Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

CPU usage yo-yo's from 2 - 100%


  • Please log in to reply

#1
cosmox2

cosmox2

    New Member

  • Member
  • Pip
  • 8 posts
Hello – Please help!

I have a Dell Dimension 4400 running XP Pro with SP2
PentiumR 4 CPU 1.8 GHz 1.79GHz, 256ram

My CPU Usage with no applications open is yo-yoing from 2% to 100% usage
in perfectly uniform spikes continually. Page File usage is a relatively constant
218 MB. (36) Processes are running. Networking Utilization is 0%.

I have defragged and run my MacAfee anti-virus twice.

Performance is destroyed. What to do ! Thank you !
  • 0

Advertisements


#2
dsenette

dsenette

    Je suis Napoléon!

  • Administrator
  • 26,019 posts
  • MVP
follow the malware instructions of the forum and post the requested logs into the malware forum
  • 0

#3
cosmox2

cosmox2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
I will - Thank you! :tazz:
  • 0

#4
Chronos0001

Chronos0001

    Member

  • Member
  • PipPip
  • 43 posts
More specifically,

if you can, open your "run" window.

type in "msconfig" (without the quotes)

when the msconfig window comes up, you will see some tabs at the top. This is the windows GUI (graphic User Interface) of the sysedit comand in DOS.

Select the "Start-Up" tab

This tab shows most (but not all ) of what your system loads in the background when it boots up.
Select all. ( in other words, temporarily disable all special startup items)

(this may or may not stop your CPU hogging) but that is not the purpose of doing this.

Reboot your computer. (if should boot a little faster since you are not loading your standard TSR (Terminal Stay Ready) programs.

Go online and find:
AVG free edition ( www.grisoft.com ) virus detection software.
AD-Aware (personal edition) (free) from www.lavasoft.com for AD detection and removal.
and lastly Spybot Search and destroy (free) (go to any search engine and type "Spybot Search and Destroy".)

All three of these program can probably find what is eating your CPU time. If you have broadband ( DSL, Cable Modem) and you see the datalight on your modem going crazy, you have probably been hyjacked. If you are not transmitting alot ( Modem light not busy) then you likely have a virus of some type.

After you run ALL 3 of these programs, and your system has somwhat returned to to normal, do not forget to run "msconfig" and get your TSRs back the way they were.

Good luck
  • 0

#5
cosmox2

cosmox2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Tried the MSConfig to no avail - what next? Thanks!
  • 0

#6
cosmox2

cosmox2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
I installed Process Explorer to watch how the hogging was occurring and the usage is being split pretty evenly between System Idle Process and System. All means nothing to me!?
  • 0

#7
poorak

poorak

    Member

  • Member
  • PipPip
  • 39 posts
can you tell us which processes are running .......or giv us a hijackthis log.......to figure out the problem ..........that would be beneficial
  • 0

#8
cosmox2

cosmox2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Thanks for your request for the Hijack log. I have uninstalled my macafee virus program (because it has always stunk) re-run all the malicious tools that Geeks suggested and here is the latest Logfile.
Thank you! Rob

Logfile of HijackThis v1.99.1
Scan saved at 11:51:14 AM, on 7/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\progra~1\scansoft\paperp~1\pptd40nt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\RD Friedman\Desktop\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PaperPort PTD] c:\progra~1\scansoft\paperp~1\pptd40nt.exe
O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PPWebCap] C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cp...ddObjSigned.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcaf...83/mcinsctl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcaf...,20/mcgdmgr.cab
O16 - DPF: {BDD2F926-8158-4F62-9E0D-B3B75FD1F07F} (McObjectFactory Class) - http://download.mcaf...0,2/mcmysec.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  • 0

#9
cosmox2

cosmox2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
I restarted my system in diagnostic mode and the CPU Usage issue was cured. Here is the hijackthis log in that mode for comparison to the problematic startup. Thanks

Logfile of HijackThis v1.99.1
Scan saved at 12:11:02 PM, on 7/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\Documents and Settings\RD Friedman\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cp...ddObjSigned.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcaf...83/mcinsctl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcaf...,20/mcgdmgr.cab
O16 - DPF: {BDD2F926-8158-4F62-9E0D-B3B75FD1F07F} (McObjectFactory Class) - http://download.mcaf...0,2/mcmysec.cab
  • 0

#10
cosmox2

cosmox2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Gentlemen,
Thanks for your help but problem solved by a fluke.While trying to scan a page this AM, my HP flatbed shut down. Rebooted to no avail and found no driver attached. Went to HP to download and noticed new diagnostic tool download. Installed it. Out of no where, bing bong and my printer kicks out a photograph that my F-ing daughter had scanned or downloaded. After 50 reboots and running every malicious program you suggested 3 and 4 times, this item was still stuck in "memory". System immediately returned to normal and is running great.
  • 0

#11
mayanksingh

mayanksingh

    New Member

  • Member
  • Pip
  • 3 posts
cosmox2 was the user who had exactly the same problem
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP