From: "johncesta" <johnce***@discussions.microsoft.com>

|
| I have a windonws server being used asd a workstation. Lately it is
| impossible to use most of the time since every time a program is launched
| explorer.exe generates high cpu about 99%. This remains for about 1 minutes
| then the program comes up.
|
| It doesn't happen with any particular program but a number of them.
|
| All updates/patches/security fixes are installed.
|
| Can anyone help?
|
| Thanks

"David H. Lipman" wrote:

> From: "johncesta" <johnce***@discussions.microsoft.com>
>
> |
> | I have a windonws server being used asd a workstation. Lately it is
> | impossible to use most of the time since every time a program is launched
> | explorer.exe generates high cpu about 99%. This remains for about 1 minutes
> | then the program comes up.
> |
> | It doesn't happen with any particular program but a number of them.
> |
> | All updates/patches/security fixes are installed.
> |
> | Can anyone help?
> |
> | Thanks
>
>
>
> If you are using any version of Sun Java that is prior to JRE Version 5.0,
> then you are strongly urged to remove any/all versions that are prior to JRE
> Version 5.0.  There are vulnerabilities in them and they are actively being exploited.
> It is possible that is how you got infected with malware.
>
> Therefore, it is highly suggested that if there are any prior versions of Sun Java
> to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
> be installed ASAP.
>
> http://www.java.com/en/download/manual.jsp
>
>
> For non-viral malware...
>
> Please download, install and update the following software...
>
> * Ad-aware SE v1.06
>   http://www.lavasoft.de/
>   http://www.lavasoftusa.com/
>
> * SpyBot Search and Destroy v1.4
>   http://security.kolla.de/
>
> After the software is updated, I suggest scanning the system in Safe Mode.
>
> I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
> that may be on the PC.
>
> * BHODemon
>
> http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d
>
> For viral malware...
>
> * Download MULTI_AV.EXE from the URL --
>   http://www.ik-cs.com/programs/virtools/Multi_AV.exe
>
> To use this utility, perform the following...
> Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> Choose; Unzip
> Choose; Close
>
> Execute; C:\AV-CLS\StartMenu.BAT
> { or Double-click on 'Start Menu' in C:\AV-CLS }
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
> FireWall to allow it to download the needed AV vendor related files.
>
> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> This will bring up the initial menu of choices and should be executed in Normal Mode.
> This way all the components can be downloaded from each AV vendor's web site.
> The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.
>
> You can choose to go to each menu item and just download the needed files or you can
> download the files and perform a scan in Normal Mode. Once you have downloaded the files
> needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
> during boot] and re-run the menu again and choose which scanner you want to run in Safe
> Mode.  It is suggested to run the scanners in both Safe Mode and Normal Mode.
>
> When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
> file.  http://www.ik-cs.com/multi-av.htm
>
>
> * * *   Please report back your results  * * *
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
>

"Adriana Viola" wrote:

> Hi John,
>
> A part of all the things that advised you David, and if all of them don't
> work, try to desactivate all of the third party software, and then check the
> performance.
>
> Which is the specific software that you are trying to running on it? Can you
> check on the task manager, which kind of program is generating this strange
> behaviour?
>
> Regards,
>
> Adriana
>
> "David H. Lipman" wrote:
>
> > From: "johncesta" <johnce***@discussions.microsoft.com>
> >
> > |
> > | I have a windonws server being used asd a workstation. Lately it is
> > | impossible to use most of the time since every time a program is launched
> > | explorer.exe generates high cpu about 99%. This remains for about 1 minutes
> > | then the program comes up.
> > |
> > | It doesn't happen with any particular program but a number of them.
> > |
> > | All updates/patches/security fixes are installed.
> > |
> > | Can anyone help?
> > |
> > | Thanks
> >
> >
> >
> > If you are using any version of Sun Java that is prior to JRE Version 5.0,
> > then you are strongly urged to remove any/all versions that are prior to JRE
> > Version 5.0.  There are vulnerabilities in them and they are actively being exploited.
> > It is possible that is how you got infected with malware.
> >
> > Therefore, it is highly suggested that if there are any prior versions of Sun Java
> > to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
> > be installed ASAP.
> >
> > http://www.java.com/en/download/manual.jsp
> >
> >
> > For non-viral malware...
> >
> > Please download, install and update the following software...
> >
> > * Ad-aware SE v1.06
> >   http://www.lavasoft.de/
> >   http://www.lavasoftusa.com/
> >
> > * SpyBot Search and Destroy v1.4
> >   http://security.kolla.de/
> >
> > After the software is updated, I suggest scanning the system in Safe Mode.
> >
> > I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
> > that may be on the PC.
> >
> > * BHODemon
> >
> > http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d
> >
> > For viral malware...
> >
> > * Download MULTI_AV.EXE from the URL --
> >   http://www.ik-cs.com/programs/virtools/Multi_AV.exe
> >
> > To use this utility, perform the following...
> > Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> > Choose; Unzip
> > Choose; Close
> >
> > Execute; C:\AV-CLS\StartMenu.BAT
> > { or Double-click on 'Start Menu' in C:\AV-CLS }
> >
> > NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
> > FireWall to allow it to download the needed AV vendor related files.
> >
> > C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> > This will bring up the initial menu of choices and should be executed in Normal Mode.
> > This way all the components can be downloaded from each AV vendor's web site.
> > The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.
> >
> > You can choose to go to each menu item and just download the needed files or you can
> > download the files and perform a scan in Normal Mode. Once you have downloaded the files
> > needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
> > during boot] and re-run the menu again and choose which scanner you want to run in Safe
> > Mode.  It is suggested to run the scanners in both Safe Mode and Normal Mode.
> >
> > When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
> > file.  http://www.ik-cs.com/multi-av.htm
> >
> >
> > * * *   Please report back your results  * * *
> >
> >
> > --
> > Dave
> > http://www.claymania.com/removal-trojan-adware.html
> > http://www.ik-cs.com/got-a-virus.htm
> >
> >
> >

