Trouble with PC not sure if it's a virus

By silveriris
Aug 24, 2008
Topic Status:
Not open for further replies.
  1. Hi,

    I am having trouble with my pc, there is a process that is contiously running which is slowing down my pc. It of course happens after boot up, but it also starts on it's own in the middle of the day and makes it impossible to work. I though it might be a virus but honestly not sure. I reformated earlier this year..

    I have gone through the preliminary virus removal instructions.

    PC Info:
    Win XP home edition with sp2
    AMD Sempron(tm)
    1.47GHz, 256 mb of RAM

    I've attached the HJT, Combofix, MBAM nad SAS logs... (sorry that makes 4 ;) )

    Panda Antirootkit scan results were no toolkits found :)

    Let me know if you need something else...

    Any help you can give me would be much appreciated, I am in a position where I really need to use my personal pc.. :(

    thanks, SilverIris

    Attached Files:

  2. leadpill42

    leadpill42 Newcomer, in training

    Seems like you need to upgrade parts of your pc. It looks a bit out of date and might not be able to keep up.
  3. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    Considerations: It appear that you are running both Network Associates (McAfee) and AVG v8 which also is antivirus program. Decide which you want and uninstall the other.

    Looks like running the Java updater hasn't done much good- you are way way behind:
    Updater: C:\Program Files\Java\jre6\bin\jusched.exe

    Dowload the latest version which is v6u7 from here:
    http://www.java.com/en/download/manual.jsp

    You can unitall the old versions in Add/Remove Programs in the Control Panel.

    Turn off this Real Time program
    When the above have been handled, please run HijackThis again. I did not review the rest of the log or the other logs. You need to get the AV handled now and the Java updated.
  4. silveriris

    silveriris Newcomer, in training Topic Starter

    Hello Bob,

    Thanks for looking.

    I doubled checked, and I don't have McAfee installed. McAffee or Network Associates do not appear in add/remove programs. Let me know if there is anything you want me to check regarding the AV. Not sure why you are seeing two AVs.

    I did have the latest version of JRE however I think those were left over files from previous upgrades, so I uninstalled anyways and deleted any left over files and installed from the site you mentioned.

    I also uninstalled the Panda active scan.


    Just in case I've attached the HJT file.

    Thanks,
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    Well, I will have to wear a red face today! I saw "Network", made an incorrect assumption that it was Network Associates instead of Network Magic. My apology.

    I see Java is now current. mbam is clean, combofix deleted some files. SuperAntispyware turned up a gazillion Tracking Cookies, as expected with all the game entries. Have all of those deleted please.

    For that process that is running: when it happens, open the Task Manager (right click on Task Bar> Task Manager) and see which process is consuming much of the CPU. To sort the CPU column, double-click on the top frame of the column. That will sort in descending order- the highest numbers at the top.

    Reopen HijackThis and check these entries:
    Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis. Reboot into safe mode.

    Go to the Control Panel> Java> Update tab> UNCHECK 'automatically check for updates> answer Yes when you're asked if you're sure, then close.
    Access the Startup menu: Start> Run> type in 'msconfig' without the quotes> enter> Selective Startup> Star up tab: Uncheck the following:
    Apply> OK> Reboot into Normal mode> Close the nag message that comes up after checking 'don't show this message again'.

    Be sure to remove the Tracking Cookies. Post back with the name of the process(es) in the Task Manager that starts to run in the background.
  6. silveriris

    silveriris Newcomer, in training Topic Starter

    Bob,

    Thanks again...

    Ok I did as you asked.

    I deleted all the tracking cookies and fix checked the items you identified in HJT.

    qttask.exe and GoogleToolbarnotifier.exe were not in the start up tab (I assume that the fix check took them out, I also cleaned up my startup this weekend)

    Here are the processes running (wow lots).. Please note they are not in order of which ones using the most cpu. Also didn't know if there is a trick to cut and paste these so I have typed them out. Hopefully there are no typos ;)

    -------- List of running processs after bootup ----------
    taskmgr.exe
    ctfmon.exe
    SuperAntiSpyware.exe
    usnssvc.exe
    wuauclt.exe
    avgtray.exe
    alg.exe
    alclient.exe
    nmsrvc.exe
    aawservice.exe
    explorer.exe
    nmapp.exe
    svchost.exe
    vsmon.exe
    mcciCMSerive.exe
    svchost.exe
    avgwdsvc.exe
    AppliceMobileDeviceService.exe
    svchost.exe
    svchost.exe
    msnmsgr.exe
    svchost.exe
    mccitrayApp.exe
    lsass.exe
    services.exe
    winlogon.exe
    csrss.exe
    smss.exe
    avgrsx.exe
    spoolsv.exe
    system
    system Idle Process

    ------------------------------------------------------------

    I noticed that svchost.exe is there at least 6 times. Is this normal?

