Explorer at 100% when accessing a Hard Drive

Help Desk Psycho · #1 01-16-2010

Hi there everyone,
Hope you all had a great holiday season.

I was wondering if someone could help me solve this conundrum.
I have a P4 2.6 GHz computer with 2 Gigs of Ram and 3 80Gig Hard drives. It's been running super great for a long time until recently. Now, every time I try to access a folder in my second (not primary) drive and just scroll down (or access any file or subfolder), explorer.exe jumps to 100%.

What's weird is that the root of this drive has 3 folders and this incident only happens when I access one of the three folders in particular.

Now that I am typing this I am wondering if I typed it in the right forum. I first assumed it may be some sort of malware ... but ... I'll let the jury decide on that one.

I have Norton Internet Security 2010 and I've run AdWare, MAlwarebytes, IOBit Security 360 and have defragged all my drives.

Thanks in advance for your help.

God Bless
-Frank-

PS. If you need a Hijackthis log, please let me know.

Help Desk Psycho · #2 01-16-2010

Hoping someone could help soon, this is quite a frustrating problem since I use a lot of files on this drive (and in this particular folder).

To speed things up, I'll provide the Hijackthis log. Thanks again for your time mates.

-------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:10:01 AM, on 17/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\csrss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\system32\svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Installations\Utilities and Security\IObit Security 360\IS360srv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\windows\system32\SearchIndexer.exe
C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
C:\windows\System32\alg.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Installations\Utilities and Security\IObit Security 360\IS360tray.exe
C:\windows\System32\svchost.exe
C:\windows\system32\ctfmon.exe
C:\Installations\Applications\Microsoft ActiveSync\wcescomm.exe
C:\Installations\Applications\Skype\Phone\Skype.ex e
C:\Installations\Utilities and Security\PeerBlock\peerblock.exe
C:\INSTAL~1\APPLIC~1\MICROS~1\rapimgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Installations\Utilities and Security\Sony Corporation\Image Transfer\SonyTray.exe
C:\Installations\Applications\SnagIt 9\SnagIt32.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Installations\Applications\SnagIt 9\TSCHelp.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Installations\Applications\SnagIt 9\SnagPriv.exe
C:\Installations\Applications\Skype\Plugin Manager\skypePM.exe
C:\Installations\Applications\SnagIt 9\snagiteditor.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Installations\Utilities and Security\IObit Security 360\is360.exe
C:\INSTALLATIONS\UTILITIES AND SECURITY\PROCEXP.EXE
C:\Installations\Utilities and Security\Auslogics Disk Defrag\diskdefrag.exe
C:\windows\explorer.exe
C:\Documents and Settings\Frank Musulinaro\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Frank Musulinaro\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Frank Musulinaro\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Frank Musulinaro\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Documents and Settings\Frank Musulinaro\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Frank Musulinaro\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Frank Musulinaro\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\Installations\Utilities and Security\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.musulinaro.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
R3 - URLSearchHook: EvonyNet Toolbar - {36a4bdcd-d5b5-4618-b144-e335d0f3d381} - C:\Program Files\EvonyNet\tbEvo1.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Installations\Applications\SnagIt 9\SnagItBHO.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: EvonyNet Toolbar - {36a4bdcd-d5b5-4618-b144-e335d0f3d381} - C:\Program Files\EvonyNet\tbEvo1.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\IPSBHO.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - (no file)
O2 - BHO: Ask.com Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Installations\Applications\SnagIt 9\SnagItIEAddin.dll
O3 - Toolbar: EvonyNet Toolbar - {36a4bdcd-d5b5-4618-b144-e335d0f3d381} - C:\Program Files\EvonyNet\tbEvo1.dll
O3 - Toolbar: Ask.com Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Installations\Imagine and Create\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [IObit Security 360] "C:\Installations\Utilities and Security\IObit Security 360\IS360tray.exe" /autostart
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Installations\Applications\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Skype] "C:\Installations\Applications\Skype\\Phone\Skype. exe" /nosplash /minimized
O4 - HKCU\..\Run: [uTorrent] "C:\Installations\Applications\UTorrent\uTorrent.e xe"
O4 - HKCU\..\Run: [PeerBlock] C:\Installations\Utilities and Security\PeerBlock\peerblock.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Frank Musulinaro\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKLM\..\Policies\Explorer\Run: []
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: SnagIt 9.lnk = C:\Installations\Applications\SnagIt 9\SnagIt32.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\INSTAL~1\APPLIC~1\MICROS~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\INSTAL~1\APPLIC~1\MICROS~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\INSTAL~1\APPLIC~1\MICROS~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1249243461156
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...Uploader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762# # (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: IS360service - IObit - C:\Installations\Utilities and Security\IObit Security 360\IS360srv.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Help Desk Psycho · #3 01-18-2010

Hello there mates,

Just wondering if anyone had any ideas on this. I'm at my wit's end in regards to this. I've just been ignoring it since real life has been keeping me quite busy but I know there is something wrong and find it frustrating that I can't access these files without bogging down my system. I am having issues backing the files up since everytime I go in it to burn it on a DVD, it takes very long.

