I think I have a viurs...
#1
I think I have a viurs...
First off, I'm a total computer n00b...
My year-old Dell Latitude D610 has been acting very strange lately.
ITunes constantly encounters errors and needs to close.
When I close a window of anything, sometimes parts of it will remain on the screen.
Certain programs take FOREVER to load.
Sometimes, I'll hit Ctrl-Alt-Delete when a program is not responding. There are 45 applications, and the CPU usage is steady at 100%.
Any ideas? Please please help!
My year-old Dell Latitude D610 has been acting very strange lately.
ITunes constantly encounters errors and needs to close.
When I close a window of anything, sometimes parts of it will remain on the screen.
Certain programs take FOREVER to load.
Sometimes, I'll hit Ctrl-Alt-Delete when a program is not responding. There are 45 applications, and the CPU usage is steady at 100%.
Any ideas? Please please help!
#2
what AV software do you ahve on it? when was the last time you did a virus defention update? when was it last scanned for virus? spyware?
Run:
Spybot S&D
Windows Defender / Spyware removal
HiJack This
also try:
taking a look at the processes running using a tool called Process Exlporer from Sysinterals. http://www.sysinternals.com/Utilitie...sexplorer.html it will tell you what the process is, who makes it, whats it doing, and when all else fails there is a built in google search button
when all else fails, back up data on external a harddrive, create a list of applications you have installed and that you use (i've learned from expirence this is a must do) and then reformat the hard drive and start fresh (this really shouldnt need to be done on a 1 year old laptop, unless you have NO AV software and its full of spyware / virus / trojans.)
Run:
Spybot S&D
Windows Defender / Spyware removal
HiJack This
also try:
taking a look at the processes running using a tool called Process Exlporer from Sysinterals. http://www.sysinternals.com/Utilitie...sexplorer.html it will tell you what the process is, who makes it, whats it doing, and when all else fails there is a built in google search button
when all else fails, back up data on external a harddrive, create a list of applications you have installed and that you use (i've learned from expirence this is a must do) and then reformat the hard drive and start fresh (this really shouldnt need to be done on a 1 year old laptop, unless you have NO AV software and its full of spyware / virus / trojans.)
#3
Originally Posted by ToferUOP
what AV software do you ahve on it? when was the last time you did a virus defention update? when was it last scanned for virus? spyware?
Run:
Spybot S&D
Windows Defender / Spyware removal
HiJack This
also try:
taking a look at the processes running using a tool called Process Exlporer from Sysinterals. http://www.sysinternals.com/Utilitie...sexplorer.html it will tell you what the process is, who makes it, whats it doing, and when all else fails there is a built in google search button
when all else fails, back up data on external a harddrive, create a list of applications you have installed and that you use (i've learned from expirence this is a must do) and then reformat the hard drive and start fresh (this really shouldnt need to be done on a 1 year old laptop, unless you have NO AV software and its full of spyware / virus / trojans.)
Run:
Spybot S&D
Windows Defender / Spyware removal
HiJack This
also try:
taking a look at the processes running using a tool called Process Exlporer from Sysinterals. http://www.sysinternals.com/Utilitie...sexplorer.html it will tell you what the process is, who makes it, whats it doing, and when all else fails there is a built in google search button
when all else fails, back up data on external a harddrive, create a list of applications you have installed and that you use (i've learned from expirence this is a must do) and then reformat the hard drive and start fresh (this really shouldnt need to be done on a 1 year old laptop, unless you have NO AV software and its full of spyware / virus / trojans.)
Windows Defender (Beta)
Symantec AntiVirus
Spybot SE
I scan it and update definitions, and it pretty much always comes up clean. But on certain web pages, they know where I live (you know the sites, showing models "that live in towns near me". They know my zip code.
I will follow your url. I'm XP Home, SP2, but is it 32 bit or 64 bit?
Thanks for the help!
Last edited by Georgia4Runner; Jun 14, 2006 at 04:30 PM.
#4
Try eWido... http://www.ewido.net/en/download/
Grisoft (AVG Antivirus) just bought 'em. You'll get the fully loaded suite for 14 days, then a stripped down version after that if you don't purchase. If you have any infections that can be removed by a scanner, eWido will do it.
