Am I been Hacked???????

[reanbeg]

Hi, my computer is very slow, I don’t know if I’ve been hacked or I have to change something in my system.

Please Help.

My vista is booting GRLDR

Here are my system information
------------------
System Information
------------------
Operating System: Windows Vista™ Ultimate (6.0, Build 6001) Service Pack 1
Language: English (Regional Setting: English)
BIOS: BIOS Date: 09/27/04 21:48:26 Ver: 08.00.10
System Type X86-based PC
Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz, 3456 Mhz, 1 Core(s), 2 Logical Processor(s)
Memory: 2046MB RAM
Page File: 1751MB used, 2586MB available
Windows Dir: C:\Windows
DirectX Version: DirectX 10

---------------
Display Devices
---------------
Card name: NVIDIA GeForce 8600 GT
Manufacturer: NVIDIA
Chip type: GeForce 8600 GT
DAC type: Integrated RAMDAC
Display Memory: 1267 MB
Dedicated Memory: 499 MB
Shared Memory: 767 MB
Current Mode: 1680 x 1050 (32 bit) (60Hz)
Monitor: SyncMaster 226BW(Digital)
DDraw Status: Enabled
D3D Status: Enabled
AGP Status: Enabled

----------------
Startup Programs
----------------

(Empty!) Public HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AVP "c:\program files\kaspersky lab\kaspersky internet security 7.0\avp.exe"
Bluetooth c:\progra~1\widcomm\blueto~1\bttray.exe Public
ehTray.exe c:\windows\ehome\ehtray.exe
HP Software Update c:\program files\hp\hp software update\hpwuschd2.exe
hpqSRMon c:\program files\hp\digital imaging\bin\hpqsrmon.exe
InCD d:\nero\nero8\incd\incd.exe
ISUSPM "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
iTunesHelper "d:\itunes\ituneshelper.exe"
NBKeyScan "d:\nero\nero8\nero backitup\nbkeyscan.exe"
NeroFilterCheck c:\program files\common files\nero\lib\nerocheck.exe
NvCplDaemon rundll32.exe c:\windows\system32\nvcpl.dll,nvstartup
NvMediaCenter rundll32.exe c:\windows\system32\nvmctray.dll,nvtaskbarinit
QuickTime Task "d:\quicktime\qttask.exe" -atboottime
RoxWatchTray "c:\program files\common files\roxio shared\9.0\sharedcom\roxwatchtray9.exe"
SansaDispatch c:\users\fred\appdata\roaming\sandisk\sansa updater\sansadispatch.exe
SecurDisc d:\nero\nero8\incd\nbhgui.exe
Sidebar %programfiles%\windows sidebar\sidebar.exe /detectmem NT AUTHORITY\NETWORK SERVICE
Sidebar c:\program files\windows sidebar\sidebar.exe /autorun
TkBellExe "c:\program files\common files\real\update_ob\realsched.exe" -osboot
TomTomHOME.exe "d:\tomtom home 2\homerunner.exe"
WindowsWelcomeCenter rundll32.exe oobefldr.dll,showwelcomecenter NT AUTHORITY\NETWORK SERVICE
WMPNSCFG c:\program files\windows media player\wmpnscfg.exe

This is what I’ve got in my Vista System Diagnostics Report
CPU Busy 100 % High CPU load. Investigate Top Processes.

my processes
mage Name Process Launched Used Kernel User CPU%
ID CPU% CPU%
perfmon.exe 4344 18 3 23.7 5.4 29.1
avp.exe 484 47 26 5.3 12.4 17.7
svchost.exe 904 23 16 9.4 1.4 10.8
sidebar.exe 2440 18 3 6.1 1.5 7.6
svchost.exe 1200 46 6 1.2 4.0 5.1
rundll32.exe 5572 97 37 3.2 2.0 5.1
WmiPrvSE.exe 2376 34 28 2.5 1.1 3.6
System 4 130 18 2.5 0.0 2.5
services.exe 668 10 3 1.9 0.1 2.0
svchost.exe 1212 109 52 0.8 0.9 1.7
dwm.exe 3908 9 2 0.4 1.1 1.6
TrustedInstaller.exe 1496 7 1 1.2 0.2 1.4
SearchIndexer.exe 2812 31 15 0.3 0.7 1.0
SearchFilterHost.exe 5240 5 3 0.2 0.7 0.9
SearchProtocolHost.exe 2988 8 7 0.7 0.3 0.9
InCDsrv.exe 1808 21 4 0.8 0.1 0.9
spoolsv.exe 1864 23 2 0.5 0.1 0.7
Idle 0 2 2 0.4 0.0 0.4
SearchFilterHost.exe 5744 7 4 0.2 0.1 0.3
WmiPrvSE.exe 2736 9 3 0.3 0.0 0.3
lsass.exe 680 19 6 0.2 0.0 0.3
csrss.exe 580 11 3 0.1 0.1 0.2
svchost.exe 1136 30 5 0.1 0.0 0.1
explorer.exe 628 46 7 0.1 0.0 0.1
svchost.exe 1032 25 6 0.0 0.1 0.1
NBHRegInCDSrv.exe 2064 3 1 0.1 0.0 0.1
avp.exe 3460 11 2 0.0 0.0 0.1
svchost.exe 988 14 5 0.0 0.0 0.1
sidebar.exe 268 17 1 0.0 0.0 0.0
the rest are 0.0

[Stefano Mtangoo]

have you tried System Restore to previous working state?

