1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

KHHEB.DLL is slowing down my computer

Discussion in 'Virus & Other Malware Removal' started by miscreant, Jan 8, 2006.

Thread Status:
Not open for further replies.
Advertisement
  1. miscreant

    miscreant Thread Starter

    Joined:
    Oct 27, 2003
    Messages:
    46
    My computer has suddenly become very slow. It seems to constantly be "crunching" or making noises typical of activity even when it is idle. I used hijackthis to find a BHO entry and an entry for a DLL that I have never seen before. I tried to fix them with hijackthis and delete the dll in safe mode but even in safe mode the dll file is still in use and wont allow me to change it, and the bho entry remains even after I try to remove it with hijackthis. Hijackthis seems to work, but if I click to scan the registry a moment later it pops back up again. I have even used regedit and found all the places in which the dll title appear and tried to delete them all. That doesn't work either. In some folders the reference is deleted but in others the reference reappears as soon as I delete it.

    I have found no hits with google returning my search for KHHEB.DLL so it must be something new. Also, in addition to the general slowness I am experiencing I have recieved several pop-ups when browsing the internet that are advertisments purporting that my computer is infected with a virus and that I should download their anti-viral software. That is at least a little encouraging in that I have not been attacked by something nefarious but have only been targeted for commercial purposes. At least I hope.

    Please tell me how to get rid of something that is active even in safe mode.

    Here is my hijackthis log:

    Logfile of HijackThis v1.97.3
    Scan saved at 7:04:19 PM, on 1/8/2006
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\RUNDLL32.EXE
    C:\WINDOWS\RUNDLL32.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\PROGRAM FILES\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 209.86.122.224:80
    O2 - BHO: (no name) - {2353FCBC-012D-487B-8BF3-865C0929FBEB} - C:\WINDOWS\SYSTEM\KHHEB.DLL
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunOnce: [*KHHEB] rundll32.exe C:\WINDOWS\SYSTEM\KHHEB.DLL,CreateProtectProc rerun
     
  2. khazars

    khazars

    Joined:
    Feb 15, 2004
    Messages:
    12,302
    hi, welcome to TSG.


    the version of hijack this you have is outdated, download a newer
    version from below.


    Download hijack this from the link below.Please do this. Click here:

    http://www.thespykiller.co.uk/files/hijackthis_sfx.exe

    to download HijackThis. Click scan and save a logfile, then post it here so
    we can take a look at it for you. Don't click fix on anything in hijack this
    as most of the files are legitimate.
     
  3. khazars

    khazars

    Joined:
    Feb 15, 2004
    Messages:
    12,302
    And don't run hijack this in safe mode!
     
  4. miscreant

    miscreant Thread Starter

    Joined:
    Oct 27, 2003
    Messages:
    46
    it doesn't make a difference what version of hijackthis i use. i downloaded the newest version of hijackthis and it doesnt fix the problem either.

    please, tell me how to remove stubborn hijackthis entries that reappear as soon as you "fix" them. and please tell me how to delete dll files that are still in use even in safe mode.
     
  5. khazars

    khazars

    Joined:
    Feb 15, 2004
    Messages:
    12,302
    I want to see what you have on your computer, the latest version of hijack this shows a lot more than the version you have, please post your hijack this log from version 1.99.1
     
  6. miscreant

    miscreant Thread Starter

    Joined:
    Oct 27, 2003
    Messages:
    46
    i fixed the problem on my own. i had the winfixer virus (or whatever it is exactly) but I could not use vundofix to remove it because the program ran erraticly. so instead I downloaded killbox which was able to remove the BHO entry and delete the DLL file upon reboot. that little program works wonders. no more will i be stuck trying to figure out how to delete a file that is inaccessible because it is in use.
     
  7. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/432366

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice