Re: CPU Spikes in svchost.exe
OK, i had to run in safe mode to do any of this but i managed to do the steps i was told to on my other thread. I had to Zip all of it cuz the site wouldnt take the OTL txt because of its size, so see the attachment, thanks! Please, never zip any logs, or attach them.
the comp wont let me, the site always times out before i can post them :C plus, like i said, one of the txt's was too big to post. i attached the ones i could. posting the last one here:========== Processes (SafeList) ========== ========== Modules (SafeList) ========== ========== Win32 Services (SafeList) ========== ========== Driver Services (SafeList) ========== ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== AOL.com - Welcome to AOL AOL.com - Welcome to AOL AOL.com - Welcome to AOL iGoogle ========== FireFox ========== js ..browser.startup.homepage: "http://www.google.com/ig?hl=en"js ..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:3.6js ..extensions.enabledItems: {eeeeeeee-aaaa-0000-aaaa-000000000000}:3.1.2js ..extensions.enabledItems: savesession@noasobi.net :1.3.1.6js ..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2js ..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.13js ..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20js ..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198js ..extensions.enabledItems: {99a0337c-6303-4879-b72e-500fd9aaca8c}:1.0.8js ..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.91js ..network.proxy.no_proxies_on: "*.local"Pr ofiles\vjax0f5n.default\extensionsPr ofiles\vjax0f5n.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}Pr ofiles\vjax0f5n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}Pr ofiles\vjax0f5n.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}Pr ofiles\vjax0f5n.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}Pr ofiles\vjax0f5n.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}Pr ofiles\vjax0f5n.default\extensions\{eeeeeeee-aaaa-0000-aaaa-000000000000}Pr ofiles\vjax0f5n.default\extensions\savesession@noa sobi.netPr ofiles\vjax0f5n.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensionsPr ofiles\vjax0f5n.default\searchplugins\ask.uk.xmlwww.antivirussyspr2009.com http://appldnld.apple.com.edgesuite....x/qtplugin.cab (QuickTime Object)http://download.microsoft.com/downlo...eckControl.cab (Windows Genuine Advantage Validation Tool)http://messenger.zone.msn.com/binary...r.cab56986.cab (Checkers Class)https://h20436.www2.hp.com/ediags/de...e/HPDEXAXO.cab (HP Download Manager)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_20)http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)http://messenger.zone.msn.com/binary...t.cab56907.cab (MessengerStatsClient Class)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_02)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_20)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_20)http://messenger.zone.msn.com/binary...r.cab56986.cab (Minesweeper Flags Class)http://hp.vector.co.jp/authors/VA012897/ )========== Files/Folders - Created Within 90 Days ========== ========== Files - Modified Within 90 Days ========== ========== Files Created - No Company Name ========== ========== LOP Check ========== ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > < %systemroot%\Fonts\*.com > < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > < %systemroot%\Fonts\*.ini2 > < %systemroot%\Fonts\*.exe > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.jpg > < %systemroot%\*.png > < %systemroot%\*.scr > < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\System32\config\*.sav > < %PROGRAMFILES%\bak. /s > < %systemroot%\system32\bak. /s > < %ALLUSERSPROFILE%\Start Menu\*.lnk /x > < %systemroot%\system32\config\systemprofile\*.dat /x > < %systemroot%\*.config > < %systemroot%\system32\*.db > < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x > < %USERPROFILE%\Desktop\*.exe > < %PROGRAMFILES%\Common Files\*.* > < %systemroot%\*.src > < %systemroot%\install\*.* > < %systemroot%\system32\DLL\*.* > < %systemroot%\system32\HelpFiles\*.* > < %systemroot%\system32\rundll\*.* > < %systemroot%\winn32\*.* > < %systemroot%\Java\*.* > < %systemroot%\system32\test\*.* > < %systemroot%\system32\Rundll32\*.* > < %systemroot%\AppPatch\Custom\*.* > < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x > < %PROGRAMFILES%\PC-Doctor\Downloads\*.* > < %PROGRAMFILES%\Internet Explorer\*.tmp > < %PROGRAMFILES%\Internet Explorer\*.dat > < %USERPROFILE%\My Documents\*.exe > < %USERPROFILE%\*.exe > < %systemroot%\ADDINS\*.* > < %systemroot%\assembly\*.bak2 > < %systemroot%\Config\*.* > < %systemroot%\REPAIR\*.bak2 > < %systemroot%\SECURITY\Database\*.sdb /x > < %systemroot%\SYSTEM\*.bak2 > < %systemroot%\Web\*.bak2 > < %systemroot%\Driver Cache\*.* > < %PROGRAMFILES%\Mozilla Firefox\0*.exe > < %ProgramFiles%\Microsoft Common\*.* > < %ProgramFiles%\TinyProxy. > < %USERPROFILE%\Favorites\*.url /x > < %systemroot%\system32\*.bk > < %systemroot%\*.te > < %systemroot%\system32\system32\*.* > < %ALLUSERSPROFILE%\*.dat /x > < %systemroot%\system32\drivers\*.rmv > < dir /b "%systemroot%\system32\*.exe" | find /i " " /c > < dir /b "%systemroot%\*.exe" | find /i " " /c > < %PROGRAMFILES%\Microsoft\*.* > < %systemroot%\System32\Wbem\proquota.exe > < %PROGRAMFILES%\Mozilla Firefox\*.dat > < %USERPROFILE%\Cookies\*.txt /x > < %SystemRoot%\system32\fonts\*.* > < %systemroot%\system32\winlog\*.* > < %systemroot%\system32\Language\*.* > < %systemroot%\system32\Settings\*.* > < %systemroot%\system32\*.quo > < %SYSTEMROOT%\AppPatch\*.exe > < %SYSTEMROOT%\inf\*.exe > < %SYSTEMROOT%\Installer\*.exe > < %systemroot%\system32\config\*.bak2 > < %systemroot%\system32\Computers\*.* > < %SystemRoot%\system32\Sound\*.* > < %SystemRoot%\system32\SpecialImg\*.* > < %SystemRoot%\system32\code\*.* > < %SystemRoot%\system32\draft\*.* > < %SystemRoot%\system32\MSSSys\*.* > < %ProgramFiles%\Javascript\*.* > < %systemroot%\pchealth\helpctr\System\*.exe /s > < %systemroot%\Web\*.exe > < %systemroot%\system32\msn\*.* > < %systemroot%\system32\*.tro > < %AppData%\Microsoft\Installer\msupdates\*.* > < %ProgramFiles%\Messenger\*.* > < %systemroot%\system32\systhem32\*.* > < %systemroot%\system\*.exe > < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > ========== Alternate Data Streams ==========
Last edited by DrewtheMew; 03-10-2010 at 12:23 AM .
Reason: smileys in text that werent intended
You can post one log per reply, if the length is the issue....========== Extra Registry (SafeList) ========== ========== File Associations ========== ========== Shell Spawning ========== ========== Security Center Settings ========== ========== Firewall Settings ========== ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== ========== Vista Active Application Exception List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== ========== HKEY_CURRENT_USER Uninstall List ========== ========== Last 10 Event Log Errors ========== Hotmail, Free Online News, Sport, Music, Movies, Money, Cars and Windows Live from MSN UK prior to filing a bug.; Win32 GetLastError returned 10000109Hotmail, Free Online News, Sport, Music, Movies, Money, Cars and Windows Live from MSN UK prior to filing a bug.; Win32 GetLastError returned 10000109Malwarebytes GMER - Rootkit Detector and Remover
Download HostsXpert ( |MG| HostsXpert 4.3 Download ) and then follow the steps below:HostsXpert.zip HostsXpert.exe by double clicking on it (Vista and Windows 7 users, right click and click "Run As Administrator").Restore MS Hosts File and then click OK.X to exit the programHere Here **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop** Please, never rename Combofix unless instructed. Close any open browsers. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Very Important! disable your anti-virus , script blocking and any anti-malware real-time protection before "unpredictable results" .Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. NOTE1. Recovery Console NOTE 2. always do so .Close any open browsers. WARNING: Combofix will disconnect your machine from the Internet as soon as it startsPlease do not attempt to re-connect your machine back to the Internet until Combofix has completely finished. If there is no internet connection after running Combofix, then restart your computer to restore back your connection. Double click on combofix.exe & follow the prompts. When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall** Make sure, you re-enable your security programs, when you're done with Combofix. DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
OK heres the combofix log, still running in safe mode btw. should i try running normally yet? Let me check your log first.....drewthemew@hotmail.com }\spore_ep1_dd.zip\support\eadm-installer.exedrewthemew@hotmail.com }\spore_ep1_dd.zip\support\SPORE Galactic Adventures_code.exedrewthemew@hotmail.com }\spore_ep1_dd.zip\_setup.dlldrewthemew@hotmail.com }\spore_ep1_dd.zip\support\SPORE Galactic Adventures_uninst.exedrewthemew@hotmail.com }\spore_ep1_dd.zip\Spore\SporebinEP1\SporeApp.exedrewthemew@hotmail.com }\spore_ep1_dd.zip\Spore\SporebinEP1\winui.dlldrewthemew@hotmail.com }\spore_ep1_dd.zip\Spore\SporebinEP1\msvcr90.dlldrewthemew@hotmail.com }\spore_ep1_dd.zip\Spore\SporebinEP1\msvcr80.dlldrewthemew@hotmail.com }\spore_ep1_dd.zip\Spore\SporebinEP1\DMCmdPortalCl ient.dlldrewthemew@hotmail.com }\spore_ep1_dd.zip\Spore\SporebinEP1\paul.dlldrewthemew@hotmail.com }\spore_ep1_dd.zip\ISSetup.dlldrewthemew@hotmail.com }\spore_ep1_dd.zip\setup.exedrewthemew@hotmail.com }\spore_ep1_dd.zip\Autorun.exePr ofiles\vjax0f5n.default\js : browser.startup.homepage - hxxp://www.google.com/ig?hl=enjs - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); js - pref("dom.ipc.plugins.enabled", false);GMER - Rootkit Detector and Remover
Looks good
running the scan now, still having the svchost sapping the cpu...
Updated and clean, problem persists. :Cwww.malwarebytes.org
Last edited by DrewtheMew; 03-10-2010 at 02:41 AM .
Reason: Forgot log
Junior Member
Re: CPU Spikes in svchost.exe 24 PM | Computer Name = HAL-9001 | Source = DCOM | ID = 10005
