[Becky84]

When i open task manager, it usually says CPU Usage: 100%. My computer is very slow and the problem is not internet explorer, but "explorer.exe". Everytime I restart, it says that this program is not responding. I have done a virus scan (AVG) and everything else that usually clears up problems caused by malaware.

Any ideas on how I should fix this?

Thanks.

[Advertisements]

Download a free evaluation copy of Trojan Hunter, update it and run it. This is one of the two top anti-trojan programs out there.....

[macten]

Download a free evaluation copy of Trojan Hunter, update it and run it. This is one of the two top anti-trojan programs out there.....

[Major Payne]

You might also try the microsoft anti-spyware program available on M$'s web site.

Ron

[gerryf]

explorer will be 100 percent at start up as it loads (it is your shell) everything else.

Does it stay at 100 percent?

[Becky84]

ok -- ran the trojan hunter. it found 4 and removed them.

however, not much has changed. explorer is still running all the time and yes, the CPU usage stays at a constant 100%. I can only use my computer for a few hours before i have to restart....

any new ideas?

[gerryf]

program with memory leak?

Post a hijack log and maybe we can see something that stands out.

[Becky84]

here we go
-------------------------------------

Logfile of HijackThis v1.99.0
Scan saved at 9:05:54 PM, on 3/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.princeton.edu/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [MXO Auto Loader] C:\WINDOWS\MXOALDR.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Word Racer - http://download.game...nts/y/wt1_x.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell...iler/SysPro.CAB
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtec...DjVuControl.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterf...ds/Uploader.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - https://www.dotphoto.com/XUpload.ocx
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalci...illama/ampx.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = princeton.edu
O17 - HKLM\Software\..\Telephony: DomainName = princeton.edu
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = princeton.edu
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Retrospect Launcher - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) - Unknown - %ProgramFiles%\WinPcap\rpcapd.exe (file missing)
O23 - Service: WLTRYSVC - Unknown - C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe (file missing)

[gerryf]

You don't have anything "bad" running, nor do I see any known memory leaks. You do have too much running on this machine at startup, however, so you could certainly reduce the stress on your machine.

Can you tell me how much memory you have

Right click MY COMPUTER< choose PROPERTIES, you should see MEMORY.

[Becky84]

hmm i'm not finding anything that says memory when i choose properties after right clicking on my computer

i'm stumped....

[mek]

I've got a solution - Switch to Linux. I'm now going to wipe my Windows partition forever!! Mungeware as I shall refer to these viruses etc propergated by mindless wankers who live in dark rooms would be fine and dandy if it somehow targeted Microsoft. Which it doesn't. It's the bloody users. Grrrrrr! Regards, Andy

[Major Payne]

hmm i'm not finding anything that says memory when i choose properties after right clicking on my computer

i'm stumped....

It's there, but try Start>Programs>Accessories>System Tools>System Information. I don't have XP installed on pc yet so I hope that is correct. Clicking on System Information will give you more info than you really want to know.

The simplest was right-clicking on "My Computer" icon on your desktop and choosing "Properties". The window that comes up should have had the info under "Computer:". Mine lists "System:", "Registered to:" and "Computer" in that order, but I use Win ME.

Or click Start>Run and type mem into command line, click "OK" button. Somewhere in DOS window that comes up, you'll see again more info than you wanted to know.

There's other ways. An easy way is to watch your boot screen for mem test.

Ron

[sebastian___]

I have the exact same problem. With a fresh install WinXp sp 1 (only a couple of weeks old). But in task manager, explorer.exe isn't allways at 100 %. Only sometimes when I suspect the PC is running slow, I look in task manager and usually explorer.exe is using all the processor. The only solution I have is close the explorer.exe and start again. Sometimes when I start again the explorer.exe it doesn't go again with using all the power. But sometimes no matter how many times I start the explorer again, it still goes up. And then , I close the explorer, and I continue working without explorer.exe. You can start any program just fine only with task manager. I also have the same problem on the laptop (but it doesn't happen so often). So I think it's just some bug in WinXP

[gerryf]

First,

Becky, if you are still out there, I lost track of this thread.....please report current status.

Second look at the hijack log and I notice you have two AV programs running....usually not a good idea. Try and remove one and see if the issue is addressed.

Also, note that you have multiple instances of svchost--which is normal, but you seem to have a few more than normal (may or may not be bad)

Sebastian, please start your own thread.

[gerryf]

running multiple av programs CAN have unexpected consequences, especially when more than one is running memory resident...it's not guaranteed to be an issue, tho

so, multiple AV programs should have one run memory resident, and the others used for file scanning.