« previous next »
Pages: [1]

Author Topic: CPU always at 100%  (Read 874 times)

Offline mikeb1034

  • Newbie
  • *
  • Posts: 8
  • Karma: +0/-0
    • View Profile
CPU always at 100%
« on: December 13, 2007, 11:59:15 AM »
Recently my laptop has been running very slowly and I opened up task manager and realized that my cpu was at 100% all of the time regardless of whether or not I had any programs running.  I scanned my computer using advanced windows care v2 and mcafee and found nothing.  I'm not too computer savy so I really have no idea what the problem could be.  I've posted my hijack log below, if anyone could help me figure out why my computer is running so poorly it would be greatly appreciated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:48:09 AM, on 12/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\kkw_run.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [kkw_run.exe] kkw_run.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\PartyPoker.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\PartyPoker.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1190051699375
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/RICKBU~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

--
End of file - 7446 bytes
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
CPU always at 100%
« Reply #1 on: December 13, 2007, 05:52:09 PM »
Download this file - Combofix.exe and save it ONLY to your desktop

Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you.
It's default location is C:\Combofix.txt

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall
« Last Edit: December 13, 2007, 05:52:27 PM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline mikeb1034

  • Newbie
  • *
  • Posts: 8
  • Karma: +0/-0
    • View Profile
CPU always at 100%
« Reply #2 on: December 17, 2007, 01:01:59 AM »
[quote name=\'guestolo\' post=\'412994\' date=\'Dec 13 2007, 05:52 PM\']Download this file - Combofix.exe and save it ONLY to your desktop

Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you.
It's default location is C:\Combofix.txt

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall[/quote]

I ran the program and initially it worked, but after restarting my computer a few times the problem resumed.  In addition to that my computer is now popping up with the found new hardware everytime i start up and the hardware is my "system" which I don't think is normal......any other suggestions?
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
CPU always at 100%
« Reply #3 on: December 17, 2007, 08:02:26 PM »
Quote
I ran the program and initially it worked, but after restarting my computer a few times the problem resumed. In addition to that my computer is now popping up with the found new hardware everytime i start up and the hardware is my "system" which I don't think is normal......any other suggestions?

I forgot to ask for the logs completely
Can you do the below please

Go to START>>RUN>>Copy then paste the next command below in bold
Then hit OK

combofix /u

This will uninstall combofix

Afterwards
ReDownload this file - Combofix.exe and save it ONLY to your desktop

Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you.
It's default location is C:\Combofix.txt

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Post back the following

1. Post the log from Combofix
2. Run a fresh Scan>>Save logfile with hijackthis and post it's log please
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline mikeb1034

  • Newbie
  • *
  • Posts: 8
  • Karma: +0/-0
    • View Profile
CPU always at 100%
« Reply #4 on: December 18, 2007, 10:28:14 PM »
[quote name=\'guestolo\' post=\'413698\' date=\'Dec 17 2007, 08:02 PM\']I forgot to ask for the logs completely
Can you do the below please

Go to START>>RUN>>Copy then paste the next command below in bold
Then hit OK

combofix /u

This will uninstall combofix

Afterwards
ReDownload this file - Combofix.exe and save it ONLY to your desktop

Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you.
It's default location is C:\Combofix.txt

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Post back the following

1. Post the log from Combofix
2. Run a fresh Scan>>Save logfile with hijackthis and post it's log please[/quote]
Here's the combo fix log

(((((((((((((((((((((((((   Files Created from 2007-11-19 to 2007-12-19  )))))))))))))))))))))))))))))))
.

