CPU Usage high, No Processes using more than 0%

[momok]

Your log is looking alot cleaner. How is your system running now?

 

[LookinAround]

Momok

I’m not getting any hits for this GID 24869047-0A6A-1033-0624-050513200001 don't know if you recognize it?​

akshay_leo
Am I correct to understand from your last statement your system is still hanging at times??

1. going from 512MB -> 1MB or 1.5MB usually not a lot of $$ and u’d see improvement. But not at all clear is the source of current problem
2. Does your problem begin soon after reboot? Or take awhile before it starts.
3. Your comments indicated you had trouble goin through all the steps. Could you verify you installed CCleaner and ran it?
4. Please click Start->Run, enter eventvwr.msc
   • Click System in left pane. Then click View->Filter. Only check Warning and Error boxes. Hit OK. Click Action->Export List and save as a txt file
   • Then click on Application in left pane and export a .txt file for it too. Post both back here
5. Install Process Explorer Start it (kinda Task Manager on steroids). Now minimize it. Note you see green and red waves thru the box. Green is how busy your CPU is. Move the cursor over it. It reports CPU % busy along with busiest process and its % CPU usage. When your system hangs move your cursor over the box and see if it consistently reports the same process and report back here. about the process(es) that keep showing up (and approx vaues for CPU process %s just so we have an idea for quantifying it)

 

[momok]

Ah oops I missed out on those 2 entries. Yea they're definitely bad.

akshay: do fix these 2 entries too (do it in safe mode); not sure if you left them out. Post a fresh log from normal mode there after.
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{24869047-0A6A-1033-0624-050513200001}] "C:\Program Files\Common Files\{24869047-0A6A-1033-0624-050513200001}\Update.exe" te-110-12-0000059 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{24869047-0A6A-1033-0624-050513200001}] "C:\Program Files\Common Files\{24869047-0A6A-1033-0624-050513200001}\Update.exe" te-110-12-0000059 (User 'Default user')

 

[LookinAround]

And you can hold off on the items in my last post until after you see the results of removing those two O4 - HKUS entries

 

[akshay_leo]

Does your problem begin soon after reboot? Or take awhile before it starts.
Yes, mostly. The comp hangs half way through booting, or if it does boot properly, it is damn slow. After about 20-odd minutes, it gets normal (but normal is still not what it should be)

Your comments indicated you had trouble goin through all the steps. Could you verify you installed CCleaner and ran it?
Ya, I installed CCleaner and ran it. The others also I have installed but am unable to run them, as the comp hangs while the scan is on. So I have to repeat the whole process.

Eventvwr logs have been attached.

When your system hangs move your cursor over the box and see if it consistently reports the same process and report back here. about the process(es) that keep showing up (and approx vaues for CPU process %s just so we have an idea for quantifying it)
If the system hangs, I cant move my mouse so how will I be able to move my mouse over anything.

Also, fixed those 2 entries.

Basically, I have done all the following but the problem exists. Today, am planning to try a 2GB RAM and check if the problem still persists.

 

[momok]

Hi,

Could you download and run Deckard's System Scanner from HERE?
It will produce two logs: main.txt and extra.txt
Attach both in your reply, thanks.

Thanks to Blind Dragon for the suggestion

 

[akshay_leo]

i got new ram (1gb), changed page size on a friend's advice.. and uninstalled avast and got myself avg..
and the system is really fast now..

still the HJT log is attached.. pls check it and tell me if everything seems ok?

 

[LookinAround]

:grinthumb Looks clean to me!! And nice you have a fast system again! enjoy

 

[Blind Dragon]

The other suggestion I made was that one of the infections you had is normally transmitted through USB drives or removable media (external hard drive, ect.) You need to run a scan on any of these type of drives to be sure. It is a dropper type script that will drop malicious files to your root drive.

You should definitely still run Deckard or at least run an online scan with Kaspersky online scanner to look for leftovers - there is no point in going through the effort of cleaning to have you get reinfected within a few weeks.