none of the above, just start the program"
then click on config, then misc tools, then on generate startup list log.
save that log, then post it in next reply.

shelf life

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI