100 percent CPU usage associated to rundll32

This can be a legit file or it can be a very bad virus file....depending on where it is located on your computer.

http://www.liutilities.com/products/wintaskspro/processlibrary/rundll32/

http://www.neuber.com/taskmanager/process/rundll32.exe.html

Do you have updated virus software and have you run a virus scan?

Have you run spybot and adaware to scan for junk on your computer?

Have you run msconfig?

Try to run spybot 1.3 and adaware SE.  Also scan your computer for viruses with this link http://housecall.trendmicro.com/housecall/start_corp.asp.
let me know.

(1) I have the latest McAfee ViruScan version, which automatically updates via permanent broadband connection.
(2) Also, I have an updated version of ZoneLabs Zone Alarm Pro.
(3) Running Anonymzer AntiSypware detector does not show any relevant suspects.

My system was running perfectly for the past 3-4 months. The only thing I did recently -but which cannot definitely associate with this problem- was to install IBM's "Rapid Respore Ultra" software. I have not installed or unistalled anything except that software, and shortly after I did the problem started.

Rundll32 is a legitimate file according to Microsoft's support.

I have run MSCONFIG but not while the problem is occurring. By the way, if I run MSCONFIG and selectively uncheck one by one every process, will the problem stop immediately? And, if so won't it happen again upon reboot?

Thanks!

You need to determine if you have any other versions of the file........the Rundll32 is a legit process....the version of the file that is in the sytem32 folder.....if you have a copy of that file anywhere else on your comptuer then it is a virus.

Download, update, and run in safe mode both adaware and spybot...these are among the recommended spyware scanners out there:

Adaware http://www.lavasoftusa.com/software/adaware/

And

Spybot http://www.safer-networking.org/en/spybotsd/index.html

Also, do a search on your computer for the file and see what you find.

No, if you use the MSCONFIG this will stop things from running at startup - the only thing is, once you start and app it may re-enable itself within the MSCONFIG. Things like Real Audio, QUicktime, and others are guilty of doing this.

Running just one antispyware program is never enough....spybot and adaware are among the best out there so I always suggest running those 2, but even then....you often times must run other tools or even revert to manual intervention in order to keep a system clean from junk.

You can also try HiJackThis...it'll show you all the processes running on your computer...but be very CAREFUL...this is not a antipsyware program like the others....it shows you all things...good and bad. If you delete everything that hijack this finds then you'll be reinstalling your OS :) So be careful.....but you can use it to see if there may be bad processes running.

You can download it here:

http://www.spywareinfo.com/~merijn/files/hijackthis.zip

and use this analyzer site in order to analyze the log....delete what it finds as nasty....for the unknowns, do a google search or ask question if they are legit processes or not.

http://www.hijackthis.de

Also, since you have XP

you need to turn OFF system restore before running msconfig or any antispyware programs.

A couple of items to look at in your running processes, based on my past experience with recent thinkpads:
1)  Bluetooth - this is a rundll32 process on an IBM that can use a tremendous amount of CPU time in an office environment because of stray signals from cell phones and other wireless equipment (wifi) that operates in the same frequency band (2.4 Ghz) as bluetooth.
2)  with WinXP, you can use the msconfig application to find out what programs are being launched using rundll32 aside from bluetooth, then you can either disable them through msconfig or find them in the registry and comment them out.

I encountered a similar problem which, after weeks of diagnosis in conjunction with MS support, was determined to be caused by McAfee's mclsp.dll loading into the memory space allocated to another process.  The clobbered process would then, basically, manifest the 100% CPU scenario.  The problem was related to XP logoff/on.  That is; everything fine, logoff, logon, immediate 100% CPU.

You might try MS Knowledgebase for mclsp.dll or 100% CPU.  Note that there are some 100% CPU problems caused by other than the scenario I described above.

I have found two versions of rundll32.exe located in:
C:\WINDOWS\system32
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\8b5e9cdb91dddbb342695fbdc36fe0e4\backup

Is the second one illegal?

However, my search also showed there are SEVERAL other files with names like "RUNDLL32.EXE-12083663.pf" located in:
C:\WINDOWS\Prefetch

Any idea how this might be related?

Currently I am making sure my laptop has all the updates suggested by Microsoft. Thanks.

Have you run spybot and adaware yet as we have instructed?

