cdfc2002
2010-06-09, 04:53
Hi. I bought a used computer a few weeks ago. It was working fine at first, though I did notice there were problems that spybot detected. The cpu is now always at 100%. This started a few days ago. I think the some startup processes might be behind this. Though when I tried to stop them, they would come back: NvCpl, drshep, siszpe32. I've done multiple spybot cleans, but it has done nothing. Even if it scans at startup. Also, Firefox acts weird now. It saves passwords, but if I shut down the browser I'll have to login to everything again. Here is the hijackthis info:
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Christian\Start Menu\Programs\Startup\siszpe32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Christian\My Documents\Downloads\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1AB1AD36-67A5-1E77-A53D-6EE339E1AAEF} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\RunOnce: [SpybotDeletingA2289] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy Help.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8190] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy Help.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7636] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy on the Web.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3857] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy on the Web.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2867] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1463] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2580] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Uninstall Registry Easy.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6339] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Uninstall Registry Easy.lnk"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Bjatiwoluw] rundll32.exe "C:\WINDOWS\drshep.dll",Startup
O4 - HKCU\..\RunOnce: [SpybotDeletingB9396] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy Help.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD694] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy Help.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB505] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy on the Web.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD904] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy on the Web.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3029] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7065] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7259] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Uninstall Registry Easy.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7024] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Uninstall Registry Easy.lnk"
O4 - Startup: siszpe32.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
--
End of file - 6795 bytes
Thanks.
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Christian\Start Menu\Programs\Startup\siszpe32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Christian\My Documents\Downloads\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1AB1AD36-67A5-1E77-A53D-6EE339E1AAEF} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\RunOnce: [SpybotDeletingA2289] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy Help.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8190] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy Help.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7636] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy on the Web.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3857] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy on the Web.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2867] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1463] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2580] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Uninstall Registry Easy.lnk"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6339] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Uninstall Registry Easy.lnk"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Bjatiwoluw] rundll32.exe "C:\WINDOWS\drshep.dll",Startup
O4 - HKCU\..\RunOnce: [SpybotDeletingB9396] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy Help.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD694] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy Help.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB505] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy on the Web.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD904] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy on the Web.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3029] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7065] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Registry Easy.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7259] command.com /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Uninstall Registry Easy.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7024] cmd.exe /c del "C:\Documents and Settings\All Users\Start Menu\Programs\Registry Easy\Uninstall Registry Easy.lnk"
O4 - Startup: siszpe32.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
--
End of file - 6795 bytes
Thanks.