1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

explorer.exe & SVCHOST.exe gone crazy

Discussion in 'Windows XP' started by Cavitt99, 2004/08/01.

Thread Status:
Not open for further replies.
  1. 2004/08/01
    Cavitt99

    Cavitt99 Inactive Thread Starter

    Joined:
    2004/08/01
    Messages:
    1
    Likes Received:
    0
    After starting WinXP, nothing would respond to mouse clicks, and mouse moved very slowly if at all on desktop. Cntl Alt Del revealed that explorer.exe and SVCHOST.exe were using all the CPU. Usage was at 99-100 % and all of it was between these two processes. No applications were running. Multiple re-boots produced same result. Additionally, multiple copies (2-8) of Pahffa32.exe were randomly spawing and ending. Messages pop-ed up saying that Pahffa32.exe was experiencing problems and had to close. Same for iexplorer which I don't even use !!! I use Mozilla. I was able to fix by doing a system restore but any idea about what's going on here. My system was completely useless! HELP
     
  2. 2004/08/01
    Steve R Jones

    Steve R Jones SuperGeek Staff

    Joined:
    2001/12/30
    Messages:
    12,317
    Likes Received:
    252
    Pahffa32.exe -> does that sound familiar? Looks and smells like a virus to me.
     

  3. to hide this advert.

  4. 2004/08/01
    LDTate

    LDTate Inactive

    Joined:
    2004/06/29
    Messages:
    284
    Likes Received:
    0
    Welcome to the board Cavitt99
    Very possible virus / spyware. I can't find any information on Pahffa32.exe.

    I suggest you do the following.

    Make sure you have the up-to-date versions of Spybot (v1.3), Ad-aware (build 6.181) and HijackThis. All are free and available bellow.
    Download Spybot, install, update and run Spybot. Delete all it finds that is prechecked. Then download Ad-aware, install, update and configure Ad-aware for a custom full scan and run, deleting all it finds.
    Full Scan:
    Click on the Start Button, Tick Use Custom scanning options, Customize

    Scan Within Archives
    Scan Active Processes
    Scan Registry
    Deep Scan Registry
    Scan my IE favorites for banned URL’s
    Scan my Hosts file
    Under Click here to select drives + folders, choose:
    All of your hard drives
    Click on the Advanced button on the left and select:

    Include additional process information
    Include additional file information
    Include environment information
    Include additional object details
    Click the Tweak button and select:

    Under the Scanning Engine:
    Unload recognized processes during scanning
    Include basic Ad-aware settings in logfile
    Include additional Ad-aware settings in logfile
    Under the Cleaning Engine:
    Tick Let Windows remove files in use at next reboot

    Click on Proceed to save the settings.

    Click Start and on the next screen choose Activate in-depth Scan at the bottom of the page and then choose:

    Use Custom Scanning Options
    Click Next and Ad-aware will scan your hard drive(s) with the options you have selected.

    Save the log file when it asks and then click Finish

    When finished, mark everything for removal and get rid of it. (Right-click the window and choose Select All from the drop down menu and click Next).

    Download HijackThis from link in my signature. Save it to a permanent folder (I create a new folder in C:\ named HJT). Open and hit scan, then save log. Once it is saved it will open in notepad. Select all from the edit button, copy and paste the results here. Post a HijackThis log.
    Don't fix anything with it yet! Someone experienced with the logs will advise you.
     
  5. 2004/08/01
    sparrow

    sparrow Inactive

    Joined:
    2004/03/21
    Messages:
    2,282
    Likes Received:
    0
    You were infected, restore may have eliminated the worst, but you should check further. Suggest you use the advice on this thread and post back a hijackthis log (after cleaning all you can with your antivirus, spybot and adaware as indicated in the thread.
     
    Last edited: 2004/08/01
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.