Anyhow, anything you can do to help will be totally appreciated.

Take care

***Lonny*** · #4 01-31-2010

C:\Installations\Applications\Skype\Phone\Skype.ex e looks very suspicious.

That being said - since you said this issue only happens when you access your second drive it sounds as though this is a physical issue and not a logical (software based) issue.

What version of windows are you using?
Do you have ANY issues if you do NOT access the second drive?
What happens when you physically disconnect the second drive?

SpiritWind · #5 02-05-2010

Hi :

Could be a "conflict" since you have BOTH Norton Internet Security and
the programming-stealing ( from Malwarebytes Anti-Malware ) IOBit on
your computer !?

Could be the "Snagit" program !?

And you seem to have an overabundant of "toolbars" !?

What are you doing having that adware "Ask" toolbar !?

Help Desk Psycho · #6 02-05-2010

Thank you for taking the time to respond Lonny and Spiritwind. I apologize for my delay in response.

Lonny: I suspected that it may have been a hard drive issue but have since run several diagnostics (including the one offered by the hard drive manufacturer WD - which happens to be the brand of all 3 of my hard drives). The hard drive in question passed all tests offered. I actually haven't tried to disconnect it as it never crossed my mind seeing as this problem only occurred when accessing my folders on this drive. Could the files system on this drive have been tampered with or damaged? I'm using Windows XP Pro With the latest SP and patches.

Spiritwind: I was getting desperate and stumbled on IObit to try and help discover the culprit when Norton, Malwarebyte and a few other tests didn't find anything. Moment of weakness on my part.

- Another one being the fact that I was caught with all those toolbars.

- The only one I purposely installed was the Evony toolbar (a game I played many months ago). I've stopped using IE so that toolbar lagged behind and I forgot about it (I had also stopped using Firefox since it's been crashing a lot when I was on a few intensive Flash sites at a time). Snagit is actually a legit screen capture tool I've been using for many years (even used it on the job as a help desk techie).

I'm actually baffled by all this and don't know what is causing this. I've tried emptying the drive another 30%, defragged it and nothing changed.

I've now removed all the toolbars.

So then could the Master File Table have been damaged by some malware, can this be the cause of my grief?

Thanks again and God Bless

SpiritWind · #7 02-06-2010

Hi Frank :

Since you did NOT mention IF you had "removed" IOBit, I will mention that a couple of people have developed an IOBit Removal Program after Malwarebytes caught them stealing their programming; it is called "IOBit Remover" and details are available at www.t-tools.nl/bitremoveren.php .

And I wonder HOW your PeerBlock interacts with the firewall
"component" of your undesirable Norton Internet Security !?
Norton had the 2nd worse "Result" in the latest "Retrospective/
Proactive" testing ( the degree of effectiveness of keeping
malware OFF a computer ) done by the Independent
Researchers at www.av-comparatives.org .

And I am a strong Advocate of NOT having P2P programs like
your uTorrent, though I suspect your PeerBlock may help
negate some of its potential negativity !?

On to "explorer.exe" - Your log implies you have the Process
Explorer program on your computer !? Have you used it to try
and get details, such as clicking on "explorer.exe" and looking through the "List" that appears in the bottom pane for any
"suspicious" ( usually they are "dll" ) Entries that you would further
investigate !?

***Lonny*** · #8 02-09-2010

Originally Posted by Help Desk Psycho

Lonny: I suspected that it may have been a hard drive issue but have since run several diagnostics (including the one offered by the hard drive manufacturer WD - which happens to be the brand of all 3 of my hard drives). The hard drive in question passed all tests offered. I actually haven't tried to disconnect it as it never crossed my mind seeing as this problem only occurred when accessing my folders on this drive. Could the files system on this drive have been tampered with or damaged? I'm using Windows XP Pro With the latest SP and patches.

Ok, good to know you've run the test. It's entirely possible that the files on the HDD have been tampered with. Since you have three try to disconnect the two that do not have the OS installed on them. Be sure to adjust the Master/Slave jumper as needed.

Let us know the results.