unknown process

Discussion in 'Computer Support' started by Dan, Jun 23, 2004.

  1. Dan

    Dan Guest

    Hi
    recently did a clean install of XP Pro. First thing I did was install SP-1.
    Noticed lights on modem flahing. (Lan) Opened task manager, noticed
    unfamiliar process. PDSched.exe. Terminated process and modem quit flashing.
    Then Angel fire web page starts opening on its own. Did Google search. Angel
    fire has not been a big issue lately. Not sure if I actually fixed it or
    not. Can find no helpfull information on this PDSched.exe. Computer is
    brutally slow. Have done many virus scans (on-line) all clean. Ran adaware
    and spybot. Spybot keeps finding same 5 problems and says it has fixed them.
    It hasn't.
    Every time pc is started the process is as well. Can anyone advise what I
    might try next? TIA, Dan.
    Dan, Jun 23, 2004
    #1
    1. Advertising

  2. Dan

    °Mike° Guest

    Install HijackThis and post the contents of your log here.

    HijackThis
    http://mjc1.com/mirror/hjt/
    http://www.spywareinfo.com/~merijn/files/hijackthis.zip
    http://209.133.47.12/~merijn/files/HijackThis.exe


    On Wed, 23 Jun 2004 20:07:35 GMT, in
    <bqlCc.870073$Ig.401277@pd7tw2no>
    Dan scrawled:

    >Hi
    >recently did a clean install of XP Pro. First thing I did was install SP-1.
    >Noticed lights on modem flahing. (Lan) Opened task manager, noticed
    >unfamiliar process. PDSched.exe. Terminated process and modem quit flashing.
    >Then Angel fire web page starts opening on its own. Did Google search. Angel
    >fire has not been a big issue lately. Not sure if I actually fixed it or
    >not. Can find no helpfull information on this PDSched.exe. Computer is
    >brutally slow. Have done many virus scans (on-line) all clean. Ran adaware
    >and spybot. Spybot keeps finding same 5 problems and says it has fixed them.
    >It hasn't.
    >Every time pc is started the process is as well. Can anyone advise what I
    >might try next? TIA, Dan.
    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Jun 23, 2004
    #2
    1. Advertising

  3. Dan

    GoGeta Guest

    heres what you should have done
    1)slipstream sp1 into the xp cd
    (http://www.neowin.net/articles.php?action=more&id=46)
    2)format hard drive (use NTFS unless you need a win9x to beable to read the
    drive)
    3)install xp (don't have the computer connected to the internet when
    installing)
    4)before doing anything install a firewall and antivirus (I suggest symantec
    antivirus corporate edition 9)
    5) after the firewall and that are installed..connect to the net and update
    windows and drivers

    you got viruses on there because..as hard as it is to beleive..you got a
    virus in the short time it took to install your sp1 and updates...I learned
    this a while ago..cause if I had the computer connected to the internet
    while installing xp...I would almost for sure have a virus or something
    see what happens..especially on cables isp networks is that some stupid
    newbie will have the viruses on there computer and not know it...and what
    this viruse does is port scan for other people on the ISP's network for open
    ports ..then send out the viruses to any open ports






    ----- Original Message -----
    From: "Dan" <>
    Newsgroups: 24hoursupport.helpdesk
    Sent: Wednesday, June 23, 2004 3:07 PM
    Subject: unknown process


    > Hi
    > recently did a clean install of XP Pro. First thing I did was install

    SP-1.
    > Noticed lights on modem flahing. (Lan) Opened task manager, noticed
    > unfamiliar process. PDSched.exe. Terminated process and modem quit

    flashing.
    > Then Angel fire web page starts opening on its own. Did Google search.