If you're noticing something keeps coming back, you might have a rootkit. Post it's name here, and we'll see if we can get it removed. Most have to be done manually, and some require a reformat.
Grisoft (AVG Antivirus) just bought 'em. You'll get the fully loaded suite for 14 days, then a stripped down version after that if you don't purchase. If you have any infections that can be removed by a scanner, eWido will do it.
If you're noticing something keeps coming back, you might have a rootkit. Post it's name here, and we'll see if we can get it removed. Most have to be done manually, and some require a reformat.
#5
Another thumbs up for Ewido. Until recently, I was having issues with a Trojan Horse (Trojan.Galapoper.A) and nothing, including Symantec's manual deletion method, worked. After doing some searching I read about Ewido...tried it and have had no problems since. I use it in conjunction with Spybot S&D, Ad-Aware and Spyware Blaster.
#6
the symptoms you list could be caused by lots of things, not just a virus or worm. since you say you're green at computers, half of what i'm suggesting won't be easy to do, but could help in numerous ways. btw not all of these would directly fix what you're experiencing, but together they would tend to clean up a lot of issues.
1) do a full virus scan using the latest engine and definitions
2) do a full spybot scan
3) defrag your hard drive
4) get a new hard drive if your primary (system) drive is > 75% full
5) disable unnecessary services
6) stop using IE
7) kill unnecessary cookies
8) know that sites that know where you are often are just decoding your public name by reverse lookup, to find where you are. this is a popular tool for online dating services, for instance.
9) delete unneeded activeX components
10) check your RAM. apps that die unexpectedly can be doing that due to bad memory modules (not always, of course, but that's common)
11) reinstall the apps that have problems, and see if that helps
12) review the list of running processes and kill off the ones that aren't needed
13) download and run sysinternals "autoruns" or other similar program like M$ sysinfo that allows you to review and selectively remove unwanted programs that run on startup
14) install and inoculate with spywareblaster
1) do a full virus scan using the latest engine and definitions
2) do a full spybot scan
3) defrag your hard drive
4) get a new hard drive if your primary (system) drive is > 75% full
5) disable unnecessary services
6) stop using IE
7) kill unnecessary cookies
8) know that sites that know where you are often are just decoding your public name by reverse lookup, to find where you are. this is a popular tool for online dating services, for instance.
9) delete unneeded activeX components
10) check your RAM. apps that die unexpectedly can be doing that due to bad memory modules (not always, of course, but that's common)
11) reinstall the apps that have problems, and see if that helps
12) review the list of running processes and kill off the ones that aren't needed
13) download and run sysinternals "autoruns" or other similar program like M$ sysinfo that allows you to review and selectively remove unwanted programs that run on startup
14) install and inoculate with spywareblaster
#7
Originally Posted by photoleif
1) do a full virus scan using the latest engine and definitions
I just installed ewido; will post with results.
2) do a full spybot scan
Done; doesn't pick up anything
3) defrag your hard drive
Done a few days ago
4) get a new hard drive if your primary (system) drive is > 75% full
It's about 40% full
5) disable unnecessary services
Not sure what you mean there...
6) stop using IE
Opera and Firefox for me; IE only when required
7) kill unnecessary cookies
Been done
8) know that sites that know where you are often are just decoding your public name by reverse lookup, to find where you are. this is a popular tool for online dating services, for instance.
Ahh, that's what that is. I hate that!!!
9) delete unneeded activeX components
Okay; I had to reinstall Macromedia...I'll look into that.
10) check your RAM. apps that die unexpectedly can be doing that due to bad memory modules (not always, of course, but that's common)
11) reinstall the apps that have problems, and see if that helps
12) review the list of running processes and kill off the ones that aren't needed
That's what I have trouble with. They all look legit; 45 processes. But one says "Intel" with the registered symbol. The other ones by Intel don't have that...
13) download and run sysinternals "autoruns" or other similar program like M$ sysinfo that allows you to review and selectively remove unwanted programs that run on startup
How do you do that?
