Tom's Guide | Tom's Hardware | Tom's Games

Computing.Net > Forums > Windows XP > Advice please - explorer.exe @ 99%

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Advice please - explorer.exe @ 99%

Reply to Message Icon

Name: Forethought
Date: March 31, 2004 at 12:30:53 Pacific
OS: Win XP Pro SP1
CPU/Ram: 2 ghz AMD, 1gb dual chann
Comment:


I've reviewed the other posts on this issue and it appears that the answer may be a little different for each user so I'd appreciate some **expert** advice.

The problem began after opening a file that had scanned OK w/NAV. The file immediately initiated a browser/web call and I shut down access with ZoneAlarm Pro but the damage was done. Next reboot saw 99% explorer.exe CPU utilization and trying to restore to previous point resulted in a "log-in/log-off loop" (e.g. "Windows is loading settings" immediately followed by "Windows is saving settings")

I performed an XP Repair Install and recovered the basic system but explorer.exe remains at 99%. Appklication access is possible only through the Command line.

I rebooted system with Selective Start allowing required files only but CPU utilization remains at 99%. A HijackThis log is available of this boot.

Any help is MOST appreciated. Thank you in advance for your assistance.


John
Redondo Beach, CA



Sponsored Link
Ads by Google

Response Number 1
Name: Solarian
Date: March 31, 2004 at 12:52:22 Pacific
Reply:

John:

It's entirely possible that something slipped through NAV. Have you scanned your system with other utilities? Also examine your Task Manager to see if it's listing something that shouldn't be there.

Solarian


0

Response Number 2
Name: Baz.
Date: March 31, 2004 at 13:32:46 Pacific
Reply:

Have you run ad/spyware removers, sounds like a run of the mill problem.


0

Response Number 3
Name: Abnormal
Date: March 31, 2004 at 16:47:19 Pacific
Reply:

Post your log, 100% CPU hijack is not good.
I will look at it.


DO NOT post a HiJackThis log here unless an expert has requested it. Instead, please ask in plain english about what is wrong with your computer.


0

Response Number 4
Name: Forethought
Date: March 31, 2004 at 20:40:04 Pacific
Reply:

I'm just leaving the office - will post the Hijack Log in about 45 miniutes.

I changed explorer.exe priority to Low, which allowed Ad-Aware 6 and SpyBot S&D to run successfully - they found nothing.

Selective Start is still active so nothing is being loaded (that I can see) and, of course, Task Manager application pane is clean (I don't see anything out of the ordinary in Processes either.)

I suspect explorer.exe was hijacked by a rougue .dll but haven't found it yet although I'm suspicious of a couple of the Hijack entires.

I'll be **very** interested to hear what you think! The Hijack log is on it's way in about 45 minutes.

TIA.....

..... John

John
Redondo Beach, CA


0

Response Number 5
Name: Forethought
Date: March 31, 2004 at 21:50:22 Pacific
Reply:

Abnormal --

(Like the moniker...but are you certain it's not A B Normal?)

Here's the Hijack log...THANKS for your help!

********************************************

Logfile of HijackThis v1.97.7 - forethought@adelphia.net

Scan saved at 12:04:58 PST, on 03/31/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\taskmgr.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
A:\hijackthis1977\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {040023E4-C167-4B73-A078-316BC1E848EE} - C:\WINDOWS\f2g3rcDaF.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Popup Manager - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI699F~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)

O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe

O16 - DPF: {47F591A2-8783-11D2-8343-00A0C945A819} (RFXPlayer Class) - http://download.richfx.com/player/mediaversion/005/latest/twophase.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/04f2d36b547905fe6422/netzip/RdxIE601.cab

O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab

O16 - DPF: {65B818E1-F4D8-4F96-A1DF-35F3D1C86194} (limmyloding.limmyform) - http://bins.roings.com/roing.cab

O16 - DPF: {73954DC6-A1B2-4157-966F-D9914A39F59C} (Vividence Connector Launcher) - http://task.vividence.com/download/ConnectorLauncher.cab

O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs5b.instantservice.com/jars/customerxsigned32.cab

O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://zinio.earthc.net/images.zinio.com/reader/isetup.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37864.7976967593

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -

O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.dll

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://honda.webex.com/client/latest/webex/ieatgpc.cab

O16 - DPF: {E4C5D394-E44C-43F9-BE9D-ACB344936B8A} (Project1.UserControl1) - http://www.roings.com/p.cab

O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab

O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/crack.CAB

O16 - DPF: {F5C90925-ABBF-4475-88F5-8622B452BA9E} (Compaq System Data Class) - http://atwnt333.external.hp.com/bus-nacons/caller/SysQuery.cab

John
Redondo Beach, CA


0

Related Posts

See More



Response Number 6
Name: Abnormal
Date: March 31, 2004 at 22:14:46 Pacific
Reply:

Hi John,

First, move Hijack This to a permanent directory like c:\program files\hijack this\hijackthis.exe. This way we can make backups if something goes wrong.

Put a check next to these, click "fix checked" and reboot.

O2 - BHO: (no name) - {040023E4-C167-4B73-A078-316BC1E848EE} - C:\WINDOWS\f2g3rcDaF.dll

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/04f2d36b547905fe6422/netzip/RdxIE601.cab

O16 - DPF: {65B818E1-F4D8-4F96-A1DF-35F3D1C86194} (limmyloding.limmyform) - http://bins.roings.com/roing.cab

O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://download.rfwnad.com/cab/crack.CAB

Above 016 lines prevented with Spywareblaster, this I will pass on to Javacool, remove also.

O16 - DPF: {E4C5D394-E44C-43F9-BE9D-ACB344936B8A} (Project1.UserControl1) - http://www.roings.com/p.cab

Good luck



0

Response Number 7
Name: Abnormal
Date: March 31, 2004 at 22:18:28 Pacific
Reply:

Forgot one;

O2 - BHO: Popup Manager - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - (no file)

you also need to Update IE to version 6sp1
http://v4.windowsupdate.microsoft.com


0

Response Number 8
Name: Forethought
Date: April 1, 2004 at 10:58:20 Pacific
Reply:

Abnormal --

Thanks - it worked! I'd identified all but one of the entries you listed, but it sure was a relief to see that someone much more skilled than I came to the same conclusion!

I had to do an XP repair install to correct the "log-on loop" problem and haven't yet applied any XP updates, including IE6 SP1. I will do so as soon as I reconfigure the internet connection.

I will also remove SpyBot S&D and install SpyWare Blaster, Spyware Guard and the MP scripting patch as soon as XP is fully uodated (and donate to Javacool Software).

Thanks again for your help!

Best regards,

......John


John
Redondo Beach, CA


0

Response Number 9
Name: Abnormal
Date: April 1, 2004 at 11:34:13 Pacific
Reply:

Hi John, SpyBot is great tool, just some
things they can't remove.

The line in red is always different, a
search for it will take you here.
Glad we fixed it, some more tips under my
internet name.


Take care, from Chicago


0

Response Number 10
Name: mystik
Date: April 4, 2004 at 15:22:55 Pacific
Reply:

hello, im having the same problem. My explorer.exe goes up to 99% everytime i open a folder or leave my comp idle. and it has been affecting my computer. And i cant get rid of it i already tried reinstalling my os.. and that didnt work now i might just have to reformat and start from scratch again which i really dont want to do. so does anyone know the solution to the problem with my comp..

i got a hijackthis log if anyone would like to check it out


0

Response Number 11
Name: Abnormal
Date: April 5, 2004 at 19:40:01 Pacific
Reply:

I will look, post your log.


0

Response Number 12
Name: mystik
Date: April 6, 2004 at 15:15:59 Pacific
Reply:

heres my log created by hijackthis...

Thankx for your time Abnormal..