Download and Run Hijack this and post results in the viruses and other nasties

[zeroth]

Hi, my computer is very slow, I don’t know if I’ve been hacked or I have to change something in my system.

Please Help.

you can clean up what's running on your system by using CodeStuffStarter which can be downloaded here http://www.snapfiles.com/get/Starter.html

If you have Norton's running, this can also slow your machine down after a while. If you want to change to another lower overhead system, you can just google Norton Removal Tool and run that. You'll be surprised how much this will improve your speed but you should go after another virus program like Avast! or something if you decide to get rid of the Norton suite.

[reanbeg]

I don't have Norton in my system and I have already Codestuff starter.
Is it because I have Kaspersky running ?

Thanks

[caperjack]

no antiviri program is going to make you computer to run as slow as you describe ,unless its doing a system scan ,and they all will slow the computer down when they are doing a full system scan ,
shut off a few unnecessary that you have running ,
like these
=
HP Software Update c:\program files\hp\hp software update\hpwuschd2.exe

hpqSRMon c:\program files\hp\digital imaging\bin\hpqsrmon.exe

InCD d:\nero\nero8\incd\incd.exe

ISUSPM "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler

NBKeyScan "d:\nero\nero8\nero backitup\nbkeyscan.exe"

NeroFilterCheck c:\program files\common files\nero\lib\nerocheck.exe

NvMediaCenter rundll32.exe c:\windows\system32\nvmctray.dll,nvtaskbarinit

QuickTime Task "d:\quicktime\qttask.exe" -atboottime

RoxWatchTray "c:\program files\common files\roxio shared\9.0\sharedcom\roxwatchtray9.exe"

SansaDispatch c:\users\fred\appdata\roaming\sandisk\sansa updater\sansadispatch.exe

SecurDisc d:\nero\nero8\incd\nbhgui.exe

Sidebar c:\program files\windows sidebar\sidebar.exe /autorun

TkBellExe "c:\program files\common files\real\update_ob\realsched.exe" -osboot

TomTomHOME.exe "d:\tomtom home 2\homerunner.exe"

WindowsWelcomeCenter rundll32.exe oobefldr.dll,showwelcomecenter NT AUTHORITY\NETWORK

[caperjack]

also if you find any of these are using a lot of cpu resources you could do the following .
do a alt+ctrl+del and open windows task manager

SearchFilterHost.exe

SearchProtocolHost.exe

SearchFilterHost.exe

Try and disabling the .XML file extension from being indexed in the Indexing Options control panel.

[Stefano Mtangoo]

you can clean up what's running on your system by using CodeStuffStarter which can be downloaded here http://www.snapfiles.com/get/Starter.html

If you have Norton's running, this can also slow your machine down after a while. If you want to change to another lower overhead system, you can just google Norton Removal Tool and run that. You'll be surprised how much this will improve your speed but you should go after another virus program like Avast! or something if you decide to get rid of the Norton suite.

Norton is resource hunger.
It came with my PC and removed it using Revo. Unfortunately it break down (Also Office 2007) and now there are services runing and cant release my Context menu. I don't like it!

[reanbeg]

I did all off the above, start prog, XML & indexing..
The system is a little bit better but, still slow. like I have to wait 30sec to open a word doc, with Firefox browser opened only.

Thank you guys for your help.

[cohen]

1. - Start > Run > type cmd and type msconofig and hit enter
2. - Then under startup disable the following

• AVP "c:\program files\kaspersky lab\kaspersky internet security 7.0\avp.exe"
• Public ehTray.exe c:\windows\ehome\ehtray.exe
• HP Software Update c:\program files\hp\hp software update\hpwuschd2.exe
• hpqSRMon c:\program files\hp\digital imaging\bin\hpqsrmon.exe
• InCD d:\nero\nero8\incd\incd.exe
• ISUSPM "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
• iTunesHelper "d:\itunes\ituneshelper.exe"
• NBKeyScan "d:\nero\nero8\nero backitup\nbkeyscan.exe"
• NeroFilterCheck c:\program files\common files\nero\lib\nerocheck.exe
• NvCplDaemon rundll32.exe c:\windows\system32\nvcpl.dll,nvstartup
• NvMediaCenter rundll32.exe c:\windows\system32\nvmctray.dll,nvtaskbarinit
• QuickTime Task "d:\quicktime\qttask.exe" -atboottime
• RoxWatchTray "c:\program files\common files\roxio shared\9.0\sharedcom\roxwatchtray9.exe"
• SansaDispatch c:\users\fred\appdata\roaming\sandisk\sansa updater\sansadispatch.exe
• TkBellExe "c:\program files\common files\real\update_ob\realsched.exe" -osboot
• TomTomHOME.exe "d:\tomtom home 2\homerunner.exe"
• WindowsWelcomeCenter rundll32.exe oobefldr.dll,showwelcomecenter NT AUTHORITY\NETWORK SERVICE
• WMPNSCFG c:\program files\windows media player\wmpnscfg.exe

3. - Do the following:
Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebyt...re_d5756.htmll) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
4. - After running Malwarebytes run hijackthis and post a log

once that is done... we can continue :)

Enjoy

[RLHennig]

You've probably just got too much junk on there and spyware/malware out the rear end. Go to Task Manager (right click on taskbar and select it) then to Performances and see what % of the CPU is being used. On the Processes tab you should see SysIdle at like 98% (if all is normal) but for you it may be like 0-15%