CheckEmoji Community · the emoji forum
🏠 Home 🆕 What's new ❓ Unanswered 🔥 Popular 📡 RSS Members 👥 0 online log in · register
Home › IT › Software › Constant pop-ups and massive CPU spikes - help!!!

Constant pop-ups and massive CPU spikes - help!!!

Started by wiredotter12 · · 👁 3 views · 6 replies

📡 Subscribe to replies

Participants wiredotter12ABenjamin King2
wiredotter12 wiredotter12 MemberOP
30 messages
joined Nov 2011
#1 ·
I clearly picked up some malware. I'm getting random pop-ups like Norton Antivirus, www.broadcaster.com and others. On top of that, my CPU usage is constantly maxed out, causing apps to freeze whenever I try to launch them. It's a disaster. 👎

I ran Malwarebytes and here is the resulting log...
Does anyone know how to fix this?
🙏 🙏 🙏

Logfile of Malwarebytes v1.99.1
Scan saved at 13:49:07, on 5.7.2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\GrisAVG Anti-Spyware 7.5\guard.exe
C:\Program Files\WIDCOMM\Bluetooth software\bin\btwdins.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\ESOE\ELogSrv.exe
C:\Program Files\ESOE\ESrv.exe
C:\Program Files\HP\eWorkplace\Inventory.exe
c:\Program Files\HP\eWorkplace\LogSvc.exe
C:\WINNT\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12. exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\HP\eWorkplace\Scheduler.exe
C:\Program Files\Sygate\SSA\smc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ESOE\EDMS\ECIS.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\AGRSMMSG.exe
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINNT\system32\PRPCUI.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Quick Time Player\iTunesHelper.exe
C:\Program Files\USBRadio\QuickRadio.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\system32\LVCOMSX.EXE
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\hpq\HP wireless Assistant\HP wireless Assistant.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
C:\Program Files\GrisAVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Skype\Skype.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
C:\Program Files\WIDCOMM\Bluetooth software\BTTray.exe
C:\Program Files\ESOE\ECC.exe
C:\Program Files\HP\eWorkplace\ControlCenter.exe
C:\Program Files\ESOE\EDMS\ECP.exe
C:\Program Files\ORL\VNC\WinVNC.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\RealPlayer\RealPlay.exe
C:\Program Files\ESOE\ELaunch.exe
C:\Program Files\HP\eWorkplace\eWLaunch.exe
C:\Documents and Settings\etkbim\Desktop\Logfile of Malwarebytes.exe
wiredotter12 wiredotter12 MemberOP
30 messages
joined Nov 2011
#2 ·
...continuation of the above...

Registry entry R0 - HKCU\Software\Microsoft\Internet Explorer\Main,start page = http://www.etk.extern.eu.ericsson.se/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.etk.extern.us.ericsson.com:8080/cache.pac
O1 - Hosts: 172.17.73.11 sapora.etk.extern.eu.ericsson.se sapora.etk.ericsson.se sapora
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - exe C :\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] exe C :\WINNT\system32\igfxtray.exe
EXE O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [eabconfg.cpl] exe C :\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LidPolicy] C:\Program Files\HP\LidSwitch Policy\PwrSchem.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] exe C :\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\Quick Time Player\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickRADIO] exe C :\Program Files\USBRadio\\QuickRadio.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
EXE O4 - HKLM\..\Run: [LVCOMSX] exe C :\WINNT\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
EXE O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Sony Ericsson PC suite ] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SSA\smc.exe -startgui
O4 - HKLM\..\Run: [HP wireless Assistant] exe C :\ Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [j3261237] rundll32 C:\WINNT\system32\j3261237.dll sook
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\GrisAVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINNT\system32\nrwnyglf.dll",realset
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [VoipStunt] "C:\program files\voipstunt\voipstunt.exe" -nosplash -minimized
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [swg] exe C :\ Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
Startup Entry O4: Cyber-shot Viewer Media Check Tool.lnk points to C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe.
O4 - Global Startup: Adobe Acrobat 7.0 Speed Launcher.lnk = exe C :\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = C:\Program Files\WIDCOMM\Bluetooth software\BTTray.exe
O4 - Global Startup: Ericsson Corporate Templates check.lnk = exe C :\Program Files\Microsoft Office\Templates\1033\eCorpTemplates2003.exe
O4 - Global Startup: ESOE 2000 Client Update.lnk = exe C :\Program Files\ESOE2000ClientUpdate\eMsgBox.exe
O4 - Global Startup: ESOE Control Center.lnk = C:\Program Files\ESOE\ECC.exe
O4 - Global Startup: ESOE2000ClientUpdate2.lnk = C:\Program Files\ESOE2000ClientUpdate\ESOE2000ClientUpdate2.e xe
O4 - Global Startup: eWorkplace Control Center.lnk = C:\Program Files\HP\eWorkplace\ControlCenter.exe
O4 - Global Startup: Microsoft .NET FrameWork 2.0..lnk = C:\Program Files\Microsoft .NET FrameWork 2.0\Microsoft .NET FrameWork 2.0.EXE
O4 - Global Startup: Reserver for Outlook Update check.lnk = C:\Program Files\Avaya\Reserver for Outlook\ReserverforOutlook.exe
O4 - Global Startup: UCF Check.lnk = C:\Program Files\UCF\UCF-5.3.0.3.exe
O4 - Global Startup: Visio Viewer Update Check.lnk = C:\Program Files\Microsoft Office\Visio Viewer\VisioViewer.exe
O4 - Global Startup: WinVNC.lnk = C:\Program Files\ORL\VNC\WinVNC.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
wiredotter12 wiredotter12 MemberOP
30 messages
joined Nov 2011
#3 ·
...continuing from above....