Logfile of HijackThis v1.97.7
Scan saved at 3:16:33 PM, on 4/4/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\toolbars\y's_dock_bar left\Y'S TOP BAR\y's dock\YzDock.exe
C:\toolbars\y's_dock_bar right\Y'S TOP BAR\y's dock\YzDock.exe
C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\Program Files\Soulseek\slsk.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\DAP\DAP.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\MystiK\My Documents\Web Downloads\spywareinfo.com\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O4 - HKLM\..\Run: [ATIPTA] C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.exe
O4 - HKLM\..\Run: [PC Booster] C:\Program Files\inKline Global\PC Booster\pcbooster.exe
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ATI Launchpad] C:\Program Files\ATI Multimedia\main\launchpd.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Startup: ATI Remote Wonder.lnk = ?
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Trace (HKLM)
O9 - Extra 'Tools' menuitem: VisualRoute Trace (HKLM)
O9 - Extra button: ATI TV (HKLM)
O9 - Extra button: Run DAP (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37984.9820717593
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6AAB9A99-ADA4-4570-8757-D9079EA4BD63}: NameServer = 192.168.1.1


0

Response Number 13
Name: Abnormal
Date: April 6, 2004 at 18:41:43 Pacific
Reply:

Hi mystik,
I can't find anything bad in your log.

Sorry I can't help you, I wish you luck.


0

Response Number 14
Name: mystik
Date: April 8, 2004 at 08:02:31 Pacific
Reply:

its allright thanx for your time..


0

Response Number 15
Name: Abnormal
Date: April 8, 2004 at 08:23:23 Pacific
Reply:

Your welcome.


0

Response Number 16
Name: liatonly
Date: April 28, 2004 at 15:43:06 Pacific
Reply:

hi' i have the same problem with roings' here is my log. i will be very very happy to an answer.

thanks!

Logfile of HijackThis v1.97.7
Scan saved at 01:28:51, on 29/04/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\Explorer.exe
E:\WINDOWS\system32\LEXBCES.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\LEXPPS.exe
E:\PROGRA~1\Grisoft\AVG7\avgcc.exe
E:\WINDOWS\System32\LXSUPMON.exe
E:\WINDOWS\System32\ctfmon.exe
E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\system32\pctspk.exe
E:\WINDOWS\System32\svchost.exe
G:\e Mule\eMule.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\Internet Explorer\IEXPLORE.exe
E:\Program Files\Internet Explorer\IEXPLORE.exe
E:\Program Files\SpywareGuard\sgmain.exe
E:\Program Files\SpywareGuard\sgbhp.exe
C:\Downloads\HijackThis.exe

O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - E:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.exe E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [LXSUPMON] E:\WINDOWS\System32\LXSUPMON.exe RUN
O4 - HKLM\..\Run: [MSConfig] E:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [PPMemCheck] E:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] E:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] E:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = E:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = E:\Program Files\GetRight\getright.exe
O8 - Extra context menu item: &Google Search - res://E:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://E:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://E:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download with GetRight - E:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - E:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Si&milar Pages - res://E:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://E:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Research (HKLM)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab
O16 - DPF: {346685E3-C383-11CF-A5A4-00AA00A45705} (ActiveX Control) - http://imd.gonext.co.il/gonext/zazabox/pc/SISActiveX.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38102.5088541667
O16 - DPF: {B3A5878E-5B4C-4D12-9156-4D7FD8D0AF6C} (Cltbuilder Class) - http://akamai.downloadv3.com/binaries/one2one/one2oneSvcEN.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{20D93593-717B-4FD3-9B8A-F9FCDC3C2CE8}: NameServer = 212.150.48.169 206.49.94.234
O17 - HKLM\System\CS1\Services\Tcpip\..\{20D93593-717B-4FD3-9B8A-F9FCDC3C2CE8}: NameServer = 212.150.48.169 206.49.94.234
O17 - HKLM\System\CS2\Services\Tcpip\..\{20D93593-717B-4FD3-9B8A-F9FCDC3C2CE8}: NameServer = 212.150.48.169 206.49.94.234


0

Sponsored Link
Ads by Google
Reply to Message Icon



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Windows XP Forum Home


Sponsored links
Ads by Google


Results for: Advice please - explorer.exe @ 99%
WinXP - Explorer.exe @ 99% usage... www.computing.net/answers/windows-xp/winxp-explorerexe-99-usage/57597.html

explorer.exe at 99% www.computing.net/answers/windows-xp/explorerexe-at-99/91502.html

explorer.exe uses 99% of CPU www.computing.net/answers/windows-xp/explorerexe-uses-99-of-cpu/20536.html