CPU usage 100%???

tigermatt

This thread popped up on the forum a few days ago - I haven't read through it all but it may be of assistance. [thread=129000]CPU usage 100%, Pop-ups, & poss Virus...PLEASE HELP!! [/thread]

hawkwinddotcom

shellyd wrote:

PS, just one last thing I would like to ask if I did get a new PC am I right thinking I shouldn't xfer my photos(very special of my baby who died) to the new PC incase it passes the infection on. I really don't want to lose them.

Please Please Please save those photo's somewhere else as well not just on the hard drive

Browntoa

nothing to stop you transferring the photo's , just virus scan the disk before putting on the new PC to be sure

shellyd_3

Thank-you for all your replies.

Browntoa, Xp updates, when I press the download button I just get the egg timer , no message at all.

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)


this is also not required

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1;<local>

can you please tell me how to remove these.

Shopnav. I thought I had removed that with PChelpmans link.?

JonG. I will try majorgeeks- Thanks

Tigermatt, I have been following that thread but it has started to get a bit complicated for me. (me PC Dummy).

Hawkwndot.com.I will try to put the pictured on a floppy.( I don't have a CD)
I made the pictures from the small amount of video tape we had of his short life via some sort of software we had at the time, I don't think the quality would be good to get them printed, I will find a way to keep them though.

Thank-you all

Michelle

Browntoa

try one of the updates direct from here

try this first

http://www.microsoft.com/downloads/details.aspx?FamilyID=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

or if not then

http://www.microsoft.com/technet/security/Bulletin/MS05-054.mspx

maybe this one

Internet Explorer 6 for Microsoft Windows XP Service Pack 2 – Download the update

Browntoa

I wonder if your host file is corrupt

its found here

Windows XP Homec:\windows\system32\drivers\etc\hosts

it should look like this

http://www.bleepingcomputer.com/misc/hosts

when you have found the hosts file right mouse click on it and then "Open With" Notepad , it should have nothing probably other than this line

127.0.0.1 localhost

Browntoa

there is a file here

http://www.mvps.org/winhelp2002/hosts.htm

that will replace yours if it is corrupt and offer additional blocking against dodgy sites

Download: hosts.zip [right-click - Select: Save Target As] b]Updated 12-28-05[/b

This download includes a simple batch file (mvps.bat) that will rename the existing HOSTS file (HOSTS.MVP) then copy the included HOSTS file to the proper location. For more information please see the readme.txt included in the download.

If you are having trouble downloading or extracting the HOSTS file url="http://www.mvps.org/winhelp2002/hosts2.htm"][u][color=#0000ff]click here[/color][/u][/url
Note: the below locations are for the default paths, edit as needed.
Windows XP=C:\WINDOWS\SYSTEM32\DRIVERS\ETC
Windows 2K=C:\WINNT\SYSTEM32\DRIVERS\ETC
Win 98/ME=C:\WINDOWS

JonG_3

It may also be worth having a quick check that a virus has'nt disabled your MS updates. To do this go to :

Start Menu > Run and type in services.msc

You will get a list of services.

Look for "Automatic Updates" and check that this is started and set to automatically start. If not change the settings. You may find that a virus (if you have one) keeps turning this to Stop.

pchelpman

Hi Shelleyd

I don't want to confuse the issue here - for you or anyone else - so I will address just HJT related issues. Browntoa may be right about your hosts files but, as things seem to be gradually improving for you, I'd rather just tackle known quantities at the moment.

Service Pack 2 ... it is absloutely VITAL that you get this update. Without it your PC will keep getting infected everytime you go online with it. I hope you have cracked that problem now.

shopnav ... so far as I can see from your last HJT log you are free from this.

removal with HJT ... this is the full procedure to get HJT to fix things in your log:

First you should print out or copy this page to Notepad in order to assist you when carrying out the instructions.

You are running HijackThis from a temporary location. Please move the folder to a permanent place on your hard drive such as C:\HJT. This will ensure that any backups made are not lost.

Go to My Computer >Tools >Folder Options >View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System Files and Folders are showing / visible. Uncheck the Hide protected operating system files option.

Download CleanUp! here….. http://www.cleanup.stevengould.org/ .......

*WARNING* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups. If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility

Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes.

Reboot your system in Safe Mode (by repeatedly tapping the F8 key until the menu appears).

Open HijackThis and click on Scan. Check the following entries (make sure you do not miss either):

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O9 - Extra button: Coches - {AF0828BC-CB46-4C8D-95B6-8A7C4988F9FF} - c:\exio-libremp3-uk\index.html (file missing)

Please remember to close all other windows, including browsers, before clicking “Fix checked”.

Reboot your System in normal mode.

If you have a fast internet connection (Broadband) run online scans here….

http://www.pandasoftware.com/activescan/

…and here…..

http://housecall.trendmicro.com.

When running the Panda Activescan make sure you click the Free Online Virus Scan in the upper right hand corner of the page under the Free use Activescan header. You do NOT want the default spyXposer scan.

Once it has finished save the Activescan log. Then post that log in your next post.

Please run ALL the free scans offered by Housecall.

Make sure they both perform full system scans.

If either/both scans find something they cannot fix - perhaps because the infected files are "in use" - please make a note of the file(s) concerned and post the details back to this thread.

Please post a fresh HijackThis log so that we can check if your system is clean.

MOST IMPORTANTLY…..

Please also give us an update on how your system is operating now.