2007-12-16 21:58 . 2007-12-16 21:58    <DIR>    d--------    C:\Program Files\QuickTime
2007-12-13 11:47 . 2007-12-13 11:47    <DIR>    d--------    C:\Program Files\Trend Micro
2007-12-12 20:20 . 2007-12-12 20:20    <DIR>    d--hs----    C:\FOUND.008
2007-12-11 17:34 . 2007-12-11 17:34    1,044,480    --a------    C:\WINDOWS\system32\libdivx.dll
2007-12-11 17:34 . 2007-12-11 17:34    200,704    --a------    C:\WINDOWS\system32\ssldivx.dll
2007-12-11 10:57 . 2007-12-11 10:57    65,536    --a------    C:\WINDOWS\system32\QuickTimeVR.qtx
2007-12-11 10:57 . 2007-12-11 10:57    49,152    --a------    C:\WINDOWS\system32\QuickTime.qts
2007-12-07 21:44 . 2007-12-07 21:44    <DIR>    d--------    C:\Program Files\IObit
2007-12-07 00:42 . 2007-12-07 00:42    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\WinZip
2007-11-28 13:32 . 2007-11-28 13:32    23    --a------    C:\WINDOWS\PARAM.CMI
2007-11-26 21:15 . 2007-11-26 21:15    <DIR>    d--------    C:\Program Files\Zune

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-12 21:29    27,344    ----a-w    C:\Documents and Settings\Rick Buckner\Application Data\wklnhst.dat
2007-11-16 02:38    40,832    ----a-w    C:\WINDOWS\system32\drivers\zumbus.sys
2007-11-13 10:25    20,480    ----a-w    C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-30 23:42    3,590,656    ----a-w    C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-29 22:43    1,287,680    ----a-w    C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43    1,287,680    ----a-w    C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-27 22:40    222,720    ----a-w    C:\WINDOWS\system32\wmasf.dll
2007-10-27 22:40    222,720    ----a-w    C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-26 03:36    8,454,656    ----a-w    C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-18 18:09    1,419,232    ----a-w    C:\WINDOWS\system32\WdfCoInstaller01005.dll
2007-10-10 23:56    824,832    ----a-w    C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-10 23:56    671,232    ----a-w    C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-10 23:56    232,960    ----a-w    C:\WINDOWS\system32\dllcache\webcheck.dll
2007-10-10 23:56    105,984    ----a-w    C:\WINDOWS\system32\dllcache\url.dll
2007-10-10 23:56    102,400    ----a-w    C:\WINDOWS\system32\dllcache\occache.dll
2007-10-10 23:56    1,159,680    ----a-w    C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-10 23:55    63,488    ------w    C:\WINDOWS\system32\dllcache\icardie.dll
2007-10-10 23:55    6,065,664    ------w    C:\WINDOWS\system32\dllcache\ieframe.dll
2007-10-10 23:55    52,224    ------w    C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-10-10 23:55    478,208    ----a-w    C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-10 23:55    459,264    ------w    C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-10-10 23:55    44,544    ----a-w    C:\WINDOWS\system32\dllcache\iernonce.dll
2007-10-10 23:55    384,512    ----a-w    C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-10-10 23:55    383,488    ------w    C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-10-10 23:55    27,648    ----a-w    C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-10 23:55    267,776    ------w    C:\WINDOWS\system32\dllcache\iertutil.dll
2007-10-10 23:55    230,400    ----a-w    C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-10-10 23:55    214,528    ----a-w    C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-10 23:55    193,024    ----a-w    C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-10 23:55    153,088    ----a-w    C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-10-10 23:55    132,608    ----a-w    C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-10 23:55    124,928    ----a-w    C:\WINDOWS\system32\dllcache\advpack.dll
2007-10-10 10:59    70,656    ----a-w    C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-10-10 10:59    625,152    ----a-w    C:\WINDOWS\system32\dllcache\iexplore.exe
2007-10-10 10:59    13,824    ------w    C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-10-10 05:46    161,792    ----a-w    C:\WINDOWS\system32\dllcache\ieakui.dll
2007-04-25 02:53    50,072    ----a-w    C:\Documents and Settings\Rick Buckner\Application Data\GDIPFONTCACHEV1.DAT
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" []
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-07 19:59]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 17:07 C:\WINDOWS\system32\HdAShCut.exe]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 19:51]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 14:44]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 14:43]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 05:00 C:\WINDOWS\system32\bthprops.cpl]
"RTHDCPL"="RTHDCPL.EXE" [2005-08-09 15:17 C:\WINDOWS\RTHDCPL.EXE]
"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-08-11 19:21]
"ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-03-15 10:03]
"LManager"="C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE" [2005-08-19 01:28]
"eRecoveryService"="C:\Program Files\Acer\eRecovery\Monitor.exe" [2005-08-18 19:38]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" [2006-11-17 03:06]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"kkw_run.exe"="kkw_run.exe" [2005-12-15 17:00 C:\WINDOWS\system32\kkw_run.exe]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2006-11-30 08:50]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2007-03-14 17:03]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 10:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys [2004-12-17 17:14]
R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2004-07-19 13:10]
R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-07 18:08]
R2 int15.sys;int15.sys;C:\Program Files\Acer\eRecovery\int15.sys [2005-01-13 14:46]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30 16:58]
R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14 15:57]
R3 KKW_HID;Kensington HIDClass Filter Driver;C:\WINDOWS\system32\DRIVERS\KKW_HID.sys [2005-12-01 15:17]
R3 KMW_KBD;Kensington Input Devices Class filter driver;C:\WINDOWS\system32\DRIVERS\KMW_KBD.sys [2005-09-01 11:41]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys [2005-04-12 19:21]
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys [2005-04-12 19:21]
S3 DKbFltr;Dritek Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DKbFltr.sys [2004-12-08 14:10]
S3 KMW_SYS;Kensington MouseWorks Mouse filter driver;C:\WINDOWS\system32\DRIVERS\KMW_SYS.sys [2005-09-01 11:41]
S3 KMW_USB;Kensington MouseWorks USB filter driver;C:\WINDOWS\system32\DRIVERS\KMW_USB.sys [2005-09-01 11:41]
S3 WINIO;WINIO;C:\WINDOWS\system32\winio.sys [2001-11-13 09:47]
S3 WmFilter;Logitech Gaming HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys [2005-04-12 19:21]
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys [2005-04-12 19:21]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8eaad7f6-9f11-11dc-8d83-00c09fdc84b1}]
\Shell\AutoRun\command - G:\Autorun.exe /run
\Shell\Shell00\Command - G:\Autorun.exe /run
\Shell\Shell01\Command - G:\Autorun.exe /action
\Shell\Shell02\Command - G:\Autorun.exe /uninstall

