HELP! High CPU Usage causes very jittery sound. (Laptop)

[Carbon Dudeoxide]

Did you do the SuperAntiSpyware Scan and MalwareBytes' Scan? (Steps 3 & 4)

If so, post the logs.

[dingbat-dom]

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/30/2008 at 07:09 AM

Application Version : 4.21.1004

Core Rules Database Version : 3555
Trace Rules Database Version: 1543

Scan type       : Complete Scan
Total Scan Time : 13:33:18

Memory items scanned      : 638
Memory threats detected   : 0
Registry items scanned    : 6647
Registry threats detected : 0
File items scanned        : 146848
File threats detected     : 26

Adware.Tracking Cookie
   .premiumtv.122.2o7.net [ C:\Documents and Settings\Q\Application Data\Mozilla\Firefox\Profiles\po9i93gy.default\cookies.txt ]
   .adtech.de [ C:\Documents and Settings\Q\Application Data\Mozilla\Firefox\Profiles\po9i93gy.default\cookies.txt ]
   C:\Documents and Settings\administrator.QUEENSWOOD\Cookies\administrator@2o7[1].txt
   C:\Documents and Settings\gilbertd\Cookies\[email protected][1].txt
   C:\Documents and Settings\gilbertd\Cookies\[email protected][1].txt
   C:\Documents and Settings\gilbertd\Cookies\gilbertd@hitbox[1].txt
   C:\Documents and Settings\gilbertd\Cookies\gilbertd@findarticles[2].txt
   C:\Documents and Settings\gilbertd\Cookies\gilbertd@atdmt[2].txt
   C:\Documents and Settings\gilbertd\Cookies\gilbertd@2o7[2].txt
   C:\Documents and Settings\gilbertd\Cookies\gilbertd@statcounter[1].txt
   C:\Documents and Settings\gilbertd\Cookies\gilbertd@burstnet[2].txt
   C:\Documents and Settings\gilbertd\Cookies\[email protected][2].txt
   C:\Documents and Settings\gilbertd\Cookies\[email protected][2].txt
   C:\Documents and Settings\gilbertd\Cookies\[email protected][1].txt
   C:\Documents and Settings\dickinsone\Cookies\dickinsone@apmebf[2].txt
   C:\Documents and Settings\dickinsone\Cookies\dickinsone@indextools[2].txt
   C:\Documents and Settings\burchelli\Cookies\burchelli@revsci[1].txt
   C:\Documents and Settings\burchelli\Cookies\burchelli@specificclick[2].txt
   C:\Documents and Settings\burchelli\Cookies\burchelli@statcounter[2].txt
   C:\Documents and Settings\burchelli\Cookies\burchelli@imrworldwide[2].txt
   C:\Documents and Settings\burchelli\Cookies\[email protected][1].txt
   C:\Documents and Settings\burchelli\Cookies\burchelli@tns-counter[1].txt
   C:\Documents and Settings\burchelli\Cookies\burchelli@azjmp[1].txt
   C:\Documents and Settings\burchelli\Cookies\burchelli@socialmedia[1].txt
   C:\Documents and Settings\burchelli\Cookies\[email protected][2].txt
   C:\Documents and Settings\burchelli\Cookies\[email protected][1].txt

[dingbat-dom]

AND MALWARE BYTE

[Saving space - attachment deleted by admin]

[evilfantasy]

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

- O4 - HKLM\..\RunServices: [MSN Messenger] live.messenger.com

Important: Close all windows except for HijackThis and then click Fix checked.

Exit HijackThis.

----------

Note: the below instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

Go to Start > Run and type notepad.exe then click OK

Copy and paste the below into Notepad and save as fixme.reg to Your Desktop

Code: [Select]

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"MSN Messenger"=-
Locate fixme.reg on your Desktop and double-click it. Answer Yes when prompted to merge with the Registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it did not work.

Delete the fixme.reg from the Desktop.

----------

Do you know what this is? queenswood.org

[dingbat-dom]

Done, it worked.

And that is the name of my schools website. This is because I have bought my laptop with the school. I wouldn't think that would be a worry.

The problem is stil there though.

[evilfantasy]

Run this online scan.

This scanner requires Internet Explorer

Use the ESET Nod32 Online Scanner

1. Check the box next to YES, I accept the Terms of Use.
2. Click Start
3. When asked, allow the activex control to install
4. Click Start
5. Make sure that the option Remove found threats and the option Scan unwanted applications is check marked.
6. Click Scan
7. Wait for the scan to finish
8. Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
9. Add the C:\Program Files\EsetOnlineScanner\log.txt log into your next reply.

[dingbat-dom]

Oh dear. When installing, it says error update failed (200)
What shall I do. And also, these random proccesses on my task manager pop up and they are not found anywhere on the internet. They usually contain 3 letters 2 numbers and like another letter, then .exe. Do think that might be the virus. I end the tasks and they eventually pop back again but a different name.

[evilfantasy]

Download ComboFix by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note:  It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
 
Double click combofix.exe & follow the prompts.
When finished ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

[dingbat-dom]

How long does it take for the log to prepare. It doesn't seem to want to do it.  It's just sitting there with the little thing  flashing

[evilfantasy]

Has the computer restarted yet?

[dingbat-dom]

Yes. Sorry it's done now!
Here is log

[Saving space - attachment deleted by admin]

[evilfantasy]

Download OTMoveIt2 by OldTimer and save it to your Desktop.

Note: If you are running on Vista, right-click on OTMoveIt2.exe and choose Run As Administrator.

1. Double-click OTMoveIt2.exe to run it.
2. Copy the lines in the codebox below.

Code: [Select]

[kill explorer]
C:\FOUND.000
C:\WINDOWS\TEMP\IK795F.EXE
EmptyTemp
[start explorer]
3. Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste
4. Click the red Moveit! button.
5. Copy everything in the Results window (under the green bar) and paste it in your next reply.
6. Close OTMoveIt2

Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose Yes. If not, reboot anyway.

[dingbat-dom]

Thankyou. For being so helpful. I hope I am not annoying you.
Anything else?



Explorer killed successfully
C:\FOUND.000 moved successfully.
C:\WINDOWS\TEMP\IK795F.EXE moved successfully.
< EmptyTemp >
File delete failed. C:\DOCUME~1\Q\LOCALS~1\Temp\Perflib_Perfdata_cac.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Q\LOCALS~1\Temp\RtkBtMnt.exe scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Q\LOCALS~1\Temp\Perflib_Perfdata_ad0.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Q\LOCALS~1\Temp\Perflib_Perfdata_57c.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_468.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_2fc.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5d0.dat scheduled to be deleted on reboot.
Temp folders emptied.
IE temp folders emptied.
Explorer started successfully
 
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09302008_195222

Files moved on Reboot...
File C:\DOCUME~1\Q\LOCALS~1\Temp\Perflib_Perfdata_cac.dat not found!
C:\DOCUME~1\Q\LOCALS~1\Temp\RtkBtMnt.exe moved successfully.
File C:\DOCUME~1\Q\LOCALS~1\Temp\Perflib_Perfdata_ad0.dat not found!
File C:\DOCUME~1\Q\LOCALS~1\Temp\Perflib_Perfdata_57c.dat not found!
File C:\WINDOWS\temp\Perflib_Perfdata_468.dat not found!
File C:\WINDOWS\temp\Perflib_Perfdata_2fc.dat not found!
File C:\WINDOWS\temp\Perflib_Perfdata_5d0.dat not found!

[evilfantasy]

Not annoying. It's why we're here...

How is everything now?

[dingbat-dom]

When I started up it made a wierd sound but I will have to wait until the CPU goes up.