system idle process at 97%

naz101

so i have runit and it says it has only scanned 222 files??? it has found nothing....

naz101

total 779338
limit 2536732
peak 850212

closed

If you follow it in order, it's quite simple and apart from the virus scanning (which you can do at the end) won't take long, post if you get stuck.

The rootkit can be tricky to remove, try a scan with malwarebytes and kaspersky if tdsskiller didn't find anything

Hammyman

naz101 wrote: »

When I bring up task manager, it says that firefox is either running at 90% or system idle process is at 97%...even when I am trying to do something.

If it says System Idle Process is at 97%, it means that the CPU usage is only 3% so barely ticking over. Firefox can run that high if you've got flash adverts running on a webpage, viewing youtube etc.

naz101

ok currently installing malware finder thingy at the moment....heres hoping.....

umm that was a bad idea to say post here if I get stuck...you have no idea how dense i am with these things....:p

closed

while it's scanning, start from here

Install and run ccleaner (untick the google toolbar during the install). Untick the "windows log files" box, under the system heading before cleaning. Also Tick the java cache tick box under CCleaner, applications, internet to wipe the java cache which sometimes hides infections. http://www.piriform.com/ccleaner/download/slim

Install and run startuplite, accept suggested changes - http://www.malwarebytes.org/StartUpLite.exe

Disable ctfmon - control panel, regional and language options,languages, details, advanced, tick the Turn off advanced text services, ok

Click the java icon in control panel, advanced, misc - untick java quick starter, and untick place icon in task bar

Click the java icon in control panel, updates, untick check for updates

click start, run,

msconfig

ok

Unless you need them running all the time, use the startup tab in msconfig to disable these items from running at startup (they can always be run manually if needed)

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\adobe\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] J:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "G:\sony ericsson pc suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [TomTomHOME.exe] "J:\tomtom\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Mobile Connectivity Suite] "C:\Program Files\HTC\HTC Sync\Application Launcher\Application
O4 - HKCU\..\Run: [doubleTwist] C:\Program Files\doubleTwist 2.0\DoubleTwist.DeviceHelper.exe
O4 - Startup: Eposter Application.lnk = G:\BAOMS poster\Eposter Application\Eposter Application.exe

naz101

ok so in the first 30000 files it has found 14 files infected but I cnat see what they are yet.

I am trying to install ccleaner but firefox has just crashed.....
am going to try and close down firefox and start again.

debitcardmayhem

closed wrote: »

************************************************

These are possible signs of a rootkit or trojan/adware/undesirable software infection or it's remnants, try scanning with tdsskiller/kaspersky/malwarebytes to fix

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
************************************************

Just an aside closed why does this suggest as you say above??

closed

when it's finished, make sure you let malwarebytes fix them otherwise you will have to scan again

debitcard, only usually get that on an infected system, possibly partially cleaned up

naz101

since you have mentioned it, im sure my computer started running slowly when a trojan was detected, or there may have been 2. i ran nortons and spybot which said it had been removed ...but maybe not comletely?

like i said something has been found.

could this be the reason why i was getting so many tracking cookies?