CPU Gone Wild?

[Buckwild]

After installing Adobe Flash Player, I have 99% CPU usage on idle!

My process finder: HiJackThis gives Me location of program startup.

HDDefrag.exe sure seems to be using plenty of resourses, But I'm not defragging, Hmmm.

WireShark packet sniffer.

2 Ips keep getting packets from My computer.

Destination: United Kingdom...

and California.

Let's have a look at this...

hddef.bat is a startup windows script.

I'll rename the file extension to text to disable it.

After restarting Win7, I get Script Host error.

Not the most elegant fix, but it works, HDDefrag.exe doesn't run.

I don't care about spyware but this program had to go,

Flash Player at youtube still works.

[RedBaird]

You're not the first with this serious problem:

http://forums.adobe.com/thread/1204185

 

I think by now you've found all kinds of references to this problem, like:

http://processchecker.com/file/HDDefrag.exe.html  with various MD5s.

 

 

 

[RedBaird]

dup post

[Buckwild]

Thanks! I deleted reg key in: HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run,

 

No more popup after starting Windows.

[Buckwild]

This was caused by a spyware? trojan dropping in on Flash Player, A most common appliation.

 

It was probably sending My wep-page usage to advertizers.

[RedBaird]

I found over 900 results on google for "HDDefrag.exe" and over 1600 for "HDDefrag" this time.  Some say it is the  Artemis Trojan , with some symptoms not matching yours.  Various reports for this trojan include adding adverts to web pages you are viewing, slowing the computer and disabling the firewall, amongst others.

 

When you first posted here and I searched for the subject, I don't think that there were so many md5 hashes and addresses listed on that second site.  Now there are 46 of them.

 

I wonder if this is a "for sale" hacking tool, used by various people for different reasons, resulting in different effects upon the victims' systems.

 

The following shows your version of hddef.bat and the one I just found.  

 

 

I can appreciate why you posted a pic and not text.