Explorer.exe being a pain

[chip2006uk]

This has only started recently, explorer.exe has been using a lot more memory than before, if I leave the laptop on long enough it can go upto around 200k. Needless to say this bogs down the system like mad, even when the laptop is first turned on and explorer.exe is at a normal level my computer still seems to be slow. Especially when it comes to opening folders and moving files around. In fact its so bad Ive delayed installing a program until I figure it out otherwise the installation could take ages.

I think I have a virus although Ive ran S&D spybot / AntiVir / Avast / AVG and although they have got rid of alot of viruses the problem is still here. Also done a couple of registry fixes but to no avail

Now from looking at the process manager program and also the good old task manager I have noticed some wierd things recently.

1. The other day when my laptop had been on for literally days I looked in the task manager to find that explorer.exe was taking up over 200k memory, but also there were about 20 rundll32.exe files running at the same time. I found this to be pretty strange as it is my understanding that only one is supposed to be on at any one time.

2. Again in task manager this time in the services tab I find that "symantec Core Lc" is running alot of the time with a high PID. Not even quite sure what PID is but I know that it takes up alot of it. I do have norton antivirus installed (came free with the laptop), but its no longer subscribed I just use it as a secondary internet guard. So I dont think this is the problem

3. Looking on the program Process Manager I find that a lot of the applications are constantly trying top create file "C:\aaa\test2.txt" with the result being "path not found" all the time. And it is a lot of applications. Just looking at the last couple these include Itunes, Firefox and explorer itself.
Now Im not sure if this is the problem as I vaguely remember reading that this was something to do with ASUS multiframe and my laptop is an ASUS. But on the other hand its literally constantly trying to create it so who knows.

4. I have 2 Taskeng.exe running at the same time, I dont think this is the problem though.

5. Noticed that when trying to stop some services on taskmanager it says I need admin permission, also found this when trying to delete some files.

6. Had a problem a few days ago where windows explorer would suddenly stop working (usually after opening a folder) and then it would restart it self. This happened at least once every 20 minutes or so. I ran the spyware scans and got rid of a few viruses and I thought Id fixed it but it still happens now, but just nowhere as frequent. I think the problem is directly related


Ive also noticed some other things but I cant remember at the moment, I'l add them later if I remember.

Just ran Hijackthis, heres the logfile . Hope you lot can help me out. Thanks in advance!

Logfile of HijackThis v1.99.1
Scan saved at 11:09:34, on 21/05/2008
Platform: Unknown Windows (WinNT 6.00.1905 SP1)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ASUS\Net4Switch\Net4Switch.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Program Files\PowerForPhone\PowerForPhone.exe
C:\Windows\ASScrPro.exe
C:\Program Files\Alcatel\SpeedTouch USB\dragdiag.exe
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Windows\VMSnap1.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\TalkTalk\bin\sprtcmd.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Apoint2K\Apvfb.exe
C:\Windows\system32\Taskmgr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Billy\Desktop\Desktop Files\Spyware removers\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Live Search:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Welcome to AOL UK in partnership with talktalk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Live Search:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {240A2128-ACD4-4124-87AF-527124CAAC38} - C:\Windows\system32\iifgHbxv.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll
O2 - BHO: (no name) - {6B9D8BB4-FEB8-4A2A-A89E-0AFF8788877E} - C:\Windows\system32\iIBrsPjj.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: pvnsmfor - {89175504-FC6D-43A2-BB07-E3247659C95A} - (no file)
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [PowerForPhone] C:\Program Files\PowerForPhone\PowerForPhone.exe
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:en
O4 - HKLM\..\Run: [VMSnap1] C:\Windows\VMSnap1.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [TalkTalk] "C:\Program Files\TalkTalk\bin\sprtcmd.exe" /P TalkTalk
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\iifgHbxv.dll,#1
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [1c1a6320] rundll32.exe "C:\Windows\system32\pxmmyddx.dll",b
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Global Startup: MultiFrame.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{B072C319-4EA9-4552-AA00-F70606A6E0FA}: NameServer = 62.24.252.134 62.24.252.135
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: SupportSoft Sprocket Service (TalkTalk) (sprtsvc_TalkTalk) - Unknown owner - C:\Program Files\TalkTalk\bin\sprtsvc.exe" /service /p TalkTalk (file missing)
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\Supportsoft\bin\ssrc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: SupportSoft Repair Service (TalkTalk) (tgsrvc_TalkTalk) - Unknown owner - C:\Program Files\Common Files\Supportsoft\bin\tgsrvc.exe" /p TalkTalk (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

 

[FightingScallion]

Have you been doing your virus scans in safe mode? If not, the application may be running and can't be removed. If the application notices it's lost something, it might be set-up to recreate those files.

You might want to try the MacAfee Stinger: McAfee Threat Center
It does a pretty decent job in some cases.

Something you could also do is look at your registry start-up programs for something suspicious to get an idea. If you don't know how to do this, now is probably not the time to learn. You might get overzealous and delete something you shouldn't (I did that once; a full install later, I realized I should have been more careful).

Just a couple things to get you started...er...a little further.

 

[chip2006uk]

Hi thanks for the quick reply,

Yes I did all the scans in safemode, downloading MacAfee stinger now, cheers for the link.
Also got Trend Micro online scan running at the moment, been scanning for a couple of hours now so it should be done soon hopefully.

Ive also looked around on the registry start up using the "autoruns" program and there is an entry called 1c1a6320, it has no publisher info ,nor a description of any kind and the image path is quite dodgy aswell - c\windows\system32\pxmmyddx.dll theres also one right below it with a different image path - File not found c\windows\system32\fsdpprka.dll so yeah pretty strange that.

Also just now my antiVir Guard has just found a trojan horse called TR/Vundo.gen.

Do you think I should delete the pxmmyddx.dll file?

 

[FightingScallion]

Hmm...well, here's where we start getting into risk assessment. The problem is that if we delete something we need, there's no going back. Then again, it might work to do that. When I did a quick analysis of the Hijack This! logfile, that .dll file did come up as nasty. So, I suspect that is a problem. But I'd really prefer to have it taken care of by some respectable software. Registry shooting and deleting stuff from system32 starts to be risky.

Absurdly, doing all of these things may make it possible to track down what is happening. When one of these programs finds something, look at every detail they give you on what it is and where it's coming from. With antiVir knocking the trojan out of the way, a different program might be able to see whatever was behind the trojan. Using them all in conjunction could in fact work better than any one of them. I don't recommend having them all on all the time (that's just a waste of resources, usually), but in these situations, worse things could happen.

Before we start deleting files, let's exhaust our scanning options. And when we do start deleting files, be ready to reformat or use a restore partition if necessary. If you don't know how to do that, start reading up while you wait for scans.

 

[chip2006uk]

thanks for the help mate, Im going to update all my anti virus software again and then do a full scan on all of them in safe mode just to make sure. I'll let you know how it goes

 

[chip2006uk]

Ah well I stopped that wierd pxmmyddx.dll from starting up (didnt delete it) and Ive restarted my laptop and it is now pretty much back to normal. I am pretty sure that file was the problem. Explorer.exe is at a steady 44k (which is pretty usual for me) and I am now able to move files back and forth without a hitch.

So its definately this file but Im going to do the scans aswell just incase, if they dont actually get rid of the file I'll probably create a restore point and then delete the file directly

 

[FightingScallion]

Fantastic. You might want to report the file to whomever does your anti-virus. With some luck, maybe they'll come up with a solution for other people.

 

[chip2006uk]

Will do mate, thanks for your help