High CPU utilization on system process

What exactly do you mean not a normal system file?  Possibly some spyware or something?  Anyway, here is the logfile.

Logfile of HijackThis v1.97.7
Scan saved at 4:57:07 PM, on 2/25/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Belkin Bulldog Plus\upsd.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Patrick\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: (no name) - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\LimeShop\System\Temp\limeshop_script0.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 (HKLM)
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://download.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://www.alief.isd.tenet.edu/tech/tsweb/msrdp.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37889.7833217593
O16 - DPF: {A1337CC4-FF8E-11D1-9C48-00A0CC20E0D0} (EZListings) - http://www.aliefisd.net/ezserver/ezlistnt.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3F173D56-FEC0-4643-A292-F244F00C16E6}: NameServer = 151.164.11.201 151.164.1.8

>>What if I told you THE "System" process is not a normal system file??

LucF...Are you sure about that?
See here: http://support.microsoft.com/default.aspx?scid=kb;en-us;263201  Although for W2K my bet is WXP is the same for the default stuff. I can't find a comparable link.

pitbullhead:
My guess is your system is either running a driver for a printer, CD ROM, or some other device that is causing the cpu usage.

Still researching this one though.

:(  How could I say that... it was really late yesterday when I posted that...

Hijackthis log looks clean to me..

Gemarti - How do I determine what driver is causing the issue if in fact the driver is the problem here?  Do you know of any good utilities that would help me determine this?

How to Perform a Clean Boot in Windows XP
http://support.microsoft.com/?kbid=310353

SUMMARY
This article describes how to disable common startup programs, settings, and drivers to troubleshoot issues in Windows XP. This procedure is known as "clean booting."

Use this procedure only to troubleshoot error messages or behaviors when you are unable to determine the cause of the issue. Following these steps results in a temporary loss of some functionality. Restoring the settings restores the functionality, but may result in the return of the original error message or behavior.

The information in this article applies to:
Microsoft Windows XP 64-Bit Edition
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional

gemarti - I tried disabling system.ini, win.ini, disabled all startup items, hid and disabled all services.  After a restart, I checked the processor performance in the windows task manager and it was still running about 25-27% on the system process.  I went ahead and did a normal startup afterwards and rebooted.  This problem is killing me!

You can try running PMON from the command line. It will update about every 5 - 10 seconds. You may get an indication of any drivers or applications that are running.

START | RUN | CMD
enter:
PMON

Watch the Mem Diif and Flt Diff colums for changes. Note the application causing the change. Not sure if this will get us any where but it is a start.

Check for Virii also.

Online Virus Scanning

http://us.mcafee.com/root/mfs/default.asp?cid=9059
http://security.symantec.com/
http://housecall.trendmicro.com/
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
http://www.pcpitstop.com/antivirus/default.asp

Have you run the system file checker to verify that something isn't corrupt?

START | RUN | SFC /SCANNOW

You'll need your XP CD

System File Checker (sfc)
http://www.microsoft.com/windowsxp/home/using/productdoc/en/default.asp?url=/WINDOWSXP/home/using/productdoc/en/system_file_checker.asp

http://www.microsoft.com/windows2000/techinfo/reskit/en-us/default.asp?url=/windows2000/techinfo/reskit/en-us/prork/pref_tts_paix.asp

gemarti - I can't seem to find PMON for some reason.  Where is PMON supposed to be? That's a performance monitor right?  Can't run it from a command prompt and I did a search on c:\ for it as well.  I am clean from any virus also.

I'll try the SFC when I get home this evening and let you know what happens.

Hmmm...well PMON may be part of the Windows 2000 Resource Kit. I have that installed on my machine; or it is a support tool. On your XP CDROM there are support tools you can install too.

Ok I found PMON and ran it.  It was under the support tools on the XP CD.  What am I looking for here?  The system mem diff and flt diff?

Also ran SFC.  Everything seems fine there.

>>What am I looking for here

Watch for changes in those two columns. Note the program that is causing the changes. It or they may be the culprit.

You would be correct gemarti.  The culprit was my iomega zip device driver.  When I go into device manager, there are 2 drives listed.  One being my hard drive and the other is IMG VP1 (the iomega drive).  It is using a windows xp driver currently and as soon as I disabled the device my cpu usage went down to around 2% from 30%.  My next problem is finding a driver to replace the one that is there now.  I went to Iomega and downloaded the latest iomegaware but that did nothing.  I also downloaded some patch that they released for win xp which also did nothing to correct the issue.  Anyway, I'll take it from here and thanks for helping me out.

Thank you.

Greetings,
This is kindda late but guess it's worth mentioning... I've got a 2000 Pro box with all Gates' patches applied, Sygate Personnal Firewall and Norton Corporate AV 8. Besides that, I've got an IBM T20 notebook 2000 Pro LAN'd thru a small and convenient hub.
My svchost goes up to 100% somehow when I plug the T20 in the LAN, especially when I come back from a customer's site after having connected it to the foreign LAN. It seems to me a kindda timeout in the network level. But after a while it returns back to normal... networking layer.
Regards,
Fernando K

I have had the exact same problem.  What I found was that it was related to the IOMega driver.

If there was NO disk in the Zip drive, the system CPU Util would use any available CPU time "looking" for the disk.

The solution was to keep a disk in the drive - not perfect, but effective!

Ira

I decided to solve this thing for good, it took me a couple of valuable hours but I finally got to the point. The solution I found was to kill the service ROUTING AND REMOTE ACCESS. You can leave it OFF, didn't miss anything, but if you restart it, CPU is back normal.

Hope this helps,

Fernando K