Please help - CPU Usage by alarm.exe is 99%

waltino · 12-04-2004, 12:06 PM

Thank you in advance for your assistance.

One week ago I downloaded and installed spambayes on a normally functioning desktop. Since then, the "alarm.exe" process takes over the CPU and constantly runs at 99% usage. By ending the alarm.exe process I re-take the CPU and the computer functions normally. Of course, that also makes my calendar less than functional.

In an attempt to solve the problem, I uninstalled spambayes and downloaded and ran stinger.exe. Stinger found multiple iterations of W32/Bugbear.69916@MM, W32/Bugbear.b!data and W32/Bugbear.b.dll.gen. The Stinger txt file is attached.

I then downloaded and installed spybot and ad-aware. And deleted all discovered threats.

Next, I ran NAV 2004 and TrendMicro. No threats were found.

When I re-boot, alarm.exe still hogs the CPU. I removed alarm.exe from its location and placed it on the desktop to prevent it from loading. Computer functions normally but calendar is less functional.

Below is my HijackThis log analyzed by HijackThis Analyzer.

Is there any thing I can do to bring back alarm.exe without the CPU hogging?

Thank you very much for your assistance!

waltino

Log was analyzed using HijackThis Analyzer - Updated on 12/4/04
Get updates at http://www.greyknight17.com/download.htm#programs

Logfile of HijackThis v1.97.7
Scan saved at 1:44:15 PM, on 12/4/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\PSSVC.EXE
C:\DMI\bin\dmisrv.exe
C:\Program Files\HP Web JetAdmin\hpwebjetd.exe
C:\PCT-SAFE\Firebird\Bin\ibguard.exe
C:\PCT-SAFE\Firebird\Bin\ibserver.exe
C:\WINNT\SYSTEM32\ZoneLabs\vsmon.exe
C:\DMI\bin\dnar.exe
C:\DMI\bin\nodemngr.exe
C:\DMI\bin\win32sl.exe
C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\createcd.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
C:\Program Files\Microsoft Office\Office\OSA9.EXE
C:\HJT\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: CorelCENTRAL 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\ccwin9.exe
O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Global Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} (AlternaTIFF ActiveX) - http://www.alternatiff.com/install/00/alttiff.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...030.3820833333
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

End of HijackThis Analyzer Log.

CTSNKY · 12-04-2004, 12:15 PM

You have an outdated version of HijackThis. Click here to get the latest version of HijackThis.

If you have a fast internet connection (broadband), run an online virus scan at TrendMicro. Make sure to select the Autoclean option.

Reboot and post a fresh HJT log.

waltino · 12-04-2004, 01:25 PM

Thank you.

I ran TrendMicro -- it found no viruses.

Below is a new log using HijackThis v1.98.2 analyzed by HiJackThis Analyzer.

Thank again for your help.

waltino

Log was analyzed using HijackThis Analyzer - Updated on 12/4/04
Get updates at http://www.greyknight17.com/download.htm#programs

Logfile of HijackThis v1.98.2
Scan saved at 3:22:03 PM, on 12/4/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\PSSVC.EXE
C:\DMI\bin\dmisrv.exe
C:\Program Files\HP Web JetAdmin\hpwebjetd.exe
C:\PCT-SAFE\Firebird\Bin\ibguard.exe
C:\PCT-SAFE\Firebird\Bin\ibserver.exe
C:\WINNT\SYSTEM32\ZoneLabs\vsmon.exe
C:\DMI\bin\dnar.exe
C:\DMI\bin\nodemngr.exe
C:\DMI\bin\win32sl.exe
C:\PROGRA~1\Adaptec\DirectCD\directcd.exe
C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\createcd.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
C:\Program Files\Microsoft Office\Office\OSA9.EXE
C:\HJT\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: CorelCENTRAL 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\ccwin9.exe
O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Global Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} (AlternaTIFF ActiveX) - http://www.alternatiff.com/install/00/alttiff.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab

End of HijackThis Analyzer Log.

CTSNKY · 12-04-2004, 01:52 PM

Now, don't be surprised if you have a problem with WordPerfect when we are done. You probably should move any important WP document files to a different directory now, just to be safe.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled.

Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it):

C:\DMI\bin\dnar.exe
C:\DMI\bin\nodemngr.exe
C:\DMI\bin\win32sl.exe
C:\DMI\bin\dmisrv.exe

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

O4 - Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe

Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\DMI\

Reboot into Normal Mode and post a new HijackThis log file so we can make sure it's clean.

12-04-2004, 12:15 PM	#2 (permalink)
CTSNKY Knower of all that is MS Join Date: Aug 2004 Posts: 10,755 OS: (multiple machines) 95, 98, 2K & XP Home & Pro	You have an outdated version of HijackThis. Click here to get the latest version of HijackThis. If you have a fast internet connection (broadband), run an online virus scan at TrendMicro. Make sure to select the Autoclean option. Reboot and post a fresh HJT log. __________________ GO BIG BLUE!!

12-04-2004, 01:52 PM	#4 (permalink)
CTSNKY Knower of all that is MS Join Date: Aug 2004 Posts: 10,755 OS: (multiple machines) 95, 98, 2K & XP Home & Pro	Now, don't be surprised if you have a problem with WordPerfect when we are done. You probably should move any important WP document files to a different directory now, just to be safe. Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below. Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it): C:\DMI\bin\dnar.exe C:\DMI\bin\nodemngr.exe C:\DMI\bin\win32sl.exe C:\DMI\bin\dmisrv.exe Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any): O4 - Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist: C:\DMI\ Reboot into Normal Mode and post a new HijackThis log file so we can make sure it's clean. __________________ GO BIG BLUE!!

12-04-2004, 01:25 PM	#3 (permalink)
waltino Registered User Join Date: Dec 2004 Posts: 2 OS: Win2K	Thank you. I ran TrendMicro -- it found no viruses. Below is a new log using HijackThis v1.98.2 analyzed by HiJackThis Analyzer. Thank again for your help. waltino Log was analyzed using HijackThis Analyzer - Updated on 12/4/04 Get updates at http://www.greyknight17.com/download.htm#programs Logfile of HijackThis v1.98.2 Scan saved at 3:22:03 PM, on 12/4/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000) Running processes: C:\WINNT\System32\PSSVC.EXE C:\DMI\bin\dmisrv.exe C:\Program Files\HP Web JetAdmin\hpwebjetd.exe C:\PCT-SAFE\Firebird\Bin\ibguard.exe C:\PCT-SAFE\Firebird\Bin\ibserver.exe C:\WINNT\SYSTEM32\ZoneLabs\vsmon.exe C:\DMI\bin\dnar.exe C:\DMI\bin\nodemngr.exe C:\DMI\bin\win32sl.exe C:\PROGRA~1\Adaptec\DirectCD\directcd.exe C:\PROGRA~1\Adaptec\EASYCD~1\CreateCD\createcd.exe C:\Program Files\America Online 8.0\aoltray.exe C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe C:\Program Files\Microsoft Office\Office\OSA9.EXE C:\HJT\HijackThis.exe O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe O4 - Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe O4 - Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe O4 - Global Startup: CorelCENTRAL 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\ccwin9.exe O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe O4 - Global Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} (AlternaTIFF ActiveX) - http://www.alternatiff.com/install/00/alttiff.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab End of HijackThis Analyzer Log.