    Angel
    > fire has not been a big issue lately. Not sure if I actually fixed it or
    > not. Can find no helpfull information on this PDSched.exe. Computer is
    > brutally slow. Have done many virus scans (on-line) all clean. Ran adaware
    > and spybot. Spybot keeps finding same 5 problems and says it has fixed

    them.
    > It hasn't.
    > Every time pc is started the process is as well. Can anyone advise what I
    > might try next? TIA, Dan.
    >
    >
    GoGeta, Jun 23, 2004
    #3
  4. Dan

    Dan Guest

    Scan saved at 4:32:45 PM, on 6/23/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Logitech\iTouch\iTouch.exe
    C:\WINDOWS\explorer.exe
    c:\program files\internet explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Dan & Val\Local Settings\Temp\Temporary Directory
    1 for hijackthis[1].zip\HijackThis.exe

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
    Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
    C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Microsoft DirectX] PDSched.exe
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program
    Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\RunServices: [Microsoft DirectX] PDSched.exe
    O4 - HKCU\..\Run: [Microsoft DirectX] PDSched.exe
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) -
    http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
    http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
    http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38150.642650463
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
    http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    "°Mike°" <> wrote in message
    news:40f7ed47.14405031@localhost...
    > Install HijackThis and post the contents of your log here.
    >
    > HijackThis
    > http://mjc1.com/mirror/hjt/
    > http://www.spywareinfo.com/~merijn/files/hijackthis.zip
    > http://209.133.47.12/~merijn/files/HijackThis.exe
    >
    >
    > On Wed, 23 Jun 2004 20:07:35 GMT, in
    > <bqlCc.870073$Ig.401277@pd7tw2no>
    > Dan scrawled:
    >
    > >Hi
    > >recently did a clean install of XP Pro. First thing I did was install

    SP-1.
    > >Noticed lights on modem flahing. (Lan) Opened task manager, noticed
    > >unfamiliar process. PDSched.exe. Terminated process and modem quit

    flashing.
    > >Then Angel fire web page starts opening on its own. Did Google search.

    Angel
    > >fire has not been a big issue lately. Not sure if I actually fixed it or
    > >not. Can find no helpfull information on this PDSched.exe. Computer is
    > >brutally slow. Have done many virus scans (on-line) all clean. Ran

    adaware
    > >and spybot. Spybot keeps finding same 5 problems and says it has fixed

    them.
    > >It hasn't.
    > >Every time pc is started the process is as well. Can anyone advise what I
    > >might try next? TIA, Dan.
    > >

    >
    > --
    > Basic computer maintenance
    > http://uk.geocities.com/personel44/maintenance.html
    Dan, Jun 24, 2004
    #4
  5. Dan

    °Mike° Guest

    On Wed, 23 Jun 2004 23:34:26 GMT, in
    <6soCc.829187$Pk3.250465@pd7tw1no>
    Dan scrawled:

    >
    >Scan saved at 4:32:45 PM, on 6/23/2004
    >Platform: Windows XP SP1 (WinNT 5.01.2600)
    >MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)


    >O4 - HKLM\..\Run: [Microsoft DirectX] PDSched.exe


    Have HijackThis fix the above.


    >O4 - HKLM\..\RunServices: [Microsoft DirectX] PDSched.exe


    Have HijackThis fix the above.


    >O4 - HKCU\..\Run: [Microsoft DirectX] PDSched.exe


    Have HijackThis fix the above.


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Jun 24, 2004
    #5
  6. Dan

    Dan Guest

    Thanks Mike. No more PDSched.exe. Computer is still not as fast as it should
    be. And GoGeta, I have SP-1 on a cd. I did install without internet
    connection. Firewall was enabled the first time windows started. Thanks
    anyway.
    "°Mike°" <> wrote in message
    news:41014f27.39460937@localhost...
    > On Wed, 23 Jun 2004 23:34:26 GMT, in
    > <6soCc.829187$Pk3.250465@pd7tw1no>
    > Dan scrawled:
    >
    > >
    > >Scan saved at 4:32:45 PM, on 6/23/2004
    > >Platform: Windows XP SP1 (WinNT 5.01.2600)
    > >MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    >
    > >O4 - HKLM\..\Run: [Microsoft DirectX] PDSched.exe

    >
    > Have HijackThis fix the above.
    >
    >
    > >O4 - HKLM\..\RunServices: [Microsoft DirectX] PDSched.exe

    >
    > Have HijackThis fix the above.
    >
    >
    > >O4 - HKCU\..\Run: [Microsoft DirectX] PDSched.exe

    >
    > Have HijackThis fix the above.
    >
    >
    > --
    > Basic computer maintenance
    > http://uk.geocities.com/personel44/maintenance.html
    Dan, Jun 24, 2004
    #6
  7. By any chance, do you use Panda Anti-Virus? For some reason, I'm thinking
    it is a product distributed with some Windows applications, and that may be
    what is running.

