# help please



## al (May 10, 2002)

running winXP,sp2, 526megs mem, something is hogging all the memory. Task manager shows over 50 processes running. Performance shows 428 megs in use at startup however the start-up log shows only four items. HJT log attatched. What can I get rid of. Please. Thank you-all for your help.Al
Logfile of HijackThis v1.99.1
Scan saved at 1:31:38 PM, on 2/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\LTMSG.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\windows\system\hpsysdrv.exe
C:\Windows\system32\HpSrvUI.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\progra~1\yahoo!\YCentral\YahooCentral.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\PeoplePC\ISP6300\Browser\Bartshel.exe
C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
C:\PERSONAL\DOWNLOADS\sswt32(1)\SSSwitch.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\PeoplePC\ISP6300\Browser\PPShared.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\PeoplePC\ISP6300\Browser\Bartshel.exe
C:\Program Files\PeoplePC Accelerated\PeoplePC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\Antivirus\tmproxy.exe
C:\Program Files\Trend Micro\Antivirus\Tmntsrv.exe
C:\Program Files\Trend Micro\Antivirus\PCClient.EXE
C:\Program Files\Trend Micro\Antivirus\PCCGUIDE.EXE
C:\Program Files\Trend Micro\Antivirus\TMOAgent.exe
c:\Program Files\Microsoft Money\System\urlmap.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus.../*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus.../*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://srch-us4.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PeoplePC ScamGuard - {7E3659A6-4BC5-4d93-B3FD-8B5ACC2FEDED} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - C:\Program Files\PeoplePC\Toolbar\PPCToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: AnonProxyBar - {0520255B-04B4-427A-9D3F-67435F6C93D9} - C:\PROGRA~1\ANONPR~1\ANONYM~1.DLL
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - C:\Program Files\PeoplePC\Toolbar\PPCToolbar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [PreloadApp] "c:\hp\drivers\printers\photosmart\hphprld.exe" c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [hp Silent Service] C:\Windows\system32\HpSrvUI.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe"
O4 - HKLM\..\Run: [YCentral] c:\progra~1\yahoo!\YCentral\YahooCentral.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Antivirus\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Antivirus\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Antivirus\TMOAgent.exe" /run
O4 - HKLM\..\Run: [Bart Station] "C:\Program Files\PeoplePC\ISP6300\BIN\PPCOLink.exe" -STATION
O4 - HKLM\..\Run: [DVD43] "C:\PROGRA~1\DVDREG~1\DVDRegionFree.exe" /hidden
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background


----------



## Nevada (Sep 9, 2004)

It's easier to determine that in the task manager. Do a Ctrl-Alt-Del to bring up the task manager, then select the Performance tab. That will give you an overview of your CPU & memory usage.

To find the particular culprit, click the Processes tab. Make the task manager full screen by clicking the square in the upper right corner, so you can see all the processes at the same time. You can monitor the various processes as they consume CPU and memory resources. You should get a very good idea of which applications are consuming your resources on that tab.

Good luck!


----------



## FalconDance (Feb 4, 2007)

I'll have my son look thru the list to see if he spots any baddies when he gets home. 

~Falcon


----------



## al (May 10, 2002)

Nevada, been there done that as for CPu usage it stays around 2% , but the memory is aeound 426 MB all the time. As for the processes tab, there are too many to get in one window even with it full screen. Thank you for the reply.Al


Falcon: thank you, I would appreciate any help your son can muster. Al


----------



## Gary in ohio (May 11, 2002)

You can get rid of a lot of junk, are you using an ipod? if not you can get rid of the itune helper. Its not needed. What printer(s) do you have? looks like a lexmark and HP are you using both? Are you on broadband or dialup? Bartshel.exe, PeoplePC.exe and PPShared.exe is a pc people dialup piece. If your running broadband via wireless these can go. If your on dialup then the wireless services can go.
Are you really using all that yahoo toollbar stuff?

I would pick a DVD manager, looks like you have nero and a couple of DVD piceces running do you really need them all the time? pick one.

If you want to take a look at a lot of the junk that starts on start up 
START-> run-> msconfig then click on startup tab. See what is running. You can check and uncheck them as needed.


----------



## al (May 10, 2002)

Gary, thanks for the response. I basicly know how to get rid of some of the trash, but the big question I need to ask is how do I figure out what all those abv stand for. Very little of it that I can decipher. Some where I heard to google the abv and it would tellme what it was, but havn't had much luck with that. Al


----------



## Nevada (Sep 9, 2004)

al said:


> Nevada, been there done that as for CPu usage it stays around 2% , but the memory is aeound 426 MB all the time. As for the processes tab, there are too many to get in one window even with it full screen. Thank you for the reply.Al
> 
> 
> Falcon: thank you, I would appreciate any help your son can muster. Al


Then you'll have to scroll down to review the resource usage on the Processes tab.

I'm not trying to belittle the HT report, but it doesn't tell the whole story. It tells you that something is running, but there's no information on how it's configured or what resources it might be using. There's simply no substitute for looking at the actual resources being used.

