Member Avatar for clinton.havens

So i just wiped my laptop and installed XP Home SP3. Everything was going find until I started downloading a few things, software removal tools, pc maintenance tools, etc. I started to see that my firefox is using about 50% of my cpu usage anytime that it's open now. Not only that, but when I try to access my C drive it gives me the generic Windows error report that you can choose to send or not send, but the program it lists is the odd the part, the program that's listed is:
I don't know why it's giving this, my first instinct was to assume that it was a virus. So I ran 2 virus scans, first with Panda, and the second was with AVG. Nothing showed out of the ordinary. So that's why I'm here now, I was curious if anyone had any ideas as to what could be causing this. Also I cannot access the internet at all with Internet Explorer, this is kind of meaningless to me, because IE is useless.

Thanks if you actually stuck around to read the whole thing, and also thanks in advance for any input.

-Clinton

  • 4 Contributors
  • 5 Replies
  • 96 Views
  • 6 Days Discussion Span
  • Latest Post Latest Post by clinton.havens

Dani AI

Generated

A concise, practical follow-up that complements , and by turning the troubleshooting ideas into repeatable steps and cleanup tasks. The odd SID-like string in a crash report often points to a user-profile/registry artifact; persistence and browser settings are common places for remnants after an infection.

First, identify the live culprit before making changes. Use Process Explorer to inspect any high-CPU or network-active process (right-click -> Properties -> Threads/Modules/Handles). Use Autoruns to find and disable suspicious auto-start entries (services, scheduled tasks, shell extensions). Both tools are part of the Sysinternals suite and are designed for this kind of forensic check: (Process Explorer) https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer and (Autoruns) https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns.

Second, verify profile/registry state and browser configuration. Check the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList to confirm each SID maps to a valid ProfileImagePath. If a profile is corrupt, create a new local account and copy user data (Documents, Pictures, Favorites) but do not copy ntuser.dat or AppData\Local/Temp. For Firefox issues, create a fresh profile or use the Refresh feature to discard corrupted settings: https://support.mozilla.org/en-US/kb/refresh-firefox-fix-problems

Finally, finish with rootkit/boot-level checks and hardening. Run an anti-rootkit scanner or a rescue ISO if persistence is suspected, reset browser proxy/hosts entries, change important passwords, keep only one reputable real-time AV, and consider moving to a supported OS—unsupported systems are a continuing risk (Windows XP reached end of support). These steps reduce the chance of a return infection and remove registry/profile artifacts that can show up as strange program names in error reports.

Recommended Answers

All 5 Replies

Member Avatar for HoustonIT

Are you running two antivirus apps at the same time? If so, remove one of them and see if that helps. Also, you might want to remove the maintenance tools as well.

Member Avatar for clinton.havens

Are you running two antivirus apps at the same time? If so, remove one of them and see if that helps. Also, you might want to remove the maintenance tools as well.

No, I know that you shouldn't ever use 2 antivirus softwares together. I used Panda, uninstalled it and then used AVG, I uninstalled the maintenance tools as well as everything I had installed after the issue had started to occur.

Member Avatar for Suspishio

I find that IE (I don't use FireFox much) only uses a lot of CPU if it's busy with authentication of a site it's trying to reach.

looks to me like the wrong thing's been pasted somewhere. Your egistry probably has a key S-0-6-98-100016064-100025734-100005007-2661 which is the way it stores user. I've no idea how it got to Firefox.

If I'm right, the key to debugging this is:

1/
Look in the options for Firefox and see whether that string has crept in somewhere

2/
Using Regedit, search for the string both with .com (unlikely to find anything but might if you've got malware) and without.

Then get back to us.

Member Avatar for cguan_77

try to scan your system with malware bytes...

Member Avatar for clinton.havens

try to scan your system with malware bytes...

That actually found 11 infected files, upon removal my C: drive is accessible now, and my IP isn't being blocked from several websites for initiating DOS attacks on the the websites.

Thank you for all for the input and your time.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.