explorer.exe cosuming 100% CPU

Viruses and worms
1

Got a new problem that explorer.exe consume 100% and ma computer getting too slow…do you think it is a virus problem? All my System restore point got deleted…can’t restore back Plis advice

???
Jack

2

Download and run HijackThis and post its log:
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html?hhTest=1

3

I suggest:

  1. Disable System Restore and reenable it after step 3.
  2. Clean your temporary files.
  3. Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
  4. Use SUPERantispyware, MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
  5. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
  6. Like YoKenny said, make a HijackThis log to post here or, better, submit the RunScanner log to to on-line analysis.
  7. Immunize your system with SpywareBlaster or Windows Advanced Care.
  8. Check if you have insecure applications with Secunia Software Inspector.
4

My taskmanager is causing 90% process >:(

And program called flec006.exe is causing 40% sometimes >:(

;D ;D

5

Seems an infected file.
Can you discover the full path of this file and then submitting it to www.virustotal.com?

Maybe you need to disable Hide protected operating system files and enable View hidden files and folders to manage the file(s).

6

Dr.web busted it i think:flec006.exe;c:\documents and settings\jonah\application data\m;Win32.HLLM.Beagle
it has alo busted these:

flec006.exe;c:\documents and settings\jonah\application data\m;Win32.HLLM.Beagle;Will be cured after restart.;
hp wireless assistant.exe;c:\program files\hpq\hp wireless assistant;Win32.HLLM.Beagle.37697;Deleted.;
wintems.exe;c:\windows\system32;Win32.HLLM.Beagle;Will be cured after restart.;
ComboFix.exe\327882R2FWJFW\psexec.cfexe;C:\Documents and Settings\Jonah\Desktop\BOX1\ComboFix.exe;Program.PsExec.171;;
ComboFix.exe;C:\Documents and Settings\Jonah\Desktop\BOX1;Archive contains infected objects;Moved.;
Process.exe;C:\Documents and Settings\Jonah\Desktop\BOX1\MSN-fix\incl;Tool.Prockill;;
Process.exe;C:\Documents and Settings\Jonah\Desktop\incl;Tool.Prockill;;
strpure12.txt;C:\Documents and Settings\Jonah\Desktop\Mopar-Server\Darkheavenpkz v1\Darkheavenpkz v1\connectedfrom;Modification of Win32.Rammstein.13346;Moved.;
giveitemlogs.txt;C:\Documents and Settings\Jonah\Desktop\Mopar-Server\Ultimate PK\logs;Modification of Win32.Rammstein.13346;Moved.;
Process.exe;C:\Documents and Settings\Jonah\Desktop\MSN FIX!!!\incl;Tool.Prockill;;
6D952C06d01\327882R2FWJFW\psexec.cfexe;C:\Documents and Settings\Jonah\Local Settings\Application Data\Mozilla\Firefox\Profiles\redk85n0.default\Cache\6D952C06d01;Program.PsExec.171;;
6D952C06d01;C:\Documents and Settings\Jonah\Local Settings\Application Data\Mozilla\Firefox\Profiles\redk85n0.default\Cache;Archive contains infected objects;Moved.;
C2152591d01\327882R2FWJFW\psexec.cfexe;C:\Documents and Settings\Jonah\Local Settings\Application Data\Mozilla\Firefox\Profiles\redk85n0.default\Cache\C2152591d01;Program.PsExec.171;;
C2152591d01;C:\Documents and Settings\Jonah\Local Settings\Application Data\Mozilla\Firefox\Profiles\redk85n0.default\Cache;Archive contains infected objects;Moved.;
FA4CCC3Fd01\327882R2FWJFW\psexec.cfexe;C:\Documents and Settings\Jonah\Local Settings\Application Data\Mozilla\Firefox\Profiles\redk85n0.default\Cache\FA4CCC3Fd01;Program.PsExec.171;;
FA4CCC3Fd01;C:\Documents and Settings\Jonah\Local Settings\Application Data\Mozilla\Firefox\Profiles\redk85n0.default\Cache;Archive contains infected objects;Moved.;
Super_Stealball_1.exe;C:\Documents and Settings\Jonah\Local Settings\Temp\Rar$EX00.844;Win32.HLLM.Beagle.37697;Deleted.;
b64[1].jpg;C:\Documents and Settings\Jonah\Local Settings\Temporary Internet Files\Content.IE5\6VZ0HMXQ;Win32.HLLM.Beagle;Deleted.;
b64_1[1].jpg;C:\Documents and Settings\Jonah\Local Settings\Temporary Internet Files\Content.IE5\6VZ0HMXQ;Trojan.PWS.Kone.3;Deleted.;
b64_3[1].jpg;C:\Documents and Settings\Jonah\Local Settings\Temporary Internet Files\Content.IE5\6VZ0HMXQ;Win32.HLLM.Beagle;Deleted.;
b64_3[2].jpg;C:\Documents and Settings\Jonah\Local Settings\Temporary Internet Files\Content.IE5\6VZ0HMXQ;Win32.HLLM.Beagle;Deleted.;
b64_1[1].jpg;C:\Documents and Settings\Jonah\Local Settings\Temporary Internet Files\Content.IE5\IJLIAO2Q;Trojan.PWS.Kone.3;Deleted.;
Super_Stealball_1.exe;C:\Documents and Settings\Jonah\My Documents\eMule Downloads\Incoming;Win32.HLLM.Beagle.37697;Deleted.;