I guess the question is, why are you concentrating on a report that tells you what processes are running but can't say what the resource usage is, when you already have another source of diagnostic information that gives you both? 

If you are refusing to review the task manager Processes tab because you don't like to scroll, you are turning your back on the most definitive tool XP has to offer for this particular type of problem. The Processes tab will tell you exactly what process(es) is/are consuming your resources. I can't encourage you enough to use it.


----------



## MELOC (Sep 26, 2005)

one fast tip to help id some of the junk is to see which processes have your name next to them as opposed to "system".


----------



## al (May 10, 2002)

Nevada, thanks for the response, I did the scrolling on the Processes list and found some items that are really hogging the memory, however I don't under stand what all those items are for. (example) bartshell.exe, listed twice. svchost.exe. csrss.exe. The reason I used the HT list is that was called for in the things to do monthly at the top of the page. I had completed all of those items and it still was using all the memory up. Al


----------



## Nature_Lover (Feb 6, 2005)

Log-in as administrator for tweaking services and startups.

Clean out your startup folder in start menu, while you're at it, clean out 'all users' startup folder, too. Drag the links to a new folder in 'Start Menu>All Programs' called "Disabled Startup Apps" so you can recover them if you change your mind about a program not loading at startup.

Disabling non-essential processes loading at boot in msconfig is an excellent troubleshooting method, disable one at a time and reboot to check if it frees memory. 

However, for permanent changes you want to disable 'startup at boot' from within the program itself whenever possible, and then if you can't do it there, use the services interface: >start menu>all programs>administrative tools>services 
-->don't see administrative tools? right-click on the taskbar, start menu tab, customize, advanced tab, scroll to the bottom and select to view 'System Administrative Tools' in the All Programs menu, OK, Apply.

Here are some links to filename and process list databases, you said you wanted to know what the abbreviations are, these will tell you. Do not make any changes without checking it out in at least a couple of places, one wrong click can disable essential services, or the processes they depend on.

Pacs-Portal Startups Database

Kephyr's File Database

process library


Here's a page with Black Viper's XP Pro Services Configuration  tweak suggestions.
Three years ago using his pages I had my XP Pro machine running fast with only 27 processes running at boot, now it loads 32 processes with all of the anti-malware and utilities I've added on.

Hope this helps...


----------



## Nevada (Sep 9, 2004)

al said:


> Nevada, thanks for the response, I did the scrolling on the Processes list and found some items that are really hogging the memory, however I don't under stand what all those items are for. (example) bartshell.exe, listed twice. svchost.exe. csrss.exe. The reason I used the HT list is that was called for in the things to do monthly at the top of the page. I had completed all of those items and it still was using all the memory up. Al


Bartshell.exe is the Bartshell Module, commonly known as the "PeoplePC pest". It's a spyware payload that's installed along with the PeoplePC connection software. Of course you can close it after each boot, but the best solution is to remove it. It's not necessary for connection, even if you're still using PeoplePC. Bartshell alone is enough to cause your problem. You'll have to call PeoplePC tech support to remove it. 1-866-772-6277 

Svchost.exe is part of Windows XP, so normally it's not a problem. I've had problems with svchost.exe drawing high CPU usage in my machine. I finally had to disable automatic Windows updates to stop it from doing that, but you evidently have a memory problem, not a CPU usage problem.

Csrss.exe is an interesting one. That is the name of a legitimate Microsoft application (the Microsoft Client/Server Runtime Server Subsystem) but can also be a trojan virus called Ahlem.A Worm that can allow access to your machine, or even a mailer worm called W32.Netsky.AB. So how do you tell which it is? Easy, in the task manager try to end that process. If it's the legitimate Microsoft file it will tell you that it's a critical system process so it can't be stopped. If you can stop it, then it's probably a virus. 

Microsoft also reports that csrss.exe can use 100% of the CPU if your user profile is corrupt, but your problem seems to be memory not CPU.

http://support.microsoft.com/kb/555021


----------



## al (May 10, 2002)

I want to thank all of you that offered help. Being I am old and slow it will take me a while to get thru all the information offered. Thanks again and yo-all have a great day. Al


----------



## Gary in ohio (May 11, 2002)

Svchost.exe is a helper process and can work with MANY different programs. It in iself is not a program that would run, but is run in conjustion with other programs.


----------



## al (May 10, 2002)

Thanks Gary, that one svchost.exe seems to be a real hooog. Under the processes tab it is listed a total of seven times, with a total of 134,712K of ram ussage. Just looks like a well sloped hog to me. Thanks and have yourself a fine day. Al


----------



## Nevada (Sep 9, 2004)

al said:


> Thanks Gary, that one svchost.exe seems to be a real hooog. Under the processes tab it is listed a total of seven times, with a total of 134,712K of ram ussage. Just looks like a well sloped hog to me. Thanks and have yourself a fine day. Al


134 megs used by svchost.exe, wow. 