*Newly Created Service* - INT15.SYS
.
Contents of the 'Scheduled Tasks' folder
"2007-12-15 18:41:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-18 22:19:05
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-18 22:22:44
C:\ComboFix3.txt ... 2007-12-15 03:43
C:\ComboFix2.txt ... 2007-12-16 21:00
.
2007-12-12 08:07:26    --- E O F ---  
And here is a new hijack log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:26:45 PM, on 12/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\kkw_run.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [kkw_run.exe] kkw_run.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\PartyPoker.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\PartyPoker.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1190051699375
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/RICKBU~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

--
End of file - 7523 bytes

Hope this helps in finding a solution.
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
CPU always at 100%
« Reply #5 on: December 18, 2007, 10:48:40 PM »
You cut off the top part of your combofix log

Copy and paste All if it back, including the top section

Also, navigate to this file if found
C:\ComboFix-quarantined-files.txt
Post it's contents also
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline mikeb1034

  • Newbie
  • *
  • Posts: 8
  • Karma: +0/-0
    • View Profile
CPU always at 100%
« Reply #6 on: December 18, 2007, 11:27:40 PM »
[quote name=\'guestolo\' post=\'413859\' date=\'Dec 18 2007, 10:48 PM\']You cut off the top part of your combofix log

Copy and paste All if it back, including the top section

Also, navigate to this file if found
C:\ComboFix-quarantined-files.txt
Post it's contents also[/quote]

Here's the full log however, I couldn't find the combofix-qurantined-files.txt I ran a search but found nothing.

