This morning, the WUDFHost.exe process, which is a subprocess to SVCHost.exe was scanning through several files on my hard disk, totally slowing down the system. The system was so slow that it was almost impossible to perform even simple actions. Another issue was mcupdate showed up in the Process Monitor also scanning through files on the hard disks, several file operations over a period of time.
I have done scans with Malware Bytes, Spyware PC Doctor, and even Spybot Search and Destroy and all found nothing. Last week, there were some trojans discovered and cleaned.
I really don't know how to fix this, and I think perhaps a reinstall may be the only way. But...if I can avoid that then that would be preferable.
Hope someone can help me :-|
Here is my Hijack This log file:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:58:36 PM, on 12/8/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
G:\Windows\System32\smss.exe
G:\Windows\system32\csrss.exe
G:\Windows\system32\wininit.exe
G:\Windows\system32\csrss.exe
G:\Windows\system32\services.exe
G:\Windows\system32\lsass.exe
G:\Windows\system32\lsm.exe
G:\Windows\system32\svchost.exe
G:\Windows\system32\nvvsvc.exe
G:\Windows\system32\svchost.exe
G:\Windows\System32\svchost.exe
G:\Windows\system32\winlogon.exe
G:\Windows\System32\svchost.exe
G:\Windows\system32\svchost.exe
G:\Windows\system32\svchost.exe
G:\Windows\system32\SLsvc.exe
G:\Windows\system32\svchost.exe
G:\Windows\system32\svchost.exe
G:\Windows\System32\ZoneLabs\vsmon.exe
G:\Windows\System32\spoolsv.exe
G:\Windows\system32\svchost.exe
G:\Program Files\Bonjour\mDNSResponder.exe
G:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
G:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
G:\Windows\system32\PnkBstrA.exe
G:\Windows\system32\svchost.exe
G:\Program Files\Spyware Doctor\pctsAuxs.exe
G:\Program Files\Spyware Doctor\pctsSvc.exe
G:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
G:\Windows\system32\svchost.exe
G:\Program Files\TVersity\Media Server\MediaServer.exe
G:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe
G:\Windows\System32\svchost.exe
G:\Windows\system32\SearchIndexer.exe
G:\Windows\system32\WUDFHost.exe
G:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
G:\Windows\system32\taskeng.exe
G:\Windows\system32\rundll32.exe
G:\Windows\system32\taskeng.exe
G:\Windows\system32\Dwm.exe
G:\Windows\Explorer.EXE
G:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
G:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe
G:\Program Files\Common Files\Logitech\LCD Manager\LCDMon.exe
G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
G:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
G:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDMedia.exe
G:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe
G:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe
G:\Windows\System32\CTXFIHLP.EXE
G:\Windows\System32\CTXFISPI.EXE
G:\Users\Angel\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Windows\System32\CTHELPER.EXE
G:\Windows\system32\SearchProtocolHost.exe
G:\Program Files\Windows Media Player\wmpnscfg.exe
G:\Program Files\Spyware Doctor\pctsTray.exe
G:\Windows\system32\wbem\unsecapp.exe
G:\Windows\system32\wbem\wmiprvse.exe
G:\Windows\System32\rundll32.exe
G:\Windows\System32\nvraidservice.exe
G:\Program Files\RivaTuner v2.07\RivaTuner.exe
G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
G:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
G:\Program Files\Windows Sidebar\sidebar.exe
G:\Program Files\Windows Live\Messenger\msnmsgr.exe
G:\Program Files\Windows Sidebar\sidebar.exe
G:\Windows\ehome\ehtray.exe
G:\Windows\ehome\ehmsas.exe
G:\Program Files\Electronic Arts\EADM\Core.exe
G:\Users\Angel\AppData\Local\Google\Update\GoogleUpdate.exe
G:\Users\Angel\AppData\Local\Google\Chrome\Application\chrome.exe
G:\Program Files\Curse\CurseClient.exe
G:\Program Files\PDFCreator\PDFCreator.exe
G:\Windows\system32\taskmgr.exe
G:\Windows\system32\cmd.exe
G:\Windows\Explorer.exe
G:\Windows\system32\SearchFilterHost.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe
G:\Program Files\Mozilla Firefox3\firefox.exe
G:\Users\Angel\AppData\Local\Google\Update\GoogleUpdate.exe
G:\Windows\system32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - G:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - G:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - g:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - G:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - G:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "G:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "G:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "G:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "G:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "G:\Program Files\RivaTuner v2.07\RivaTunerWrapper.exe" /S
O4 - HKLM\..\Run: [RivaTuner] "G:\Program Files\RivaTuner v2.07\RivaTunerWrapper.exe" /T
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE G:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVRaidService] G:\Windows\system32\nvraidservice.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "G:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [swg] G:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "G:\Games\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Sidebar] G:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "G:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [igndlm.exe] G:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [ehTray.exe] G:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "G:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [EA Core] G:\Program Files\Electronic Arts\EADM\Core.exe -silent
O4 - HKCU\..\Run: [Google Update] "G:\Users\Angel\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [CurseClient] G:\Program Files\Curse\CurseClient.exe -silent
O4 - HKCU\..\Run: [WMPNSCFG] G:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [NVIDIA nTune] "G:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" boot "G:\Users\Angel\AppData\Local\NVIDIA Corporation\nTune\Profiles\osbootpf.nsu"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: WinMySQLadmin.lnk = C:\AC Web Ultimate Repack\Server\mysql\bin\winmysqladmin.exe
O4 - Global Startup: PDFCreator.lnk = G:\Program Files\PDFCreator\PDFCreator.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://G:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://G:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://G:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://G:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - G:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - G:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - G:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - G:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell....r/SysProExe.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C3187462-29DC-4429-8477-848F9A750D8E}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - G:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - G:\Windows\System32\DreamScene.dll
O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - G:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\deskscapes.dll
O22 - SharedTaskScheduler: Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - G:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DesktopControlPanel.dll
O22 - SharedTaskScheduler: StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - G:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DreamControl.dll
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - G:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - G:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - G:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MySql - Unknown owner - C:/AC Web Ultimate Repack/Server/mysql/bin/mysqld-nt.exe (file missing)
O23 - Service: Performance Service (nTuneService) - NVIDIA - G:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - G:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - G:\Windows\system32\PnkBstrA.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - G:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - G:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - G:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - G:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - G:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - G:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Steam Client Service - Valve Corporation - G:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TVersityMediaServer - Unknown owner - G:\Program Files\TVersity\Media Server\MediaServer.exe
O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - G:\Program Files\NVIDIA Corporation\System Update\UpdateCenterService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - G:\Windows\System32\ZoneLabs\vsmon.exe
--
End of file - 14676 bytes
Sign In
Create Account
