jaydee109

Thank you very much sir

Here's the link, File Inspect seems to be informative. http://www.fileinspect.com/fileinfo/svchost-exe/ FYI... if you reboot your computer you might have to redo the priority but it's no big deal to redo.

Yes, it's date stamped 10/24 I believe. I've already tried that and I get the error message file corrupted can not continue. I went browsing Microsoft Tech Net for the cpu usage and came across a fix that suggested resetting the priority to "low", which I did. Things seem to be working much better at present. Ran both Norton and MBAM with no problems found on either. Only thing that wasn't scanned was the portable hard drive which I disconnected. Think I'll just replace it and go from there. Me thinks I'm good to go unless you have anymore suggestion.

Afternoon Sir, Just a short note to thank you for your time. I appreciate your advise and guidance, not to mention patience. I believe that my problem started from a Windows Update done on 11/12 or so. From what I've read that's where a lot of high CPU problems come from. Again I thank you for your time,

Verification please... download site for Java says Version 8, update 25 available, when I attempt to remove old version it says I already current version... Version7 update 71 and stops. I don't understand ???

Morning, Tried to do a system recovery yesterday and couldn't complete. Said a broken or corrupted file prevented it. Great. Please read the HiJackThis log, has a lot of "file missing", "unknown user" performing tasks" and various registry changes. I don't what to do. I can't afford to loose all the info on here due to medical issues. And I don't trust the back-up drive due to its past behavior. Lately, the Java Updater has been flashing windows for new version upgrade. Flashes on once every 15 to 30 seconds. Tried disabling or killing the task but keeps coming back. This is really getting frustrating. Please advize. hijackthis.log

Couldn't export the MBAM scan to .txt It wasn't there. Finally was able to find it in MBAM folder under the quarantine\ log. So ran another scan and it showed up where it should be but after selection it wouldn't export to .txt. Couldn't even select and view (grey out) Went back to Explorer Malwarebytes\log not the quarantine one and low and behold all 600 or so logs were GONE. finally found them under quarantine \log. OK' so I'll just transfer back where they belong. Nope, said I needed admin account except I'm logged in under admin. Eh, went to shortcut did the run as admin thing. Still came back "needed admin" ??? OK, let's try to move just a couple files, need admin. Lets delete the oldest log file...nope. So I had to do the HTML post. Couple interesting things, when the virus was found the post stated it was run at 3:30 something AM(my time) and manual. I was sound asleep. My puter does things on its own just like relocating all those logs. Another thing I noticed yesterday morning was my portable hard drive was performing a back-up of 5 or so hours. Now the activity light was on steady not flashing like it does when working. So I opened the program and got the welcome message, proceeded to check the back up( lately it's been missing 40 0r so files that won't back back up due to use by another program). The little progress bar was just ticking away. Disconnected it thinking might be the cause of the CPU usage. Not that lucky. Now CPU is using both cores at almost 100%. Another point, while trying to remember \ find out how to make the task bar hide the letters ENG showed up on the task bar. The balloon message said something like "Language English press space bar + something to change). Fast as it showed up it left. This things acting like it's got a mind of it's own. OK... may I delete the quarantine log for the "Trojan" just to ease my mind (probably won't let me). What's next? mbam-log-2014-11-25 (20-32-48).xml FRST.txt Addition.txt

Quick question, should I delete the previous frst.txt and addition.txt from the desktop before proceeding?

Overnight MalwareBytes performed a scan and found Trojan.Sharik.VX which it quarantined. Also my e-mail service notified me that 20 pieces of spam had been sent from my account, which I hadn't done. protection-log-2014-11-24.xml

Attachments per your instructions... mbar-log-2014-11-24 (13-23-04).txt system-log.txt FRST.txt Addition.txt

Mr. Eagle, Downloaded root kit, updated, ran scan, exited Mbam, got error message that scan failed, tried again, same thing, tried to download FRST, downloaded, Norton blocked it and removed. said unsafe. Do I need to go thru Auto Runs and disable anything to do with Mbam. J

Good Morning, Using Task Manager, I found Service Host: Local Service (No Impersonation) (5). In details shows svchost.exe PID 2524, running, LOCAL SERVICE, CPU between 78 and 89. In services portion of Task Manager I have 5 services, Upnp Device Host, Time Broker, SSDP Recovery, Sensor Monitoring Service and Function Discovery Resource Publication. PID is 2524 for all 5. System is an HP Pavilion 500-023w Desktop Intel Core i3 3240 3.4 GHz Dual Core 8GB memory 1 TB SATA drive I have tried to download FRST a couple of times but Norton red flagged it and deleted from desktop. Also have 3 references to WOW64 in AutoRuns but it says file not found, tried to delete but comes right back. Norton has been giving me high CPU usage errors which seem to be happening more frequently. Awaiting your instructions on how to proceed. J

Borislav. I am glad you gave me the detailed explanation you did. Now if I might ask you another question concerning repairing the drive. I have tried using the dell supplied recovery disc but I can't get the option that reformats the hard drive. Can you help with that or should I ask elsewhere? J

Hi Borislav, After re-reading your post and contemplating the situation I think reformatting would probably be the best option, however I do have some concerns about the recovery procedure. I do not have an Windows operating disk but a recovery disc from dell. I also don't have a product key to re-actvate the OS. I have heard that some how it is embedded in the BIOS. Your thoughts please. J

Hi Borislav, Pleased to meet ya. At this point I would like to proceed with you guidance. Before we start though, I could not find the e-mail reply option, I would like to use it if I could. Thanks... Now where should we start? J