Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


100% Cpu Usage

  • This topic is locked This topic is locked
2 replies to this topic

#1 JRIowa


  • Members
  • 1 posts
  • Local time:06:49 AM

Posted 17 May 2008 - 08:19 AM

First of all, Hello and greetings to all of you that help dummies like me out.

I've had this problem for several weeks now. It started after a McAfee update and has been driving me nuts since then. I started with the McAfee technical chat service, went to their virus removal site, and now here. Between what is going on with my PC and the slow dial-up that I have, every "fix" takes 2-3 days. Any downloads have to be done at work and then brought home via my jump drive. McAfee won't update at all and most other sites crash. ComboFix and SmitFraudfix both crash when running, even in safe mode. I've looked at HJT logs so many times, whatever is wrong is probably staring me in the face and I can't see it. Here is the DSS log:

Deckard's System Scanner v20071014.68
Run by XXXXX on 2008-05-17 07:55:12
Computer is in Normal Mode.

-- HijackThis --------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:56:11 AM, on 5/17/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Eraser\eraser.exe
C:\Documents and Settings\James & Mirles\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.Heartofiowa.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.heartofiowa.net
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KvStart] C:\WINNT\system32\RegSrvc.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LuoXueSrv (LuoXue) - Unknown owner - C:\WINNT\system32\Server.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Drivers (WyDNS) - Unknown owner - c:\win\svchost.exe

End of file - 5496 bytes

-- Files created between 2008-04-17 and 2008-05-17 -----------------------------

2008-05-15 23:11:33 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_724.dat
2008-05-15 19:45:52 53248 --a------ C:\WINNT\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-05-07 18:54:06 0 d-------- C:\Program Files\Trend Micro
2008-05-06 18:35:24 0 d-a------ C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-06 17:24:50 1008 --a------ C:\WINNT\system32\tmp.reg
2008-05-06 17:24:14 25600 --a------ C:\WINNT\system32\WS2Fix.exe
2008-05-06 17:24:14 289144 --a------ C:\WINNT\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-05-06 17:24:14 86528 --a------ C:\WINNT\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-05-06 17:24:14 288417 --a------ C:\WINNT\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-05-06 17:24:14 82944 --a------ C:\WINNT\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-05-06 17:24:14 51200 --a------ C:\WINNT\system32\dumphive.exe
2008-05-06 17:24:14 82944 --a------ C:\WINNT\system32\404Fix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-05-04 07:54:00 0 d-------- C:\Documents and Settings\All Users\Application Data\Citrix
2008-05-04 07:06:47 0 d-------- C:\Documents and Settings\James & Mirles\Application Data\McAfee
2008-05-03 16:58:02 0 d-------- C:\sdat
2008-05-01 23:09:20 281600 --a------ C:\WINNT\system32\andt.sys
2008-05-01 16:27:15 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_5e8.dat
2008-04-22 23:50:46 0 d-------- C:\Documents and Settings\Default User\Application Data\SiteAdvisor
2008-04-22 23:47:31 0 d-------- C:\Program Files\McAfee.com
2008-04-22 23:47:29 0 d-------- C:\Program Files\Common Files\McAfee
2008-04-22 23:47:23 0 d-------- C:\Program Files\McAfee
2008-04-22 19:42:01 0 d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-04-21 15:09:59 0 d-------- C:\win
2008-04-21 15:09:34 202752 ---hs---- C:\WINNT\system32\who.exe
2008-04-20 08:43:32 0 d-------- C:\Documents and Settings\Default User\Application Data\Google
2008-04-19 11:12:53 115712 --a------ C:\WINNT\system32\SysGeneral.dll
2008-04-19 11:12:20 132608 --a------ C:\cmd.exe
2008-04-19 10:52:49 56320 --a------ C:\WINNT\FireFoxUpdater.exe