    Also when I have the problem with the pc performance, the processes taking the most CPU seem to be:

    wuauclt.exe, mcci (not sure which of the two), svchost.exe, iexplorer..

    I will keep a closer eye on the processes.

    My PC has been running a bit better over the weekend since I updated the startup and completed the prelimary removal steps. I will continue to monitor...

    Do you recommend that I increase the privacy settings in IE to better control the cookies? I believe I was set to Med/High. Which setting would you recommend?

    I really appreciate your time... Let me know if there is anything else you think I should check or information you may need.

    Regards,

    SilverIris (aka..Natalie)
  7. silveriris

    silveriris Newcomer, in training Topic Starter

    FYI .. I just had the problem where processes where going nuts :(

    The processes which were using most of the cpu were : explorer.exe, mccitrayapp, system and I also got dumpprep.exe...
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    Blocking Third Party Cookies

    Yes. I usually have around 9.
    Leave the security setting where it is. But you should block or prompt for third party Cookies. First Party is for the site itself, Third Party is for all the ads, partners and 'junk':
    Open IE> Tools> Internet Options> Privacy tab> Advanced> check 'allow' for 1st party, 'block' for 3rd party, check 'always allow per session Cookies'.

    Another way to control the Cookies is by restricting the Domain they come from:
    Internet Options> Security tab> Restricted sites> Sites> each domain can be typed in one at a time and Added to the blocked sites: like this:

    For Internet Explorer: Tools> Internet Options> Security tab> Restricted Sites> Sites> type the Tracking Cookie Domain in and Add.

    Some others you might want to Add:
    Common Tracking Cookies:
    .112.2o7.net
    *.180solutions
    .2o7.net
    .ad.lookery
    *.ad.yieldmanager.com
    .adrevolver.com
    ads.monster.com
    .ads.pointroll.com
    .advertising.com
    *.atdmt.com
    .bluestreak.com
    *.casalemedia.com
    .doubleclick.net
    .fastclick.net
    .mediaplex.com
    .realmedia.com
    *.rightmedia
    .specificclick.net
    .statcounter.com
    .tacada.net
    .tacada.com
    .trafficmp.com
    .tribalfusion.com
    *.zango.com

    Type each in exactly as shown. The use of the * acts as a wild card to block anything from that Domain> Add.
    You only have to do this once. IF you get a message that it is already in another zone, open the Trusted sites and remove it from there, then add to Restricted.
  9. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    You should be able to identify most of those processes here:
    http://www.bleepingcomputer.com/startups/

    You can also use these:
    STARTUP APPLICATION DATABASE LIST
    http://www.answersthatwork.com/Tasklist_pages/tasklist.htm
    http://www.sysinfo.org/startuplist.php

    explorer.exe> is the Windows Program Manager or Windows Explorer.

    McciTrayApp.exe> Tray icon for Bell South broadband customers which can be used to diagnose and repair connection and hardware problems. This software is rebranded software from Motive

    If you have McciTrayApp.exe on the Startup Menu, you can uncheck it as it does not need to start at boot and run in the background. The process will show this in the Command Column on Startup: C:\Program Files\BellSouthWCC\

    dumpprep.exe> Dumpprep.exe is a Microsoft Dump Reporting Tool, a part of Windows Operation System.
    It is used to prepare error report after system or program crash. Dumpprep may be disabled via Control Panel, System, Additional, Error Reporting dialog. This process does not need to be running.

    MCCI Exe> associsted with PDAPhoneHome. (Verizon)

    iexplore.exe> Internet Excplorer

    wuauclt.exe> is a process managing automatic updates for Microsoft Windows

    For high usage by the 'System' process, please review this:
    How to troubleshoot configuration errors by using the System Configuration utility in Windows XP
    http://support.microsoft.com/kb/310560

    This should be of great help. This process should not be using high CPU.
  10. silveriris

    silveriris Newcomer, in training Topic Starter

    Bob,

    Thank you so much for all the help, you are amazing. I will go through all the information you provided. The PC is already running better from all the help and information I got from this site and of course with your help.

    I will be more deligent about the sites I visit (games)...

    Thanks,
  11. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +35

    You're welcome. Let us know if you need more help.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.