![]() |
![]() |
![]() |
|||||
![]() |
![]() |
![]() |
![]() |
![]() |
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
|
|
#1 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 7
OS: windows xp home sp3
|
On 7-7-09 I had sent a mail describing therein the issues I'm facing. 'amateur' had very kindly responded to my mail, and on the same day I had sent all the required information as per instructions contained in 'New Instructions'
Today, while going through the forum, I did not find my 'post'. Perhaps I had made some mistake while posting it.So I'm resending the whole thing.Pl. understand that I'm not trying to jump the queue, or bumping. DDS (Ver_09-06-26.01) - NTFSx86 Run by GAURAV AGRAWAL at 15:09:36.43 on Wed 07/08/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1432 [GMT 5.5:30] AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} AV: avast! antivirus 4.7.1001 [VPS 000000-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\Program Files\Comodo\Firewall\cmdagent.exe C:\WINDOWS\system32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\WINDOWS\stsystra.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder\OrderReminder.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Comodo\Firewall\cfp.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Down2Home\Down2Home.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\GAURAV AGRAWAL\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.co.in/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = localhost;;*.local;<local> uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Download Manager Browser Helper Object: {19c8e43b-07b3-49cb-bffc-6777b593e6f8} - c:\progra~1\common~1\fluxdvd\downlo~1\XEBDLH~1.DLL BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar3.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\3.1.807.1746\swg.dll BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No File BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: Ask Toolbar BHO: {f0d4b231-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\asksbar\bar\1.bin\ASKSBAR.DLL TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar3.dll TB: Ask Toolbar: {f0d4b239-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\asksbar\bar\1.bin\ASKSBAR.DLL TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File TB: {37B85A29-692B-4205-9CAD-2626E4993404} - No File uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [SetDefaultMIDI] MIDIDef.exe uRun: [LogitechSoftwareUpdate] "c:\program files\logitech\video\ManifestEngine.exe" boot uRun: [googletalk] "c:\program files\google\google talk\googletalk.exe" /autostart uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup uRun: [mount.exe] c:\program files\gipo@utilities\fileutilities.3\mount.exe /z uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [TomcatStartup 2.5] c:\program files\hewlett-packard\toolbox\hpbpsttp.exe mRun: [Sunkist2k] c:\program files\multimedia card reader\shwicon2k.exe mRun: [StatusClient 2.6] c:\program files\hewlett-packard\toolbox\statusclient\StatusClient.exe /auto mRun: [SsAAD.exe] c:\progra~1\sony\sonics~1\SsAAD.exe mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup mRun: [Easy-PrintToolBox] c:\program files\canon\easy-printtoolbox\BJPSMAIN.EXE /logon mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe mRun: [CTSysVol] c:\program files\creative\sbaudigy\surround mixer\CTSysVol.exe /r mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe" mRun: [nwiz] nwiz.exe /install mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE mRun: [SigmatelSysTrayApp] stsystra.exe mRun: [HP Software Update] "c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe" mRun: [OrderReminder] c:\program files\hewlett-packard\orderreminder\orderreminder\OrderReminder.exe mRun: [HPLJ Config] 8 mRun: [COMODO Firewall Pro] "c:\program files\comodo\firewall\cfp.exe" -h mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [COMODO Internet Security] "c:\program files\comodo\firewall\cfp.exe" -h dRunOnce: [RunNarrator] Narrator.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\down2h~1.lnk - c:\program files\down2home\Down2Home.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Trusted Zone: internet Trusted Zone: mcafee.com DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228628608468 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1228628592343 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} - hxxp://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {E856B973-45FD-4559-8F82-EAB539144667} - hxxp://pccheckup.dellfix.com/rel/41/install/gtdownde.cab TCP: {B54E7C2C-6EE7-43AA-B3E1-D8722F89A07D} = 59.144.127.16,59.144.127.17 Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL AppInit_DLLs: c:\progra~1\google\google~1\goec62~1.dll c:\windows\system32\guard32.