    Good luck!

    Linda



    "Dan" <> wrote in message
    news:5mBCc.837174$Pk3.159132@pd7tw1no...
    > Thanks Mike. No more PDSched.exe. Computer is still not as fast as it

    should
    > be. And GoGeta, I have SP-1 on a cd. I did install without internet
    > connection. Firewall was enabled the first time windows started. Thanks
    > anyway.
    > "°Mike°" <> wrote in message
    > news:41014f27.39460937@localhost...
    > > On Wed, 23 Jun 2004 23:34:26 GMT, in
    > > <6soCc.829187$Pk3.250465@pd7tw1no>
    > > Dan scrawled:
    > >
    > > >
    > > >Scan saved at 4:32:45 PM, on 6/23/2004
    > > >Platform: Windows XP SP1 (WinNT 5.01.2600)
    > > >MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    > >
    > > >O4 - HKLM\..\Run: [Microsoft DirectX] PDSched.exe

    > >
    > > Have HijackThis fix the above.
    > >
    > >
    > > >O4 - HKLM\..\RunServices: [Microsoft DirectX] PDSched.exe

    > >
    > > Have HijackThis fix the above.
    > >
    > >
    > > >O4 - HKCU\..\Run: [Microsoft DirectX] PDSched.exe

    > >
    > > Have HijackThis fix the above.
    > >
    > >
    > > --
    > > Basic computer maintenance
    > > http://uk.geocities.com/personel44/maintenance.html

    >
    >
    NoNewz_Iz_GoodNewz, Jun 24, 2004
    #7
  8. Dan

    °Mike° Guest

    You're welcome.


    On Thu, 24 Jun 2004 14:15:29 GMT, in
    <5mBCc.837174$Pk3.159132@pd7tw1no>
    Dan scrawled:

    >Thanks Mike. No more PDSched.exe. Computer is still not as fast as it should
    >be. And GoGeta, I have SP-1 on a cd. I did install without internet
    >connection. Firewall was enabled the first time windows started. Thanks
    >anyway.


    <snip>

    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Jun 24, 2004
    #8
  9. Dan

    Dan Guest

    No I don't use Panda. That's all I have to say about anti-virus software.
    Lol.
    "NoNewz_Iz_GoodNewz" <> wrote in message
    news:9HCCc.100408$eu.58547@attbi_s02...
    > By any chance, do you use Panda Anti-Virus? For some reason, I'm thinking
    > it is a product distributed with some Windows applications, and that may

    be
    > what is running.
    >
    > Good luck!
    >
    > Linda
    >
    >
    >
    > "Dan" <> wrote in message
    > news:5mBCc.837174$Pk3.159132@pd7tw1no...
    > > Thanks Mike. No more PDSched.exe. Computer is still not as fast as it

    > should
    > > be. And GoGeta, I have SP-1 on a cd. I did install without internet
    > > connection. Firewall was enabled the first time windows started. Thanks
    > > anyway.
    > > "°Mike°" <> wrote in message
    > > news:41014f27.39460937@localhost...
    > > > On Wed, 23 Jun 2004 23:34:26 GMT, in
    > > > <6soCc.829187$Pk3.250465@pd7tw1no>
    > > > Dan scrawled:
    > > >
    > > > >
    > > > >Scan saved at 4:32:45 PM, on 6/23/2004
    > > > >Platform: Windows XP SP1 (WinNT 5.01.2600)
    > > > >MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    > > >
    > > > >O4 - HKLM\..\Run: [Microsoft DirectX] PDSched.exe
    > > >
    > > > Have HijackThis fix the above.
    > > >
    > > >
    > > > >O4 - HKLM\..\RunServices: [Microsoft DirectX] PDSched.exe
    > > >
    > > > Have HijackThis fix the above.
    > > >
    > > >
    > > > >O4 - HKCU\..\Run: [Microsoft DirectX] PDSched.exe
    > > >
    > > > Have HijackThis fix the above.
    > > >
    > > >
    > > > --
    > > > Basic computer maintenance
    > > > http://uk.geocities.com/personel44/maintenance.html

    > >
    > >

    >
    >
    Dan, Jun 25, 2004
    #9
  10. Just wondering, I've found it installed on my system before without me
    installing it, it came embedded with something else I suppose. Just the
    name of the scheduler program that you had running made me curious.

    It isn't my choice in AV either....

    Linda



    "Dan" <> wrote in message
    news:NuJCc.877772$oR5.200331@pd7tw3no...
    > No I don't use Panda. That's all I have to say about anti-virus software.
    > Lol.
    > "NoNewz_Iz_GoodNewz" <> wrote in message
    > news:9HCCc.100408$eu.58547@attbi_s02...
    > > By any chance, do you use Panda Anti-Virus? For some reason, I'm

    thinking
    > > it is a product distributed with some Windows applications, and that may

    > be
    > > what is running.
    > >
    > > Good luck!
    > >
    > > Linda
    > >
    > >
    > >
    > > "Dan" <> wrote in message
    > > news:5mBCc.837174$Pk3.159132@pd7tw1no...
    > > > Thanks Mike. No more PDSched.exe. Computer is still not as fast as it

    > > should
    > > > be. And GoGeta, I have SP-1 on a cd. I did install without internet
    > > > connection. Firewall was enabled the first time windows started.

    Thanks
    > > > anyway.
    > > > "°Mike°" <> wrote in message
    > > > news:41014f27.39460937@localhost...
    > > > > On Wed, 23 Jun 2004 23:34:26 GMT, in
    > > > > <6soCc.829187$Pk3.250465@pd7tw1no>
    > > > > Dan scrawled:
    > > > >
    > > > > >
    > > > > >Scan saved at 4:32:45 PM, on 6/23/2004
    > > > > >Platform: Windows XP SP1 (WinNT 5.01.2600)
    > > > > >MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    > > > >
    > > > > >O4 - HKLM\..\Run: [Microsoft DirectX] PDSched.exe
    > > > >
    > > > > Have HijackThis fix the above.
    > > > >
    > > > >
    > > > > >O4 - HKLM\..\RunServices: [Microsoft DirectX] PDSched.exe
    > > > >
    > > > > Have HijackThis fix the above.
    > > > >
    > > > >
    > > > > >O4 - HKCU\..\Run: [Microsoft DirectX] PDSched.exe
    > > > >
    > > > > Have HijackThis fix the above.
    > > > >
    > > > >
    > > > > --
    > > > > Basic computer maintenance
    > > > > http://uk.geocities.com/personel44/maintenance.html
    > > >
    > > >

    > >
    > >

    >
    >
    NoNewz_Iz_GoodNewz, Jun 25, 2004
    #10
  11. Dan

    lazydavid Guest

    "Dan" <> wrote in message news:<6soCc.829187$Pk3.250465@pd7tw1no>...
    > Scan saved at 4:32:45 PM, on 6/23/2004
    > Platform: Windows XP SP1 (WinNT 5.01.2600)
    > MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    >
    > Running processes:
    > C:\WINDOWS\System32\smss.exe
    > C:\WINDOWS\system32\winlogon.exe
    > C:\WINDOWS\system32\services.exe
    > C:\WINDOWS\system32\lsass.exe
    > C:\WINDOWS\system32\svchost.exe
    > C:\WINDOWS\System32\svchost.exe
    > C:\WINDOWS\system32\spoolsv.exe
    > C:\Program Files\Logitech\iTouch\iTouch.exe
    > C:\WINDOWS\explorer.exe
    > c:\program files\internet explorer\iexplore.exe
    > C:\Program Files\Internet Explorer\iexplore.exe
    > C:\Program Files\Outlook Express\msimn.exe
    > C:\Program Files\Messenger\msmsgs.exe
    > C:\Documents and Settings\Dan & Val\Local Settings\Temp\Temporary Directory
    > 1 for hijackthis[1].zip\HijackThis.exe
    >
    > O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
    > Files\Spybot - Search & Destroy\SDHelper.dll
    > O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
    > C:\WINDOWS\System32\msdxm.ocx
    > O4 - HKLM\..\Run: [Microsoft DirectX] PDSched.exe
    > O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program
    > Files\Logitech\iTouch\iTouch.exe
    > O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
    > O4 - HKLM\..\RunServices: [Microsoft DirectX] PDSched.exe
    > O4 - HKCU\..\Run: [Microsoft DirectX] PDSched.exe
    > O9 - Extra button: Messenger (HKLM)
    > O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    > O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) -
    > http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
    > O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
    > http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    > O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
    > http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38150.642650463
    > O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
    > http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    >
    > "°Mike°" <> wrote in message
    > news:40f7ed47.14405031@localhost...
    > > Install HijackThis and post the contents of your log here.
    > >
    > > HijackThis
    > > http://mjc1.com/mirror/hjt/
    > > http://www.spywareinfo.com/~merijn/files/hijackthis.zip
    > > http://209.133.47.12/~merijn/files/HijackThis.exe
    > >
    > >
    > > On Wed, 23 Jun 2004 20:07:35 GMT, in
    > > <bqlCc.870073$Ig.401277@pd7tw2no>
    > > Dan scrawled:
    > >
    > > >Hi
    > > >recently did a clean install of XP Pro. First thing I did was install

    > SP-1.
    > > >Noticed lights on modem flahing. (Lan) Opened task manager, noticed
    > > >unfamiliar process. PDSched.exe. Terminated process and modem quit

    > flashing.
    > > >Then Angel fire web page starts opening on its own. Did Google search.

    > Angel
    > > >fire has not been a big issue lately. Not sure if I actually fixed it or
    > > >not. Can find no helpfull information on this PDSched.exe. Computer is
    > > >brutally slow. Have done many virus scans (on-line) all clean. Ran

    > adaware
    > > >and spybot. Spybot keeps finding same 5 problems and says it has fixed

    > them.
    > > >It hasn't.
    > > >Every time pc is started the process is as well. Can anyone advise what I
    > > >might try next? TIA, Dan.
    > > >

    > >
    > > --
    > > Basic computer maintenance
    > > http://uk.geocities.com/personel44/maintenance.html


    This is part of the Russian server scam, I believe. I had the exact
    same problem. I had to run Panda scan, delete pdsched.exe out of
    /system32, run hijack this, check all instances, and reboot several
    times, each time running a virus check. Good luck
    lazydavid, Jun 28, 2004
    #11
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Headtheball

    Unknown Trojan causing wireless connection to fail

    Headtheball, Oct 3, 2004, in forum: Wireless Networking
    Replies:
    1
    Views:
    1,648
  2. Mark

    Unknown process/application

    Mark, Jun 19, 2004, in forum: Computer Support
    Replies:
    10
    Views:
    751
    Boomer
    Jun 20, 2004
  3. Fu Schnickens

    Changing file from User Process to System process

    Fu Schnickens, Dec 28, 2006, in forum: Computer Support
    Replies:
    3
    Views:
    499
    Plato
    Dec 30, 2006
  4. Pieter
    Replies:
    11
    Views:
    2,031
    Pieter
    Jun 12, 2005
  5. =?Utf-8?B?TWF0dA==?=

    HELP Unknown Process

    =?Utf-8?B?TWF0dA==?=, Oct 12, 2007, in forum: Windows 64bit
    Replies:
    1
    Views:
    407
    Dennis Pack
    Oct 12, 2007
Loading...

Share This Page