ComboFix 07-12-19.3 - Michael Buckner 2007-12-18 22:09:22.3 - [color=\"red\"]FAT32[/color]x86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.472 [GMT -5:00]
Running from: C:\Documents and Settings\Rick Buckner\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((   Files Created from 2007-11-19 to 2007-12-19  )))))))))))))))))))))))))))))))
.

2007-12-16 21:58 . 2007-12-16 21:58    <DIR>    d--------    C:\Program Files\QuickTime
2007-12-13 11:47 . 2007-12-13 11:47    <DIR>    d--------    C:\Program Files\Trend Micro
2007-12-12 20:20 . 2007-12-12 20:20    <DIR>    d--hs----    C:\FOUND.008
2007-12-11 17:34 . 2007-12-11 17:34    1,044,480    --a------    C:\WINDOWS\system32\libdivx.dll
2007-12-11 17:34 . 2007-12-11 17:34    200,704    --a------    C:\WINDOWS\system32\ssldivx.dll
2007-12-11 10:57 . 2007-12-11 10:57    65,536    --a------    C:\WINDOWS\system32\QuickTimeVR.qtx
2007-12-11 10:57 . 2007-12-11 10:57    49,152    --a------    C:\WINDOWS\system32\QuickTime.qts
2007-12-07 21:44 . 2007-12-07 21:44    <DIR>    d--------    C:\Program Files\IObit
2007-12-07 00:42 . 2007-12-07 00:42    <DIR>    d--------    C:\Documents and Settings\All Users\Application Data\WinZip
2007-11-28 13:32 . 2007-11-28 13:32    23    --a------    C:\WINDOWS\PARAM.CMI
2007-11-26 21:15 . 2007-11-26 21:15    <DIR>    d--------    C:\Program Files\Zune