7

OH MY GOD!!! >:( >:( >:(

i got these from virustotal by scanning that “flec”

AhnLab-V3 2008.7.11.0 2008.07.11 -
AntiVir 7.8.0.64 2008.07.11 TR/Dldr.Bagle.IY.2
Authentium 5.1.0.4 2008.07.10 W32/Heuristic-THX!Eldorado
Avast 4.8.1195.0 2008.07.11 -
AVG 7.5.0.516 2008.07.11 Downloader.Generic7.YJM
BitDefender 7.2 2008.07.11 MemScan:Trojan.Downloader.Bagle.IY
CAT-QuickHeal 9.50 2008.07.10 (Suspicious) - DNAScan
ClamAV 0.93.1 2008.07.11 PUA.Packed.Themida
DrWeb 4.44.0.09170 2008.07.11 -
eSafe 7.0.17.0 2008.07.10 -
eTrust-Vet 31.6.5947 2008.07.11 -
Ewido 4.0 2008.07.11 -
F-Prot 4.4.4.56 2008.07.10 W32/Heuristic-THX!Eldorado
F-Secure 7.60.13501.0 2008.07.10 -
Fortinet 3.14.0.0 2008.07.11 PossibleThreat
GData 2.0.7306.1023 2008.07.11 Trojan-Downloader.Win32.Bagle.tu
Ikarus T3.1.1.26.0 2008.07.11 Trojan-Downloader.Bagle.IY
Kaspersky 7.0.0.125 2008.07.11 Trojan-Downloader.Win32.Bagle.tu
McAfee 5336 2008.07.10 -
Microsoft 1.3704 2008.07.11 Trojan:Win32/Murvs
NOD32v2 3262 2008.07.11 -
Norman 5.80.02 2008.07.11 W32/DLoader.IFLP
Panda 9.0.0.4 2008.07.11 -
Prevx1 V2 2008.07.11 Worm
Rising 20.52.41.00 2008.07.11 -
Sophos 4.31.0 2008.07.11 -
Sunbelt 3.1.1509.1 2008.07.04 -
Symantec 10 2008.07.11 W32.Beagle.EB
TheHacker 6.2.96.376 2008.07.10 -
TrendMicro 8.700.0.1004 2008.07.11 -
VBA32 3.12.6.9 2008.07.11 -
VirusBuster 4.5.11.0 2008.07.11 Packed/Themida
Webwasher-Gateway 6.6.2 2008.07.11 Trojan.Dldr.Bagle.IY.2

8

And please remember that i cannot use ANY scanners what you will soon offer
because these viruses stops it >:( >:( :cry:
I can`t install any anti-virus software or use/install any scanners
I cannot use online scanners either

-No spybot
-No ad-aware
-No Hijackthis
-No Superantispyware
-No avast
-No combofix
-No F-bagle.exe
-No F-bagle.com

Srry… :‘( :’( >:( >:(

9

Boot in SafeMode (repeatedly press F8 while booting) and try to run DrWeb CureIT! from there.