14) install and inoculate with spywareblaster
Is this a free program?
I just installed ewido; will post with results.
2) do a full spybot scan
Done; doesn't pick up anything
3) defrag your hard drive
Done a few days ago
4) get a new hard drive if your primary (system) drive is > 75% full
It's about 40% full
5) disable unnecessary services
Not sure what you mean there...
6) stop using IE
Opera and Firefox for me; IE only when required
7) kill unnecessary cookies
Been done
8) know that sites that know where you are often are just decoding your public name by reverse lookup, to find where you are. this is a popular tool for online dating services, for instance.
Ahh, that's what that is. I hate that!!!
9) delete unneeded activeX components
Okay; I had to reinstall Macromedia...I'll look into that.
10) check your RAM. apps that die unexpectedly can be doing that due to bad memory modules (not always, of course, but that's common)
11) reinstall the apps that have problems, and see if that helps
12) review the list of running processes and kill off the ones that aren't needed
That's what I have trouble with. They all look legit; 45 processes. But one says "Intel" with the registered symbol. The other ones by Intel don't have that...
13) download and run sysinternals "autoruns" or other similar program like M$ sysinfo that allows you to review and selectively remove unwanted programs that run on startup
How do you do that?
14) install and inoculate with spywareblaster
Is this a free program?
Trending Topics
#8
102 infected objects found using ewido!
Now off to run other spyware programs...
EDIT: Still not sure why my CPU usage is at 100%
Now off to run other spyware programs...
EDIT: Still not sure why my CPU usage is at 100%
Last edited by Georgia4Runner; Jun 14, 2006 at 06:28 PM.
#9
5) disabling unnecessary services entails start > run > services.msc and looking through the list for services there that aren't needed, such as telnet, indexing, windows time, and so on. i can't tell you which you don't need, since i don't know what you use your machine for, but generally speaking about 1/3 of the ones that are started can be disabled for most users. blackviper's site used to be up, but i think is now only available using archive.org -- he lists all the standard processes in gruesome detail and suggests which are needed or not.
9, 14) deleting bogus activeX components is useful if you run IE. wait. it's part of the OS, so we ALL RUN IT. grrrrrr. you can protect against these using spywareblaster, which yes is free. http://www.javacoolsoftware.com
12) 45 active processes is quite a pile. with excel, FF, IM, an MP3 player and an explorer window in its own process, i have 26 running, and wish i could be down in the 22 range, but oh well.
13) autoruns is available free from www.sysinternals.com, or you could run sysinfo if you have it installed. mine is located at "C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe"
9, 14) deleting bogus activeX components is useful if you run IE. wait. it's part of the OS, so we ALL RUN IT. grrrrrr. you can protect against these using spywareblaster, which yes is free. http://www.javacoolsoftware.com
12) 45 active processes is quite a pile. with excel, FF, IM, an MP3 player and an explorer window in its own process, i have 26 running, and wish i could be down in the 22 range, but oh well.
13) autoruns is available free from www.sysinternals.com, or you could run sysinfo if you have it installed. mine is located at "C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe"
#10
Originally Posted by photoleif
5) disabling unnecessary services entails start > run > services.msc and looking through the list for services there that aren't needed, such as telnet, indexing, windows time, and so on. i can't tell you which you don't need, since i don't know what you use your machine for, but generally speaking about 1/3 of the ones that are started can be disabled for most users. blackviper's site used to be up, but i think is now only available using archive.org -- he lists all the standard processes in gruesome detail and suggests which are needed or not.
9, 14) deleting bogus activeX components is useful if you run IE. wait. it's part of the OS, so we ALL RUN IT. grrrrrr. you can protect against these using spywareblaster, which yes is free. http://www.javacoolsoftware.com
12) 45 active processes is quite a pile. with excel, FF, IM, an MP3 player and an explorer window in its own process, i have 26 running, and wish i could be down in the 22 range, but oh well.
13) autoruns is available free from www.sysinternals.com, or you could run sysinfo if you have it installed. mine is located at "C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe"
9, 14) deleting bogus activeX components is useful if you run IE. wait. it's part of the OS, so we ALL RUN IT. grrrrrr. you can protect against these using spywareblaster, which yes is free. http://www.javacoolsoftware.com
12) 45 active processes is quite a pile. with excel, FF, IM, an MP3 player and an explorer window in its own process, i have 26 running, and wish i could be down in the 22 range, but oh well.
13) autoruns is available free from www.sysinternals.com, or you could run sysinfo if you have it installed. mine is located at "C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe"
Thanks for all the help!
#11
sorry i wasn't clear about archive.org. here's the link: http://web.archive.org/web/200503300...com/index.html
#13
Originally Posted by Georgia4Runner
102 infected objects found using ewido!
Now off to run other spyware programs...
EDIT: Still not sure why my CPU usage is at 100%
Now off to run other spyware programs...
EDIT: Still not sure why my CPU usage is at 100%
Originally Posted by photoleif
5) disabling unnecessary services entails start > run > services.msc and looking through the list for services there that aren't needed, such as telnet, indexing, windows time, and so on. i can't tell you which you don't need, since i don't know what you use your machine for, but generally speaking about 1/3 of the ones that are started can be disabled for most users. blackviper's site used to be up, but i think is now only available using archive.org -- he lists all the standard processes in gruesome detail and suggests which are needed or not.
Having too many processes running isn't a bad thing. My work laptop varies between 60-75 depending on what I'm doing. I'm spyware/virus free. Granted, most of that is IBM stuff.
My home laptop is around 45, and it is also virus/spyware free.
I agree with all of photolief's recommendations except for the services/process part... but that's really a personal preference thing more than any. His way and my way will both work.
#14
double-click the service, then use the dropdown box to switch it to manual. certain ones really ought to be disabled, such as indexing and telnet. xpsp2 finally disabled messenger, which contrary to the name has zilch to do with instant messaging. if you aren't running xpsp2, you should kill that service. also kill remote registry, which is a sechole waiting to happen. tcp/ip netbios is also extranneous and has ben exploited like crazy. disable that and as well get into your network stack and remove it there.
#15
i'm not saying you can or should disable all of these services, but here's my disable list. if you disable them and weird stuff starts happening, i'll just tell you to re-enable all of them and take it slower.
ClipBook
Distributed Link Tracking Client
DNS Client
Error Reporting Service
Event Log
Fast User Switching Compatibility
Help and Support
Human Interface Device Access
Indexing Service
IPSEC Services
Network DDE
Network DDE DSDM
Network Location Awareness (NLA)
Protected Storage
Remote Registry
Routing and Remote Access
Secondary Logon
Security Accounts Manager
Security Center
SSDP Discovery Service
Symantec AntiVirus Definition Watcher
Task Scheduler
TCP/IP NetBIOS Helper
Telephony
Telnet
Terminal Services
Themes
Universal Plug and Play Device Host
WebClient
Windows User Mode Driver Framework
Wireless Zero Configuration
ClipBook
Distributed Link Tracking Client
DNS Client
Error Reporting Service
Event Log
Fast User Switching Compatibility
Help and Support
Human Interface Device Access
Indexing Service
IPSEC Services
Network DDE
Network DDE DSDM
Network Location Awareness (NLA)
Protected Storage
Remote Registry
Routing and Remote Access
Secondary Logon
Security Accounts Manager
Security Center
SSDP Discovery Service
Symantec AntiVirus Definition Watcher
Task Scheduler
TCP/IP NetBIOS Helper
Telephony
Telnet
Terminal Services
Themes
Universal Plug and Play Device Host
WebClient
Windows User Mode Driver Framework
Wireless Zero Configuration
#16
Originally Posted by Churnd
Hit Alt+Ctrl+Delete, click on processes, then click the CPU column to sort processes by highest usage. Post the first several entries, and we'll see what they are. Easiest way to check is to just google the process name to see if it's safe or not. But some sites can be misleading so post 'em here if you aren't sure.
My home laptop is around 45, and it is also virus/spyware free.
I agree with all of photolief's recommendations except for the services/process part... but that's really a personal preference thing more than any. His way and my way will both work.