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-12 21:29    27,344    ----a-w    C:\Documents and Settings\Rick Buckner\Application Data\wklnhst.dat
2007-11-16 02:38    40,832    ----a-w    C:\WINDOWS\system32\drivers\zumbus.sys
2007-11-13 10:25    20,480    ----a-w    C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-30 23:42    3,590,656    ----a-w    C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-29 22:43    1,287,680    ----a-w    C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43    1,287,680    ----a-w    C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-27 22:40    222,720    ----a-w    C:\WINDOWS\system32\wmasf.dll
2007-10-27 22:40    222,720    ----a-w    C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-26 03:36    8,454,656    ----a-w    C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-18 18:09    1,419,232    ----a-w    C:\WINDOWS\system32\WdfCoInstaller01005.dll
2007-10-10 23:56    824,832    ----a-w    C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-10 23:56    671,232    ----a-w    C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-10 23:56    232,960    ----a-w    C:\WINDOWS\system32\dllcache\webcheck.dll
2007-10-10 23:56    105,984    ----a-w    C:\WINDOWS\system32\dllcache\url.dll
2007-10-10 23:56    102,400    ----a-w    C:\WINDOWS\system32\dllcache\occache.dll
2007-10-10 23:56    1,159,680    ----a-w    C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-10 23:55    63,488    ------w    C:\WINDOWS\system32\dllcache\icardie.dll
2007-10-10 23:55    6,065,664    ------w    C:\WINDOWS\system32\dllcache\ieframe.dll
2007-10-10 23:55    52,224    ------w    C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-10-10 23:55    478,208    ----a-w    C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-10 23:55    459,264    ------w    C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-10-10 23:55    44,544    ----a-w    C:\WINDOWS\system32\dllcache\iernonce.dll
2007-10-10 23:55    384,512    ----a-w    C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-10-10 23:55    383,488    ------w    C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-10-10 23:55    27,648    ----a-w    C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-10 23:55    267,776    ------w    C:\WINDOWS\system32\dllcache\iertutil.dll
2007-10-10 23:55    230,400    ----a-w    C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-10-10 23:55    214,528    ----a-w    C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-10 23:55    193,024    ----a-w    C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-10 23:55    153,088    ----a-w    C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-10-10 23:55    132,608    ----a-w    C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-10 23:55    124,928    ----a-w    C:\WINDOWS\system32\dllcache\advpack.dll
2007-10-10 10:59    70,656    ----a-w    C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-10-10 10:59    625,152    ----a-w    C:\WINDOWS\system32\dllcache\iexplore.exe
2007-10-10 10:59    13,824    ------w    C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-10-10 05:46    161,792    ----a-w    C:\WINDOWS\system32\dllcache\ieakui.dll
2007-04-25 02:53    50,072    ----a-w    C:\Documents and Settings\Rick Buckner\Application Data\GDIPFONTCACHEV1.DAT
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" []
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-07 19:59]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 17:07 C:\WINDOWS\system32\HdAShCut.exe]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 19:51]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-08 14:44]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-08 14:43]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 05:00 C:\WINDOWS\system32\bthprops.cpl]
"RTHDCPL"="RTHDCPL.EXE" [2005-08-09 15:17 C:\WINDOWS\RTHDCPL.EXE]
"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-08-11 19:21]
"ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-03-15 10:03]
"LManager"="C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE" [2005-08-19 01:28]
"eRecoveryService"="C:\Program Files\Acer\eRecovery\Monitor.exe" [2005-08-18 19:38]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" [2006-11-17 03:06]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"kkw_run.exe"="kkw_run.exe" [2005-12-15 17:00 C:\WINDOWS\system32\kkw_run.exe]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2006-11-30 08:50]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2007-03-14 17:03]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 10:56]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys [2004-12-17 17:14]
R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2004-07-19 13:10]
R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-07 18:08]
R2 int15.sys;int15.sys;C:\Program Files\Acer\eRecovery\int15.sys [2005-01-13 14:46]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30 16:58]
R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14 15:57]
R3 KKW_HID;Kensington HIDClass Filter Driver;C:\WINDOWS\system32\DRIVERS\KKW_HID.sys [2005-12-01 15:17]
R3 KMW_KBD;Kensington Input Devices Class filter driver;C:\WINDOWS\system32\DRIVERS\KMW_KBD.sys [2005-09-01 11:41]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys [2005-04-12 19:21]
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys [2005-04-12 19:21]
S3 DKbFltr;Dritek Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DKbFltr.sys [2004-12-08 14:10]
S3 KMW_SYS;Kensington MouseWorks Mouse filter driver;C:\WINDOWS\system32\DRIVERS\KMW_SYS.sys [2005-09-01 11:41]
S3 KMW_USB;Kensington MouseWorks USB filter driver;C:\WINDOWS\system32\DRIVERS\KMW_USB.sys [2005-09-01 11:41]
S3 WINIO;WINIO;C:\WINDOWS\system32\winio.sys [2001-11-13 09:47]
S3 WmFilter;Logitech Gaming HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys [2005-04-12 19:21]
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys [2005-04-12 19:21]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8eaad7f6-9f11-11dc-8d83-00c09fdc84b1}]
\Shell\AutoRun\command - G:\Autorun.exe /run
\Shell\Shell00\Command - G:\Autorun.exe /run
\Shell\Shell01\Command - G:\Autorun.exe /action
\Shell\Shell02\Command - G:\Autorun.exe /uninstall

*Newly Created Service* - INT15.SYS
.
Contents of the 'Scheduled Tasks' folder
"2007-12-15 18:41:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-18 22:19:05
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-18 22:22:44
C:\ComboFix3.txt ... 2007-12-15 03:43
C:\ComboFix2.txt ... 2007-12-16 21:00
.
2007-12-12 08:07:26    --- E O F ---
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
CPU always at 100%
« Reply #7 on: December 19, 2007, 12:25:06 AM »
Open your task manager>>Wait about 10 seconds

Then report
Under CPU
What percent is System Idle process reporting

If low, what processes appear to be using most percent?