"johncesta" wrote:

> explorer.exe is generating this strange behaviour as stated in my post. It
> would be illogical not to mention almost impossible to uninstall all the
> third party software on the workstation.
>
> Thanks anyway.
> --
> LogFileManager - IIS LogFile Management Tool
> WebPageChecker - Helps Maintain Server UpTime
> DomainReportIt PRO - Helps Rebuild IIS
> http://www.serverautomationtools.com
>
>
> "Adriana Viola" wrote:
>
> > Hi John,
> >
> > A part of all the things that advised you David, and if all of them don't
> > work, try to desactivate all of the third party software, and then check the
> > performance.
> >
> > Which is the specific software that you are trying to running on it? Can you
> > check on the task manager, which kind of program is generating this strange
> > behaviour?
> >
> > Regards,
> >
> > Adriana
> >
> > "David H. Lipman" wrote:
> >
> > > From: "johncesta" <johnce***@discussions.microsoft.com>
> > >
> > > |
> > > | I have a windonws server being used asd a workstation. Lately it is
> > > | impossible to use most of the time since every time a program is launched
> > > | explorer.exe generates high cpu about 99%. This remains for about 1 minutes
> > > | then the program comes up.
> > > |
> > > | It doesn't happen with any particular program but a number of them.
> > > |
> > > | All updates/patches/security fixes are installed.
> > > |
> > > | Can anyone help?
> > > |
> > > | Thanks
> > >
> > >
> > >
> > > If you are using any version of Sun Java that is prior to JRE Version 5.0,
> > > then you are strongly urged to remove any/all versions that are prior to JRE
> > > Version 5.0.  There are vulnerabilities in them and they are actively being exploited.
> > > It is possible that is how you got infected with malware.
> > >
> > > Therefore, it is highly suggested that if there are any prior versions of Sun Java
> > > to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
> > > be installed ASAP.
> > >
> > > http://www.java.com/en/download/manual.jsp
> > >
> > >
> > > For non-viral malware...
> > >
> > > Please download, install and update the following software...
> > >
> > > * Ad-aware SE v1.06
> > >   http://www.lavasoft.de/
> > >   http://www.lavasoftusa.com/
> > >
> > > * SpyBot Search and Destroy v1.4
> > >   http://security.kolla.de/
> > >
> > > After the software is updated, I suggest scanning the system in Safe Mode.
> > >
> > > I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
> > > that may be on the PC.
> > >
> > > * BHODemon
> > >
> > > http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d
> > >
> > > For viral malware...
> > >
> > > * Download MULTI_AV.EXE from the URL --
> > >   http://www.ik-cs.com/programs/virtools/Multi_AV.exe
> > >
> > > To use this utility, perform the following...
> > > Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> > > Choose; Unzip
> > > Choose; Close
> > >
> > > Execute; C:\AV-CLS\StartMenu.BAT
> > > { or Double-click on 'Start Menu' in C:\AV-CLS }
> > >
> > > NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
> > > FireWall to allow it to download the needed AV vendor related files.
> > >
> > > C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> > > This will bring up the initial menu of choices and should be executed in Normal Mode.
> > > This way all the components can be downloaded from each AV vendor's web site.
> > > The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.
> > >
> > > You can choose to go to each menu item and just download the needed files or you can
> > > download the files and perform a scan in Normal Mode. Once you have downloaded the files
> > > needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
> > > during boot] and re-run the menu again and choose which scanner you want to run in Safe
> > > Mode.  It is suggested to run the scanners in both Safe Mode and Normal Mode.
> > >
> > > When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
> > > file.  http://www.ik-cs.com/multi-av.htm
> > >
> > >
> > > * * *   Please report back your results  * * *
> > >
> > >
> > > --
> > > Dave
> > > http://www.claymania.com/removal-trojan-adware.html
> > > http://www.ik-cs.com/got-a-virus.htm
> > >
> > >
> > >