100% CPU Usage on Windows XP [Archive]

View Full Version : 100% CPU Usage on Windows XP

ironside

17 Apr 2004, 11:00pm

Hi,

I have a problem that has been driving me mad for weeks. My CPU usage regularly shoots up to 100%, making my computer unusable. I've been told to do a complete Reinstall, which I did - no change. I have a million and one Spyware things running and regularly updated Norton Antivirus.

When I check my taskmanager, the 100% is being divided up in various sizes and keeps jumping from one process to another. One second I have 99% on Taskmgr.exe, the next I have 33% on taskmgr, lsass and other random processes. While this is going on, my computer will effectively hang for a good while, and if I'm on the Internet, the connection will terminate.

After a while, however, the computer will start working again as if nothing happened.

Does anyone have ANY idea what it could be? I'd be eternally grateful, and it would mean my computer would not have to go through the window.

If it helps, here is my HijackThis log:

Logfile of HijackThis v1.97.7
Scan saved at 22:52:52, on 17/04/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\RunDll32.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
D:\drived\my documents2\downloads\registryprotect\regprot.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AOL 8.0\waol.exe
C:\Program Files\AOL 8.0\shellmon.exe
C:\Program Files\ICQ\ICQ.exe
C:\WINDOWS\explorer.exe
D:\driveD\My Documents2\downloads\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Program Files\ICQ\NDetect.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinPatrol PLUS] C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [RegProt] d:\drived\my documents2\downloads\registryprotect\regprot.exe /start
O4 - HKLM\..\Run: [Qwik-Fix] "C:\Program Files\PivX Qwik-Fix\QwikFix.exe" splash
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: PartyPoker.com (HKLM)
O9 - Extra 'Tools' menuitem: PartyPoker.com (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38084.3875347222
O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://E:\SuperCD\IntraLaunch.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{43BE5CC9-7EE4-4AED-80B9-D9BF25F1AE00}: NameServer = 195.93.50.134

In case you were wondering, the problem was happening before I installed the Google toolbar, ICQ and Party Poker.

Sorry this is so long, but I wanted to provide all the info I could.

Any help would be BRILLIANT!

Thanks!

primesuspect

17 Apr 2004, 11:40pm

Welcome to short-media...

I'd get rid of the following:

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [RegProt] d:\drived\my documents2\downloads\registryprotect\regprot.exe /start
O4 - HKLM\..\Run: [Qwik-Fix] "C:\Program Files\PivX Qwik-Fix\QwikFix.exe" splash
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://E:\SuperCD\IntraLaunch.CAB

:)

ironside

18 Apr 2004, 12:15am

primesuspect

18 Apr 2004, 1:16am

Not exactly sure, but I can definitely tell you that it's not supposed to be there, and I've seen it as one of those "common threads" on many spyware infestations.

Straight_Man

18 Apr 2004, 4:15am

Hi,

I got rid of the RealPlayer and IntraLaunch (whatever that is). However, I put Registry Protect and Quik-Fix in on the advice of someone else to protect my system. The problem was happening before I put these in.

Would it not reduce my security to get rid of these two?

Also, could you let me know what the KernelFaultCheck is before I delete it? I'm not too hot on these things, so I would just like to find out.

Thanks!

Something like KernelFaultchack is used legitimately, as a note to Windows to recover something that has messed up. I have also seen it when a STOP error has been triggered. IF it is there a lot, woudl sorry about it, occasioanlly, not to worry, and you might see if it vaporizes after a restart also. If not, HJT KILL it. I have killed some of those off and on, no spyware\trojans\adware\viruses on box that had that running, though-- that fact I am 100% sure of.

Oh, if you get the XP process dialog that wants to do an error report, this thing will be there afterwards. BUT, on a well configured system, it should appear only occasionally.

I think this is actually a side effect of illegal things that spyware does and attempts to do, and can be a signal that something is rotten in the XP software or hardware set on the box it appears on. I think it is a sign that XP is trying to fight somehting that the security patches sense and kernel thiks are illegal or are attempts to violate system integrity, but that the process itself is not part of spyware per se. It is a REACTION to the spyware or some software that is not fully compatible with XP, or an indicator that the hardware is gradually gettign unstable (but with hardware, you will get other signs also).

Per se, as a process itself, I would ignore it until after you have cleaned the box and restarted Windows a couple times in next couple days. Windows is semi-adaptive, better than it was at this with older versions, and this appears to be a sign of a process set that validates compatibility and kernel violate attempts and tries to shut them down. However, I have killed it before and had Windows still work from a surface look and XP log inspects, so you can do either, but watch for it in runs of SpyBOTS&D and CWSHRedder, and if you get that and no other signs of spyware or trojans, please let us know.

One trick to find partial removes or processes that appear when illegal to XP stuff is present is to rescan after cleaning, and watch what reappears if anything, AFTER a restart when you are done cleaning. Typically the KernelFault stuff disappears after one or two restarts that happen normally (in other words, NORMAL XP restarts where it shuts itself down, warm boots, and starts up without user having to use power switch to "help" it) after a cleaning.

If it reappears, either you have soem software that is not all gone that is doing bad things, or there are other problems in box, with this particular one. For instance, I tracked down an old WinFax Pro that was doing things Windows XP hated this way. Pulled it, no more problems with things like that appearing-- and that product is not spyware. Since that old winFax Pro also insisted on having amodem present and on, and insisted on answering the phone like a fax, I say good riddance to it for that version on XP.

Short form-- no, NOT spyware, but is a non-specific sign something needs to be looked into on the XP install.

John D.