-- Find3M Report ---------------------------------------------------------------

2008-05-17 07:25:46 0 d-------- C:\Program Files\Eraser
2008-05-06 21:19:50 0 d-------- C:\Program Files\Common Files
2008-05-04 06:12:12 0 d-------- C:\Program Files\Accessories
2008-04-23 16:08:36 0 d-------- C:\Program Files\Google
2008-04-22 19:53:25 510 --a------ C:\WINNT\run2.vbs
2008-04-22 19:53:25 0 --------- C:\WINNT\run.vbs
2008-04-12 17:26:37 923362 ---hs---- C:\WINNT\system32\Server.exe
2008-04-12 17:26:37 923362 --a------ C:\WINNT\system32\sasa.exe
2008-04-12 17:20:55 1353 --a------ C:\WINNT\home.vbs
2008-04-01 09:07:05 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_3ec.dat
2008-04-01 08:58:25 40 --a------ C:\WINNT\system32\drmgs.sys
2008-02-20 05:43:57 0 -----n--- C:\WINNT\F

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

"Synchronization Manager"="mobsync.exe" [06/19/03 11:05a C:\WINNT\system32\mobsync.exe]
"PrinTray"="C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe" [08/16/00 12:08p]
"QuickFinder Scheduler"="C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE" [02/25/03 08:27p]
"NeroFilterCheck"="C:\WINNT\system32\NeroCheck.exe" [01/12/06 04:40p]
"KvStart"="C:\WINNT\system32\RegSrvc.exe" []
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [11/01/07 07:12p]

"internat.exe"="internat.exe" [12/07/99 06:00a C:\WINNT\system32\internat.exe]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [04/23/08 04:08p]
"Eraser"="C:\Program Files\Eraser\eraser.exe" [07/25/03 11:15a]

"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop

"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [9/23/2005 10:05:26 PM]
Microsoft Find Fast.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [7/10/1997 11:00:00 PM]

"disableregistrytools"=0 (0x0)





-- End of Deckard's System Scanner: finished at 2008-05-17 08:00:24 ------------

Thanks in advance.


BC AdBot (Login to Remove)


#2 drex23


    Bleeping Existence

  • Members
  • 456 posts
  • Gender:Male
  • Local time:07:49 AM

Posted 11 June 2008 - 08:45 PM

Hi, if you still would like assistance please try to perform the following.

Before we start fixing anything you should print out these instructions or copy them to a Notepad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download SDFix by AndyManchesta and save it to your desktop.
When using this tool, you must use the Administrator's account or an account with "Administrative rights"
  • Double click SDFix.exe and it will extract the files to %systemdrive%
  • (this is the drive that contains the Windows Directory, typically C:\SDFix).
  • DO NOT use it just yet.
Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Open the SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts, the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
  • Copy and paste the contents of the results file Report.txt in your next replyalong with a new HijackThis log.
-- If this error message is displayed when running SDFix: "The command prompt has been disabled by your administrator. Press any key to continue..."
Please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Enable_Command_Prompt.reg
Press Ok and then run SDFix again.

-- If the Command Prompt window flashes on then off again on XP or Win 2000, please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\FixPath.exe /Q
Reboot and then run SDFix again.

-- If SDFix still does not run, check the %comspec% variable. Right-click My Computer > click Properties > Advanced > Environment Variables and check that the ComSpec variable points to cmd.exe.

Next, perform a new scan with DSS (whether SDFix ran or not) as follows:
  • Click Start and then Run to bring up the Run box.
  • Copy and paste the contents of this quote box into the run box:

    "%userprofile%\desktop\dss.exe" /config

  • Close all other open windows.
  • Click OK.
  • A window will now open. Click Check All and then click Scan!.
  • When the scan is complete, two text files will open in Notepad:
    • main.txt <- this one will be maximized
    • extra.txt <- this one will be minimized
  • If not, they both can be found in the C:\Deckard\System Scanner folder.
  • Please copy (Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your next reply.
You may need to use multiple posts.

#3 drex23


    Bleeping Existence

  • Members
  • 456 posts
  • Gender:Male
  • Local time:07:49 AM

Posted 20 June 2008 - 06:17 PM

Due to the lack of feedback, this topic is closed.

If you need this topic reopened due to continuation of your original problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin your own topic.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users