First, try disabling automatic updates temporarily. To do that, go to the Control Panel and double-click on the Security Center icon. At the bottom click on Automatic Updates, then select Turnoff Automatic Updates. To prevent pop-up warnings from bugging you, on the left side click "Change the way Security Center alerts me" and uncheck the Automatic Updates box. Restart your computer to get a fresh loot at your memory usage. After restarting, take a look at your memory usage in the Task Manager. If it didn't help then you can go ahead re-enable automatic updates.

Also, search your hard drive for svchost to see if there are any bogus svchost.exe files. You should only see two, in these locations:

c:\windows\system32
c:\windows\servicepackfiles\i386

If you see svchost.exe in any other location then it may be a virus.

By the way, it's normal to see several instances of svchost.exe on the Processes tab in the Task Manager. That's the way it's supposed to work.

There is also a possibility that a network bug is causing svchost.exe to use memory. Do you have a network cable plugged into your network adapter?


----------



## al (May 10, 2002)

Nevada,thanks for the reply, checked the memory, running at370 MBdisabled auto update, reboot checked memory down to 325 MB. Did search for svhost.exe. Found the two you referenced plus one more with a dash 2D5FBD18.pf in c:\windows\prefetch, size 16KB, type PF, date modified, today about four minutes ago.
Negetive on the network cable.Thanks,Al


----------



## ericalbers (May 31, 2006)

Please go to www.windowsstartup.com and download startup inspector.

Its free, it contains no spyware etc, and will show you EVERYTHING which starts when you boot up. It allows you to disable stuff too, its very nice

http://www.windowsstartup.com/

Eric


----------



## Teresa S. (Mar 2, 2006)

Why not use 'Msconfig' that is buit into Windows? Go to START===>RUN===> and type msconfig. Gives you the same results.


----------



## al (May 10, 2002)

Thanks Teresa, I have been there done that. start up shows 27 items, but my problem is I don't know what I should get rid of .Al


----------



## Teresa S. (Mar 2, 2006)

Can you post a 'list' of what's in there so we can decide what things 'need to go'?


----------



## al (May 10, 2002)

I'll try
qttask,ps2,setup,rundll32,ltmsg,KBD,igfxtray,hpsysdru,hpztsBo4,hpsrvuI,hkcmd,yahoo central,pccguide,pcclient,tmoagent,ppcolink,lxczbmgr,nero chk,itunes helper,dvdtray,dvdregion free, spy sweeper UI,msmsgs,ypager,hpcenteruI,hpcenter,sswt.
thank you for your help.Al


----------



## Teresa S. (Mar 2, 2006)

Thank-you, most of that junk can be disabled.
Disable:
yahoo cantral
pccguide
nero 
itunes
hpcenteruI
hpcenter
msmsgs

Also, do you have an ipod? As gary said, if you don't, we can remove 'itunes'.
I would consider removing 'Bartshell.exe' (as said by Nevada), I do this after I install my peoplepc software and I see a good 'boost' in the speed of my system.


----------



## Nature_Lover (Feb 6, 2005)

I realize I'm a few days late...
Don't disable pccguide, it's your antivirus.
Check out the startups with the pac's portal link in post #10.


----------



## Teresa S. (Mar 2, 2006)

So I guess the are using trend micro 2002? Sorry for telling you to disable that


----------



## Kung (Jan 19, 2004)

They can also disable qttask - it's the Quicktime Taskbar icon. (Although preventing that from starting up is a bit like killing a cockroach - you can darn near set off a nuclear device, and it'll just laugh at you.)


----------



## al (May 10, 2002)

First off I want to thank ya-ll for all the help and guidence on this project. I have tried and used all the advice above, and had , what I think , good sucess, as before on start up we were using 428 megs of ram and now it is down to 342 megs on start. Waiting for my DS to get a day off from his work and see if we can upgrade this thing with more ram. Thanks again and you guys have a great weekend. Al


----------



## Guest (Mar 8, 2007)

Kung said:


> They can also disable qttask - it's the Quicktime Taskbar icon. (Although preventing that from starting up is a bit like killing a cockroach - you can darn near set off a nuclear device, and it'll just laugh at you.)


 Yes! I have to disable that every couple of days. I don't know how it starts itself again. And again....


----------



## Kung (Jan 19, 2004)

Do you disable it in the registry, or actually go into Quicktime Preferences and tell it to not start in the Taskbar?


----------



## Guest (Mar 8, 2007)

Kung said:


> Do you disable it in the registry, or actually go into Quicktime Preferences and tell it to not start in the Taskbar?


 Registry.

But now that you mention it, next time it starts, I'll go into QT prefs.


----------



## Teresa S. (Mar 2, 2006)

Quic Time should be illegal! It slows my pc down, even if it is off.


----------



## Nature_Lover (Feb 6, 2005)

I use Spybot S&D TeaTimer Resident, and Quicktime is in my blacklist, the resident doesn't let it rewrite the startup reg key.
I couldn't find the setting in quicktime.


----------



## al (May 10, 2002)

Kung, thanks for the tip, but can't find what you referenced. Open it, edit,pref,it lists three pref; 
player pref
Q.T. pref
registration
No where under these headings does it say anything about start up in the task bar. Al :shrug:


----------

