4,000 successful logons at noon.....

[Teri]

When I shut my computer down last night everything was
fine, this morning I could barely make it off the
desktop. Everything I tried to do would hang, I could go
on line but I couldn't view any web pages. I went into
event viewer and I had 4,000 successful logons at 12:00.
I cleared all of them went back 5 minutes later and I had
2,000. My clock stopped and Task Panel wasn't
responding, my cpu usage was at 100% all morning. I
finally got to a place which said "Launch System
Restore". I could not even get into "Help". I am
running XP Home. I I really want to know what might have
caused this so I don't do it again. When I finally got
an error message this is what it was
Event Type: Error
Event Source: IPRIP
Event Category: None
Event ID: 29028
Date: 5/30/2004
Time: 4:22:55 PM
User: N/A
Computer: OEMCOMPUTER
Description:
IPRIP was unable to create a socket for address
209.128.147.90. The data is the error code.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7a 27 00 00 z'..

 

[D.Currie]

Take a look at this:

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.portless.html

 

[Teri]

I followed your advice but its not going to be that one.
As far as I can tell my regestry hasn't been altered at
least not in the areas they discussed. What ever it is
it effects the Task Panel the most. Can you think of
anything else it might be?

 

[D.Currie]

It's got to be some sort of Trojan or virus or spyware. You say the CPU runs
at 100%. What process is using the most of that? Have you checked in
msconfig to see if there's anything suspicious running?

 

[Teri]

Yes, the CPU ran at 100% without changing at all. Task
Panel was using almost double its normal usage but it
would never open. I could click on start - nothing, I
could right click on the task bar-nothing. I did check
MSCONFIG and there was nothing unusual there. Out of 15
errors I received in my event viewer for that time frame
all of them were"Application Hang" except for this one
Event Type: Error
Event Source: EventSystem
Event Category: (50)
Event ID: 4609
Date: 5/30/2004
Time: 1:59:51 PM
User: N/A
Computer: OEMCOMPUTER
Description:
The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 8007043C from line
44 of d:\nt\com\com1x\src\events\tier1
\eventsystemobj.cpp. Please contact Microsoft Product
Support Services to report this error.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[D.Currie]

Yes, the CPU ran at 100% without changing at all. T

But which process?


ask

Panel was using almost double its normal usage but it
would never open. I could click on start - nothing, I
could right click on the task bar-nothing. I did check
MSCONFIG and there was nothing unusual there. Out of 15
errors I received in my event viewer for that time frame
all of them were"Application Hang" except for this one

Which application?

 

[Teri]

Hanging Application Hang Module
(4) version 0.0.0.0 pcre.dll
(6) Task Panel hungapp
(1) hlpctr.exe mshtml.dll
(1) spybotsd.exe hungapp
The first one did not give a name of an application it
just showed version 0.0.0.0.
As far as processes I don't think I know what the "norm"
is supposed to be.

 

[D.Currie]

Hanging Application Hang Module
(4) version 0.0.0.0 pcre.dll
(6) Task Panel hungapp
(1) hlpctr.exe mshtml.dll
(1) spybotsd.exe hungapp
The first one did not give a name of an application it
just showed version 0.0.0.0.
As far as processes I don't think I know what the "norm"
is supposed to be.

Ok, but you keep saying the CPU is at 100%...so where are you getting that
number from? I was assuming you were looking at the task manager.

If you open Task Manager and look at the Processes tab, under CPU it will
show you how much of the CPU each process is using. At this point it really
doesn't matter what listed there as the norm (and there is no norm, as
everyone will have different things running on their computer), it just
matters which ones are tying up the processor. If you see which one is using
up large chunks of the processor's time, you'll have a better ideas where to
start looking for problems.

You said you checked msconfig and there's nothing abnormal running
there...but if you aren't familiar with the processes in task manager, are
you sure the things in msconfig -- both the services and startup tabs -- are
okay?

Actually, it might end up being more productive to download Hijack This and
then post the results of that to one of the forums that will look at it for
you. That log is way too long to post here, but it's pretty comprehensive
and might yield the best results.

There's obviously something running that isn't supposed to, but picking at
it bit by bit like this is going to take a lot of time.

 

[Teri]

You are right. Thank you for your help and I already
have Hijack This and the log I'm just not sure where to
post it. I did get the 100% from Task Manager on the
application page at the bottom. I know that Explorer
was running about 8,000k and task panel was running about
4,000k. Those are the two that I knew immediately were
using a lot more than usual.