My computer has receoved 11 million packets and sent 1 million in only an hour

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: (no name) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - (no file)
  O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1046827405\ee\AOLSoftware.exe
  O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b
  O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
  O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
  O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

I recommend you remove the Java Quick Starter because it's not needed.
To do so, follow these instructions.

Go to Start > Control Panel > Java.
In the Java control panel, open the click the Advanced tab. Click the + in front of Miscellaneous and uncheck the Java Quick Starter box.

See here for more info.

Reboot normally.
Is svchost still spiking?

Still acting up for bout 15 mins after you turn on the puter. I found a tech site (http://www.technibble.com/how-to-fix-svchost-using-100-cpu-memory-leak/) the other day that had a fixsvchost tool, I followed the instructions and it still acts up. I posted a fresh hijackthis log, case you need it. Whacha think? Thanks!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:15:12 AM, on 12/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://help.live.com/ContactUs/ActiveX/MSDcode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158861330829
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader2.cab
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} (Java Plug-in 1.6.0_14) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe

--
End of file - 6124 bytes

The network activity is up again to. Thanks for your time and help, I know I'm in good hands here!

Lets find the thread hogging the CPU, please download Process Explorer from here:
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

1. Unzip it, and run the program, hit the Agree. button.

Can you take me a screenshot of the window that opens please?

Thanks, I notice when I turn the puter on w/o the internet hooked up it loads up fine, however when it is plugged in the svchost is pulling 100% for the first 15 mins. The network has received 13 million to 1 million sent in less than one hour. Hope this info helps. Here is the text results until I can figure out how to post a pic. Thanks.

Process PID CPU Description Company Name
System Idle Process 0 58.82
Interrupts n/a 0.98 Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4 0.98
smss.exe 464 Windows NT Session Manager Microsoft Corporation
csrss.exe 512 Client Server Runtime Process Microsoft Corporation
winlogon.exe 536 Windows NT Logon Application Microsoft Corporation
services.exe 580 1.96 Services and Controller app Microsoft Corporation
svchost.exe 740 Generic Host Process for Win32 Services Microsoft Corporation
wmiprvse.exe 2864 WMI Microsoft Corporation
svchost.exe 796 Generic Host Process for Win32 Services Microsoft Corporation
MsMpEng.exe 836 Service Executable Microsoft Corporation
svchost.exe 876 Generic Host Process for Win32 Services Microsoft Corporation
S24EvMon.exe 1016 Event Monitor - Supports driver extensions to NIC Driver for wireless adapters. Intel Corporation
svchost.exe 1052 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1108 Generic Host Process for Win32 Services Microsoft Corporation
spoolsv.exe 1248 Spooler SubSystem App Microsoft Corporation
svchost.exe 1324 Generic Host Process for Win32 Services Microsoft Corporation
AOLacsd.exe 1356 AOL Connectivity Service AOL LLC
Crypserv.exe 1380 CrypKey NT Service CrypKey (Canada) Ltd.
OcHealthMon.exe 1468 Windows Live OneCare Health Monitor Service Microsoft Corporation
RegSrvc.exe 1504 RegSrvc Module Intel Corporation
svchost.exe 1556 Generic Host Process for Win32 Services Microsoft Corporation
msfwsvc.exe 1620 OneCare Firewall service Microsoft Corporation
winss.exe 1660 Windows Live OneCare Service Microsoft Corporation
alg.exe 492 Application Layer Gateway Service Microsoft Corporation
svchost.exe 2756 Generic Host Process for Win32 Services Microsoft Corporation
lsass.exe 592 LSA Shell (Export Version) Microsoft Corporation
ZCfgSvc.exe 1996 ZeroCfgSvc MFC Application Intel Corporation
taskmgr.exe 2056 Windows TaskManager Microsoft Corporation
explorer.exe 848 Windows Explorer Microsoft Corporation
winssnotify.exe 2184 Windows Live OneCare Tray Notification Microsoft Corporation
firefox.exe 3892 36.27 Firefox Mozilla Corporation
WINZIP32.EXE 2944 WinZip WinZip Computing LP
procexp.exe 2632 Sysinternals Process Explorer Sysinternals - www.sysinternals.com
notepad.exe 1012 Notepad Microsoft Corporation
waol.exe 2348 AOL Software AOL, LLC.
shellmon.exe 3680 waolmon AOL, LLC.
aolsoftware.exe 2924 0.98 AOL AOL LLC

Hmmm, only 1 svchost with 1 child. Right click on the wmiprvse.exe and close the process.

Any change now?

When I got the screenshot, it was after the computer came on and cpu usage slowed down, I was not able to run the program during the first 15 mins or so of turning it on with the internet ethernet cable plugged in. That is when svchost uses 100 of the cpu for bout the first 15 mins then clears up.

When I close it, it just comes back........

https://i.servimg.com/u/f18/14/68/68/39/pe1110.jpg
https://i.servimg.com/u/f18/14/68/68/39/pe2210.jpg
https://i.servimg.com/u/f18/14/68/68/39/pe3310.jpg
https://i.servimg.com/u/f18/14/68/68/39/pe4410.jpg

I unplugged the ethernet internet cable, then run the PE program then plugged in the net and got some screen shots while it was so slow, When you first plug in the internet the computer will not open any programs for at least 15 mns. Programs already open respond slowly, but at least respond. Thanks.

P.S I killed the program as instructed while the puter was running slow and it kept on running slow. This is a pesky problem and not sure where I got it or why? Thanks.

Gotcha, I think I got this.

See in the screenshot the svchost (PID 988) using 96.04 in the CPU list? right click that one > Properties.

When the properties window opens, go into the "Threads" tab, get me a screenshot of the threads tab please.

https://i.servimg.com/u/f18/14/68/68/39/thread10.jpg

There are several of them. I tried to get screen shots of them all but they constantly move and change. Thank you again!

Well, since we can't get the list all in one image, look down the second list (CPU List) and find the one that's hogging the space.

https://i.servimg.com/u/f18/14/68/68/39/110.jpg
https://i.servimg.com/u/f18/14/68/68/39/210.jpg
https://i.servimg.com/u/f18/14/68/68/39/with_o10.jpg

I hate to keep bothering you!
This time as soon as I turned it on without internet hooked up the svchost again ate up my resources.
The first 2 pics are before I plugged in the high speed internet, the next is after.
I killed the svchost and the computer finally got on with the show, What do you think? Thanks!

Hello.
Not a problem, that last image you linked there is actually the problem, see it showing 94? that's the thread that's using your CPU.

Lets see what service it is doing this, go into the services tab and take a picture of that for me, there might only be 1 or 2 services, but 1 of them is causing it. Find it, disable it.

Hey, Hope you had a great new year! The first pic is the services tab before the internet was plugged in after a bootup. The second pic is after the net is plugged in and the third is when I tried to kill the process. Thank you again!

https://i.servimg.com/u/f18/14/68/68/39/new110.jpg
https://i.servimg.com/u/f18/14/68/68/39/with10.jpg
https://i.servimg.com/u/f18/14/68/68/39/error10.jpg

How do we disable it? Thanks.

is msmpeng.exe a legit program?

now it has received 24,200,700 bytes in one hour, is this a lost cause?

Possibly, someone DDoSing your machine can cause that.

What to do?