[Jaybird11]

I've got a user that everytime they log in explorer.exe eats up 99% CPU and it takes 20+ minutes to boot. It will also randomely eat up CPU when running random programs like outlook, excel and database program. Only happens under this one user profile. I unchecked everything in msconfig pertaining to startup and processes and there was no change. Can anyone help or have suggestions?

Here is the log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:10:44 PM, on 2/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\PGPserv.exe
C:\Program Files\VERITAS\NetBackup DLO\DLO\DLOChangeLogSvcu.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jdonline.deere.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://jdonline.deere.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://jdonline.deere.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKUS\S-1-5-19\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'Default user')
O4 - Global Startup: DLO Agent.lnk = C:\Program Files\VERITAS\NetBackup DLO\DLO\DLOClientu.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://jdonline.deere.com
O15 - Trusted Zone: http://agcc.deere.com (HKLM)
O15 - Trusted Zone: http://ascserver.jdnet.deere.com (HKLM)
O15 - Trusted Zone: http://cceprojserver.jdnet.deere.com (HKLM)
O15 - Trusted Zone: http://cimaps.deere.com (HKLM)
O15 - Trusted Zone: http://dtac.deere.com (HKLM)
O15 - Trusted Zone: http://f05cce4.jdnet.deere.com (HKLM)
O15 - Trusted Zone: http://f90casetrk.jdnet.deere.com (HKLM)
O15 - Trusted Zone: http://f90smsprod1.jdnet.deere.com (HKLM)
O15 - Trusted Zone: http://fcfvm001.jdnet.deere.com (HKLM)
O15 - Trusted Zone: http://fwagprojectdev.jdnet.deere.com (HKLM)
O15 - Trusted Zone: http://jdprojects.deere.com (HKLM)
O15 - Trusted Zone: http://projects.deere.com (HKLM)
O15 - Trusted Zone: http://tamfinch.jdnet.deere.com (HKLM)
O15 - Trusted Zone: http://tirwebtop.dx.deere.com (HKLM)
O15 - Trusted Zone: http://www.90.deere.com (HKLM)
O15 - Trusted Zone: http://*.fwagproj1 (HKLM)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = jdnet.deere.com
O17 - HKLM\Software\..\Telephony: DomainName = jdnet.deere.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = jdnet.deere.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = jdnet.deere.com
O20 - AppInit_DLLs: cahooknt.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: PGPserv - PGP Corporation - C:\WINDOWS\system32\PGPserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec NetBackup DLO Agent Change Journal Reader (VRTSChangeJournalReader) - Symantec Corporation - C:\Program Files\VERITAS\NetBackup DLO\DLO\DLOChangeLogSvcu.exe

--
End of file - 4893 bytes


Thanks for any help!!