This thing is no more than a couple years old. It belongs to my fiancee, I try to keep it running good. But lately its been running very slow. She uses it mostly for school but she also hooks it up to the net and does her browsing, sometimes she does some downloading, questionable things I think.

As I type this I have system checks going, Norton was just finished, Ad-Aware was updated and is running then search and destroy will run. Then the Hijackthis log will folow.

Here is the system info:

Windows XP Home SP1
HP Pavilion ze4400
AMD Athlon XP 1789MHz
192 MB PC2100 DDR SDRAM (I know, 192? She was ripped off I think)
40GB 4200RPM with roughly 20GB free

When I go into the Windows Task Manager it shows at the bottom 41 Processes running. Some of them I am not sure if htey need to be running. The CPU usage idles at 2-4% but will go up to 10 or 15% for a second or two. I have also seen it spike upto 86% for about a second once.

Another problem she has been having, and I dont understand, is when she opens up MS Word (office XP) it will shut down after it loads. It works fine on my computers but not the laptop. She did a system restore, never done one before, and it ran okay after but started shutting down again. This is the only program it does this to.

She has a RF mouse installed so that my show up in the log.
Well here is the Log:

Anyone?

I found this looking around.
http://www.bleepingcomputer.com/foru...howtutorial=42
I think I may give it a shot.

Boot in Safe Mode
Switch off System Restore
Press ctrl/alt/del and in Taskmanager try to STOP: (note the spelling!)
msnmsgr.exe

Next, try to uninstall anything to do with:
C:\Program Files\MSN Messenger\msnmsgr.exe

Next, run HJT on its own and let it 'fix' if still there:
C:\Program Files\MSN Messenger\msnmsgr.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us8l.hpwis.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us8l.hpwis.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O14 - IERESET.INF: START_PAGE_URL=http://us8l.hpwis.com
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn...detection3.cab

When done, delete the directory C:\Program Files\MSN Messenger with everything in it.
Boot normal.
If all OK, put System Restore back on.

Thanks I'll try this as soon as I get home.

Is MSN messenger really that bad? I have no problem with removing it, I just see it being removed everywehre.

That is NOT the MS messenger but a spyware/malware version!
The real McCoy is C:\Program Files\messenger\msmsgs.exe
Look at the spelling and directory-name

I see.

I got it all done and ran it again
Does it make a difference weather or not I turn on the system restore?

Attached Files

hijackthis.txt (6.4 KB, 7 views)

Looks clean to me.
System Restore will contain the spyware/adware that you try to remove. If you DO have to go back for one reason or another, you are back to square one.
By switching off, you delete all restore points, including all the ones that have the spyware/adware in them.

I find registryfixer.weebly.com very useful, great little program