My home laptop is around 45, and it is also virus/spyware free.
I agree with all of photolief's recommendations except for the services/process part... but that's really a personal preference thing more than any. His way and my way will both work.
1XConfig.exe
taskmgr.exe
explorer.exe
MSASCui.exe
iPodService.exe
ati2evxx.exe
ZCfgSvc.exe
iTunesHelper.exe
qttask.exe
realsched.exe
jusched.exe
atiptaxx.exe
iTrmewrk.exe
DVDLauncher.exe
VPTray.exe
scarsvr.exe
spoolsv.exe
AND MANY MORE!
#17
i re-read your original post, and saw that your cpu is pegged at 100%. that typically signals a runaway process. get into the process list (where you see 45, not the applications list) and locate the one that's hogging the system, and kill that. if the system doesn't want you to, it'll let you know. only infrequently will you lock up the system killing a process that you shouldn't. if you can still work a bit, let me know which is the pig.
#18
Originally Posted by Georgia4Runner
Cool, thanks for the advice.
1XConfig.exe
taskmgr.exe
explorer.exe
MSASCui.exe
iPodService.exe
ati2evxx.exe
ZCfgSvc.exe
iTunesHelper.exe
qttask.exe
realsched.exe
jusched.exe
atiptaxx.exe
iTrmewrk.exe
DVDLauncher.exe
VPTray.exe
scarsvr.exe
spoolsv.exe
AND MANY MORE!
1XConfig.exe
taskmgr.exe
explorer.exe
MSASCui.exe
iPodService.exe
ati2evxx.exe
ZCfgSvc.exe
iTunesHelper.exe
qttask.exe
realsched.exe
jusched.exe
atiptaxx.exe
iTrmewrk.exe
DVDLauncher.exe
VPTray.exe
scarsvr.exe
spoolsv.exe
AND MANY MORE!
Last edited by Churnd; Jun 14, 2006 at 07:23 PM.
#19
our posts crossed. a lot of the ones you listed are evil, in my book, but that doesn't say they don't do useful things for you. if you're into gaming and quicktime, you'll need at least a couple of those. i do neither, so those aren't running on my machine.
i agree with chris that googling the process name will help you identify which are needed.
i think though there's a mixup with how i was suggesting one could use msinfo. i suggested that sysinfo, not msinfo, could be used to control startup programs. i don't use it and favor "autoruns" instead.
chris, i hadn't seen tests that debunked blackviper. could you point me to some? what you said makes me curious since my system is quite stable and secure and i did disable quite a few services. while it's true that having a boatload of services running at 0% isn't a horrible thing, they *do* add up and many spawn DLLs as well, and that does decrease your available memory. certain ones *are* susceptible to exploits, and that's a good reason to disable them. that is common knowledge and microsoft recommends the disabling of unneeded services.
i agree with chris that googling the process name will help you identify which are needed.
i think though there's a mixup with how i was suggesting one could use msinfo. i suggested that sysinfo, not msinfo, could be used to control startup programs. i don't use it and favor "autoruns" instead.
chris, i hadn't seen tests that debunked blackviper. could you point me to some? what you said makes me curious since my system is quite stable and secure and i did disable quite a few services. while it's true that having a boatload of services running at 0% isn't a horrible thing, they *do* add up and many spawn DLLs as well, and that does decrease your available memory. certain ones *are* susceptible to exploits, and that's a good reason to disable them. that is common knowledge and microsoft recommends the disabling of unneeded services.
#20
Originally Posted by photoleif
i re-read your original post, and saw that your cpu is pegged at 100%. that typically signals a runaway process. get into the process list (where you see 45, not the applications list) and locate the one that's hogging the system, and kill that. if the system doesn't want you to, it'll let you know. only infrequently will you lock up the system killing a process that you shouldn't. if you can still work a bit, let me know which is the pig.
Churnd, I didn't know that. I sorted the CPU column in descending order...System Idle Process uses about 95 most of the time, followed by System.
Explorer.exe uses about 5%; is that IE? I don't even use that...
Last edited by Georgia4Runner; Jun 14, 2006 at 07:48 PM.