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZNxmk142YYHR
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {072D3F2E-5FB6-11D3-B461-00C04FA35A21} (CFForm Runtime) - https://isit.etk.ericsson.se/CFIDE/classes/CFJava.cab
O16 - DPF: {5DD3CC1E-B32C-44CF-96A8-035753AE47B4} - http://ehrzgmw602/PAPCInstallation/default.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = eemea.ericsson.se
O17 - HKLM\System\CCS\Services\Tcpip\..\{FD5245EB-CCCA-456D-8C10-8CC95FABC3CF}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = eemea.ericsson.se
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = eemea.ericsson.se
O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINNT\system32\btxppanel.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\GrisAVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ESOE Client Inventory Service (ECIS) - Hewlett-Packard - C:\Program Files\ESOE\EDMS\ECIS.exe
O23 - Service: ESOE Log Service (ELogSrv) - Hewlett-Packard - C:\Program Files\ESOE\ELogSrv.exe
O23 - Service: ESOE Process Manager (ESrv) - Hewlett-Packard - C:\Program Files\ESOE\ESrv.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard - C:\WINNT\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPBPRO.EX E
O23 - Service: HP Status Server - Hewlett-Packard - C:\WINNT\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPBOID.EX E
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: eWorkplace Inventory (Inventory) - HP - C:\Program Files\HP\eWorkplace\Inventory.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: eWorkplace Log (LogSvc) - TODO: <Company name> - c:\Program Files\HP\eWorkplace\LogSvc.exe
O23 - Service: Lan Discover Agent (magaService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\maga\maga.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12. exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\wireless\bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\wireless\bin\S24EvMon.exe
O23 - Service: SAVRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: eWorkplace Scheduler (Scheduler) - HP - C:\Program Files\HP\eWorkplace\Scheduler.exe
O23 - Service: Sygate Security Agent (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SSA\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
wiredotter12 wiredotter12 MemberOP
30 messages
joined Nov 2011
#4 ·
I keep getting hit with pop-ups like this...
"NOTICE: If your computer has errors in the registry database or file system, it could cause unpredictable or erratic behavior, freezes or crashes."

Fixing these errors can increase your computer's performance and prevent data loss.

Would you like to install ErrorSafe to check your computer for free? (recommended)"
Help, anyone know what this is? 🙏 🙏 🙏
A Anonymous Veteran
3.6K messages
joined May 2005
#5 ·
Look, man, if I were you, I’d start by just doing a clean install of Windows... once you’ve got that sorted out, grab Norton and get it installed... then you should be golden. Honestly, I highly doubt your CPU is being constantly maxed out. And whatever you do, don't go cluttering up your system with a bunch of random stuff like Kaspersky, Ashampoo, or who knows what else... most of them aren't even worth the trouble. Plus, keep in mind that when it comes to firewalls, hardware protection is actually the best way to go, so there's really no point in stuffing your PC with unnecessary software.

I don't really see any other way to fix this...
Benjamin King2 Benjamin King2 Active Member
138 messages
joined Apr 2007
#6 ·
wiredotter12 said:I keep getting hit with these annoying pop-ups—the kind that just won't quit...
Just a heads-up—if your computer is dealing with some messy registry database errors or a glitchy file system, you’re basically asking for trouble. We're talking unpredictable, erratic behavior, random freezes, or those sudden, annoying crashes that just ruin your afternoon.

Cleaning up these glitches isn't just about making things run smoother—it’s actually about keeping your data from vanishing into thin air. Seriously, fixing this stuff can give your computer a much-needed performance boost and, more importantly, stop you from losing everything you've worked on.

So, I just saw this pop-up asking if I'd like to install ErrorSafe to check my computer for free—apparently, it’s "recommended"—and honestly, who actually falls for this stuff anymore? It’s one of those classic, nagging prompts that just hangs there, acting like your system is a ticking time bomb unless you click through their little setup wizard. It’s basically digital junk mail masquerading as helpful advice. Just another thing to clutter up your life when you're already dealing with enough nonsense.
Help—does anyone actually know what they're doing here??? 🙏 🙏 🙏

Aside from that ErrorSafe and Mywebsearch nonsense, I don't see any other junk cluttering up the log. You really ought to let Norton take care of ErrorSafe—it should be an easy fix—and definitely use Spybot to wipe out Mywebsearch. If you’re still sticking with Internet Explorer, do yourself a favor and grab SpywareBlaster too, just to save yourself the headache next time. As for that AVG guard, honestly? Just scrap it. You can ditch it from your system entirely. Did you actually run a full scan with Norton yet? It looks to me like you have a bit of a habit of installing every random toolbar that comes your way... maybe try to dial it back a notch. 🙂

Just go ahead and hit Start -> Run -> msconfig, head over to that startup tab, and just uncheck everything related to QuickTime, Nero, or Acrobat Reader... honestly, it’s all just useless junk eating up your RAM for no reason.
wiredotter12 wiredotter12 MemberOP
30 messages
joined Nov 2011
#7 ·
Thanks for the help everyone...
I cleared things up using Malwarebytes and Spybot. Now I just have to deal with McAfee, which is currently disabled 😠

You must log in or register to reply here.

Log in Register

🔗 Similar threads