Opening Folder slows Everything

[Vettepartz]

I am using XP-Pro and have a problem when using Windows Explorer and opening a certain folder. It causes my CPU usage rate to go to 100% and slows everything down. This only happens when I open this one folder by double-clicking on it. I really don't want to delete the whole thing as there are many files in it that I want to keep. Any suggestions? thnx

 

[bobol]

use the free spybashing tools available from the links below, update them and run them... for starters then let us know if that detects anything,... then maybe you'll get a nod to post us a hijack this log here in this thread----[which you might want to do first anyway]
......
hijack this posting
It’s very important that you save the log to its own folder on your hard drive, such as program files (not temporary files or the desktop), so that it can create proper back-ups and be able to restore them if necessary.

Close all open windows and open Hijack This. Click “Scan”. When the scan is finished (it only takes a second), the scan button will change to “Save Log”. Click on “Save Log” and then save it to NotePad. Click on “Edit” – “Select all” – “copy” and then “paste” into the thread.

DO NOT FIX ANYTHING YET;- Await further analysis here.

 

[Vettepartz]

thanks bobol---here it is
Logfile of HijackThis v1.98.2
Scan saved at 4:41:52 PM, on 9/1/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\gearsec.exe
C:\WINDOWS\system32\gearsec.exe
C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\PGPsdkServ.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\VCOM\SYSTEM~1\MXTask.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\VCOM\SYSTEM~1\mxtask.exe
C:\Program Files\KaZaA Lite\KazaaLite.kpp
C:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\HiJackFolder\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [Fix-It AV] C:\PROGRA~1\VCOM\SYSTEM~1\MemCheck.exe
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: CUseeMe Conferencing Companion - {44EFB53C-C965-43CF-9F45-52242D134187} - C:\Program Files\CUseeMe\Amigo.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Help - {8525ECAC-75A5-4B8D-8FCB-9DECC1947F8D} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {F785DC7F-EE38-4EB4-981E-70F7870051ED} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Support - {F7DB8020-A0F2-41A1-94B2-493AA342DDE6} - http://www.comcastsupport.com (file missing) (HKCU)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab

 

[bobol]

i can't claim to decipher hjt logs unfortunately, but others here can give very precise advice, so wait for it and bump up post if its needed.... how are those tools working? did they find anything odd?
that 'folder'.... is it a program/exe file? there's something odd that it sucks up all your resources.... one thing I couldn't wait to do when I got xp, was go ntfs and also partition the heck out of my modest hdd, and put a coupla large games each on their own partition, away from the system partition...however a sizeable amount of ram eases things up for the hard drive swap file..... do you have alot of ram too ? That 'folder' is a bit of a system hogger more info on it can help if you can give it to us.

The kodak easyshare program you have, I had too but I never used it so I uninstalled it...it hogs alot of system resources I found. If you find you may need it later , you can always reinstall it too.

 

[physician]

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/8

this was the only one that came up as bad. if you dont recognize it, then put a check by it in the box, let ht fix it, reboot and repost your log...doc

 

[Vettepartz]

I let ht fix that one, doc, but it didn't help

that 'folder' has a lot of different kinds of files in it---the problem starts when i open the folder itself to see what files are in it---also, i have 512 of ram

another odd thing---Windows Task Manager says i have 100% CPU usage, but the red activity light on my computer doesn't stay on almost constantly like it does with other high usage problems

strange, huh

 

[bobol]

Have you set Windows to manage your page file, via the virtual memory settings section in MyComp properties----
you mention 'other high usage problems' what usually causes those for you...[that kodak easyshare for one is a hogger like i said]
its very mysterious.... does the 'folder' open up to let you see what's in there/or freezes before you get it opened..... The old trick of seperating what the culprit 'file' may be may help.
For instance seperate half the files from the folder and see if problem arises...if not the file is the other 'removed' half... Then continue halfing the suspect portion of files to hone in on the culprit file... A lengthy process,... but it may work.
[ps. is there an obvious .exe file in there you can see?]

 

[Vettepartz]

I have SLOWLY been moving files out of this folder, and have just found one that I cannot do anything with. It is a .avi file, and when I try to delete, move, or rename it, I get the windows error that says it is in use by another program or person, even though I have NOTHING else running. Any suggestions as to how I might be able to get rid of it?

 

[bobol]

hmmm..... in use by another program or person- and nothing else running... gets more intriguing now! Again I can't give expert advice there, as the more senior folks here could hone in on this situation with more precision.[ie,like if you're being hacked]

Forgot to ask, if you ran those spybasher tools I mentioned in post#2
another deadly tool is cw shredder http://www.majorgeeks.com/download4086.html

 

[Vettepartz]

I just wish I could find a way to make that particular file go away. It is wierd that I cannot delete it. I may start another post asking if someone knows a non-traditional method of getting rid of a file.

Oh, I ran one of the spyware finders and it did find some spy program stuff, but said I had to buy the non trial version to delete them. Can't remember which it was, but I don't like that method of selling a product.

 

[rude]

Move on Boot will get rid of the offending file,and the best thing about it is, it's FREE:
http://www.snapfiles.com/get/moveonboot.html

 

[bobol]

interesting,,,, which tool said it'd delete the file for a 'fee'// please name it for us if you can recall-we don't like that either...... was it cw shredder or spyware blaster? first i heard of that, i thought those 2 were free of obligations ---- running spybot and adaware are a dynamic duo that you should keep running[no obligations]. ps. was that found file 'named' at least.

 

[Vettepartz]

Hallelujah!!! I used MoveOnBoot to get rid of the offending file and now everything is great again. Thanks, Rude for the info. Also a big thanks to Bobol and all others who replied.

BTW, the program that wanted the money for the capability of deleting the spyware programs was called "Spyware Doctor" and was available as a free download on the same site that I got "Hijack This" from.