Edit>>Can you also post this log from hijackthis
Open Hijackthis>>Open MISC TOOLS SECTION>>Open UNINSTALL MANAGER
Click the SAVE LIST... button
Save the list to your desktop then copy>>Paste back here the Whole contents
« Last Edit: December 19, 2007, 12:35:07 AM by guestolo »
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline mikeb1034

  • Newbie
  • *
  • Posts: 8
  • Karma: +0/-0
    • View Profile
CPU always at 100%
« Reply #8 on: December 19, 2007, 12:59:50 AM »
[quote name=\'guestolo\' post=\'413868\' date=\'Dec 19 2007, 12:25 AM\']Open your task manager>>Wait about 10 seconds

Then report
Under CPU
What percent is System Idle process reporting

If low, what processes appear to be using most percent?

Edit>>Can you also post this log from hijackthis
Open Hijackthis>>Open MISC TOOLS SECTION>>Open UNINSTALL MANAGER
Click the SAVE LIST... button
Save the list to your desktop then copy>>Paste back here the Whole contents[/quote]
Here is the list of uninstall manager's print out

Acer eManager for Notebook
Acer ePowerManagement
Acer GridVista
Ad-Aware SE Personal
Adobe Reader 8.1.1
Advanced WindowsCare 2.56 Personal
AOL Uninstaller (Choose which Products to Remove)
Apple Mobile Device Support
Apple Software Update
Aspell English Dictionary-0.50-2
Azureus
Diablo II
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
Gaim (remove only)
GNU Aspell 0.50-3
GTK+ Runtime 2.6.9 rev a (remove only)
Haali Media Splitter
HDAUDIO Soft Voice Modem with SmartCP
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB935448)
Intel® Graphics Media Accelerator Driver for Mobile
iPod for Windows 2005-06-26
iPod for Windows 2006-01-10
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java(tm) 6 Update 2
Java(tm) 6 Update 3
Java(tm) SE Runtime Environment 6 Update 1
Kensington Keyboard
Kensington MouseWorks
Launch Manager
Logitech Gaming Software
Logitech SetPoint
Macromedia Flash Player 8
Matroska Pack
McAfee VirusScan Enterprise
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Money 2004
Microsoft Money 2004 System Pack
Microsoft National Language Support Downlevel APIs
Microsoft Office Excel Viewer 2003
Microsoft Office Outlook 2003 with Business Contact Manager Update
Microsoft Office Professional Edition 2003
Microsoft SQL Server Desktop Engine (MICROSOFTSMLBIZ)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works
Microsoft Works Suite Add-in for Microsoft Word
Mozilla Firefox (2.0.0.11)
MSN Music Assistant
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 6.0 Parser (KB933579)
NCSS - PASS - GESS
NTI Backup NOW! 4
NTI CD & DVD-Maker
On2 VP7 Personal Edition
PartyPokerNet
PLI - Office 2003 - Exploring
PowerDVD
QuickTime
RealPlayer
REALTEK Gigabit and Fast Ethernet NIC Driver
Realtek High Definition Audio Driver
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB944653)
Starcraft
Synaptics Pointing Device Driver
System Requirements Lab
The Core Media Player 4.0
Titanic
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
URGE
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Viewpoint Toolbar
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893086
WinZip 11.1
Zune

My idle process is at 28k
here are the programs using the most memory:  ZuneNss.exe 28,588K, svchost.exe(system) 36,672K, mcshield.exe 48,564K, sqlservr.exe 10,744K, frameworkservice.exe 10,196K, rthdcpl.exe 23,164K, explorer.exe 22,804K and firefox 126,144K

Hope that helps
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
CPU always at 100%
« Reply #9 on: December 19, 2007, 01:10:09 AM »
Please answer the last question
What % is System idle sitting at after about 10 seconds of opening task manager
Under CPU

If Low, what is using CPU %
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline mikeb1034

  • Newbie
  • *
  • Posts: 8
  • Karma: +0/-0
    • View Profile
CPU always at 100%
« Reply #10 on: December 19, 2007, 01:37:52 AM »
[quote name=\'guestolo\' post=\'413875\' date=\'Dec 19 2007, 01:10 AM\']Please answer the last question
What % is System idle sitting at after about 10 seconds of opening task manager
Under CPU

If Low, what is using CPU %[/quote]

Sorry, you'll have to excuse my computer illeteracy ok I did what you said and my system idle is at 00 and qtzgacer.exe is using 99 % of the cpu
Logged

Offline mikeb1034

  • Newbie
  • *
  • Posts: 8
  • Karma: +0/-0
    • View Profile
CPU always at 100%
« Reply #11 on: December 19, 2007, 01:44:14 AM »
[quote name=\'guestolo\' post=\'413875\' date=\'Dec 19 2007, 01:10 AM\']Please answer the last question
What % is System idle sitting at after about 10 seconds of opening task manager
Under CPU

If Low, what is using CPU %[/quote]

Sorry, you'll have to excuse my computer illeteracy ok I did what you said and my system idle is at 00 and qtzgacer.exe is using 99 % of the cpu
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
CPU always at 100%
« Reply #12 on: December 19, 2007, 01:59:18 AM »
Seems others on the Internet are having problems with High cpu and qtzgacer

Can you try the following

Run a Scan Only with Hijackthis and tick these entries

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

After you have ticked the above entries
Leave Hijackthis open, but close all other windows
Including this one
Then click FIX CHECKED in Hijackthis
Ok any prompts

Restart your computer

Back in Windows
Access your add/remove programs
and remove All older version of Sun Java
Malware can exploit older installed versions
Remove the following

J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Javaâ„¢ 6 Update 2

Javaâ„¢ SE Runtime Environment 6 Update 1

Don't reboot yet
Remain in add/remove programs, the next ones are probably installed by AOL software
and usually installed unknowing by the user
I would remove them also

Viewpoint Manager (Remove Only)
Viewpoint Media Player
Viewpoint Toolbar

IF you didn't intentionally install Party Poker
Remove it also, you can leave it if you intentionally installed and use it

Reboot the computer again after any of the above is removed

Come back here and post a fresh hijackthis log and let me know how things are now running
Let me know if you still have high CPU problems
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline mikeb1034

  • Newbie
  • *
  • Posts: 8
  • Karma: +0/-0
    • View Profile
CPU always at 100%
« Reply #13 on: December 19, 2007, 11:49:08 AM »
[quote name=\'guestolo\' post=\'413879\' date=\'Dec 19 2007, 01:59 AM\']Seems others on the Internet are having problems with High cpu and qtzgacer

Can you try the following

Run a Scan Only with Hijackthis and tick these entries

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

After you have ticked the above entries
Leave Hijackthis open, but close all other windows
Including this one
Then click FIX CHECKED in Hijackthis
Ok any prompts

Restart your computer

Back in Windows
Access your add/remove programs
and remove All older version of Sun Java
Malware can exploit older installed versions
Remove the following

J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Javaâ„¢ 6 Update 2

Javaâ„¢ SE Runtime Environment 6 Update 1

Don't reboot yet
Remain in add/remove programs, the next ones are probably installed by AOL software
and usually installed unknowing by the user
I would remove them also

Viewpoint Manager (Remove Only)
Viewpoint Media Player
Viewpoint Toolbar

IF you didn't intentionally install Party Poker
Remove it also, you can leave it if you intentionally installed and use it

Reboot the computer again after any of the above is removed

Come back here and post a fresh hijackthis log and let me know how things are now running
Let me know if you still have high CPU problems[/quote]

My computer is finally running well again, the system idle process uses 99% when idle now.  Thank you for all the help.
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
CPU always at 100%
« Reply #14 on: December 20, 2007, 01:43:32 AM »
Can you repost a fresh hijackthis log
I missed one entry earlier I believe
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Pages: [1]
« previous next »