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL ============= SERVICES / DRIVERS =============== R0 cc_4g;cc_4g;c:\windows\system32\drivers\cc_4g.sys [2006-11-19 189856] R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-5-15 11608] R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2009-3-9 132040] R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2009-3-9 25160] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2008-9-3 9968] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-9-3 55024] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-5-15 108289] R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-5-15 185089] R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-5-15 55640] R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\firewall\cmdagent.exe [2009-3-9 707152] R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-9-3 7408] S3 AvSynMgr;AVSync Manager;"c:\program files\network associates\virusscan\avsynmgr.exe" --> c:\program files\network associates\virusscan\avsynmgr.exe [?] S3 BIOSCHK;BIOSCHK;\??\c:\docume~1\gaurav~1\locals~1\temp\tiie.tmp\disk1\bioschk.sys --> c:\docume~1\gaurav~1\locals~1\temp\tiie.tmp\disk1\BIOSCHK.SYS [?] S3 PhilCam8116_XP;Logitech QuickCam Pro 3000(PID_08B1);c:\windows\system32\drivers\CamDrL20.sys [2006-3-28 245760] =============== Created Last 30 ================ 7/8/2009 9:00 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NortonInstaller 7/7/2009 13:20 <DIR> --d----- c:\windows\system32\wbem\Repository 7/1/2009 20:09 <DIR> --d----- c:\program files\Corel 7/1/2009 14:34 1,350,784 a------- c:\windows\system32\drivers\sigfilt.sys 7/1/2009 14:34 115,200 a------- c:\windows\system32\SFMS32.DLL 7/1/2009 14:34 158,464 a------- c:\windows\system32\drivers\CTUSFSYN.SYS 7/1/2009 14:34 138,752 a------- c:\windows\system32\drivers\CTSFM2K.SYS 7/1/2009 14:34 106,496 a------- c:\windows\system32\drivers\CTOSS2K.SYS 7/1/2009 14:34 20,992 a------- c:\windows\system32\SFMAN32.DLL 7/1/2009 14:34 59 a------- c:\windows\system32\DEFAULT4.SFM 7/1/2009 14:34 4,174,814 a------- c:\windows\system32\CT4MGM.SF2 7/1/2009 14:34 51,712 a------- c:\windows\system32\CISETUP.DLL 6/29/2009 10:54 <DIR> --dsh--- C:\found.001 6/26/2009 10:27 369 a------- c:\windows\capture.ini 6/26/2009 10:25 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Bitstream Font Navigator 6/26/2009 10:12 <DIR> --d----- c:\windows\Corel 6/26/2009 10:11 <DIR> --d----- c:\program files\common files\Corel 6/19/2009 8:58 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\{81D4BDA8-1F33-4633-B176-8A7E942ABDE1} 6/16/2009 10:53 <DIR> --d----- c:\program files\XnView 6/10/2009 19:02 1,985,024 -------- c:\windows\system32\dllcache\iertutil.dll 6/10/2009 19:02 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll 6/10/2009 19:02 12,800 -------- c:\windows\system32\dllcache\xpshims.dll 6/10/2009 19:02 11,064,832 -------- c:\windows\system32\dllcache\ieframe.dll ==================== Find3M ==================== 7/8/2009 8:27 179,792 a------- c:\windows\system32\guard32.dll 7/8/2009 8:27 132,040 a------- c:\windows\system32\drivers\cmdguard.sys 7/5/2009 13:32 25,160 a------- c:\windows\system32\drivers\cmdhlp.sys 6/26/2009 10:39 80,496 a------- c:\docume~1\gaurav~1\applic~1\GDIPFONTCACHEV1.DAT 5/21/2009 11:33 410,984 a------- c:\windows\system32\deploytk.dll 5/13/2009 10:45 5,936,128 a------- c:\windows\system32\dllcache\mshtml.dll 5/13/2009 10:45 915,456 a------- c:\windows\system32\wininet.dll 5/13/2009 10:45 915,456 a------- c:\windows\system32\dllcache\wininet.dll 5/7/2009 21:02 345,600 a------- c:\windows\system32\localspl.dll 5/7/2009 21:02 345,600 a------- c:\windows\system32\dllcache\localspl.dll 5/1/2009 2:52 1,207,808 a------- c:\windows\system32\dllcache\urlmon.dll 5/1/2009 2:52 25,600 -------- c:\windows\system32\dllcache\jsproxy.dll 5/1/2009 2:52 385,536 -------- c:\windows\system32\dllcache\iedkcs32.dll 4/30/2009 16:51 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe 4/17/2009 17:56 1,847,168 a------- c:\windows\system32\win32k.sys 4/17/2009 17:56 1,847,168 a------- c:\windows\system32\dllcache\win32k.sys 4/15/2009 20:21 585,216 a------- c:\windows\system32\rpcrt4.dll 4/15/2009 20:21 585,216 a------- c:\windows\system32\dllcache\rpcrt4.dll 7/30/2008 16:57 2,428,440 a------- c:\program files\password hacker.exe 7/6/2008 14:28 81,920 a------- c:\docume~1\gaurav~1\applic~1\ezpinst.exe 7/6/2008 14:28 47,360 a------- c:\docume~1\gaurav~1\applic~1\pcouffin.sys 6/21/2008 9:23 87,608 a------- c:\docume~1\gaurav~1\applic~1\inst.exe 9/24/2007 11:07 60,968 a------- c:\documents and settings\gaurav agrawal\GoToAssistDownloadHelper.exe 11/4/2005 4:59 72,832 a----r-- c:\windows\inf\CamAvb.sys ============= FINISH: 15:10:21.90 =============== |
|
|
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
|
#2 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,273
OS: XP SP3
|
Re: 100% CPU usage
Hi,
Below is the link to your original thread: Cpu usage 100% You can subscribe to your thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. You can also check for replies via Quick Links>Subscribed Threads menu. Please note that the forum is very busy and it may take a while to receive a reply. Please stay with your original thread as this one will be closed.
__________________
My services are free. However, you can donate to TSF to help keep it running. ![]() ![]() Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
| Thread Tools | |
|
|