Viruses/malware  can use the rundll32 to run junk on your computer.....so you need to actually find out what is using it.....use the tools mentioned in the posts above to do that.

Was it Noadware or Adaware that delisted the adware that Spy Eliminator(?) started bundling with its app?  Not certain who else is caught up in the scandal but, while I agree that the possibility of virus/malware/spyware should be eliminated as a possibility, including running more than 1 scanner, care should be exercised or you may be compromising your security by using them.  I didn't see webroot's Spy Sweeper listed but it is another scanner that you might consider.

Too bad you can't easily and fully disable McAfee and see if the problem goes away.

Adaware takes a lot of time to search, and I will have to do that when I have more time. Meanwhile, I ran Spybot and detected several tracking  cookies (already deleted). Also, the program detected the following:

DSO Exploit: Data source object exploit (Registry change, nothing done)
  HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
  HKEY_USERS\S-1-5-21-3711237961-4138510226-1294312534-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
  HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
  HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
  HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3


What should I do about this? Can I safely delete this?

Yes you can delete them, however, spybot will detect them again and again though you have already removed them. This is a bug in spybot. There is a spybot patch that will fix this:

http://sptimes.com/2005/02/14/Technology/Spybot_patch_will_eli.shtml

Meanwhile, the other similar files you found may be legal/suspect file. Normally, when you see a similar file with .pf this is the old RUNDLL32 file that was replaced when you installed a patch that affects the file. On the otherhand, the second file may be legit or not legit, spyware/worm developers are very clever that they use stealth attack by making you believe some not-legit files are legit ones. I suggest that you rename the duplicate files to say .old or .bak so that they won't be executed.

Going back to your issue, Selectively unchecking your startup and services that runs at bootup will be the first step to determine what is causing this. Doing the scan (for virus/spyware/worm) and repair (of affected files) will be your net moves.

Lapukman

If you use Spybot Search and Destroy or another spyware removal tool, it may find an item called DSO Exploit. This exploit is a bug in Internet Explorer that under certain circumstances would allow untrusted software to run on the computer. In other words, its a hole in Internet Explorer that hackers could use to gain access to your system.

However, if you are running the latest version of Internet Explorer and have all your Windows Updates installed, the bug has been patched and is not a threat to your computer system. Even though Spybot may still show it as a threat.

If you have the latest Internet Explorer version and all your Windows Updates, you can safely ignore the DSO Exploit as a potential problem when Spybot Search and Destroy or other spyware removal tools discover it. However if you would rather fix the exploit so it does not show up again, follow these steps to edit your Windows Registry. Please be careful however, incorrect changes to the Windows Registry can cause Windows to not boot.


excerpt taken from http://www.pchell.com/support/dsoexploit.shtml
1) Make a note of the location of the exploit shown in Spybot, something similar to:

HKEY_USERS\S-1-5-21-1614895754-73586283-725345543-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

2) Click on Start, Run, and type REGEDIT and Press Enter to open the Windows Registry Editor

3) Find the location of the exploit above in the registry by clicking on the pluses(+) next to each title

4) After opening the Zones section and clicking on '0' look to the right window, under 'name' is the key '1004' and the type is REG_SZ simply right click and delete this REG_SZ value.Then right click and create new>DWORD Value, name it 1004, then right click on that and goto modify, give it the Hex Value of 3, Click ok.

If there is only a DWORD Value for the key (in this case 1004), then double click on the key and change the HEX value to 3 and click Ok.

5) Close the Registry Editor and Reboot your computer

6) The DSO Exploit should now be removed and it should no longer appear in the Spybot Search and Destroy log as a problem.

check wether the name of the process is rundll32 or rundll.32
If it is rundll.32 then its a virus clean your  system.
I had the same problem in my PC

use a tool such as pmon to view what processes are referencing rundll32 at the time of slowness. You can then make the call whether its good or bad

Adaware only detected the following:

Vendor:Possible Browser Hijack attempt
Category:Misc
Object Type:File
Size:75 Bytes
Location:C:\...\Jorge Arteaga\Favorites\Stores\Bookstores\CDNOW.url
Last Activity:2/20/2005 12:47:36 PM
Risk Level:Low
TAC index:3
Comment:Problematic URL discovered: http://www.cdnow.com/cgi-bin/mserver/redirect/leaf=
Description:Possible attempt to control/redirect the browser. This object referrs to a "blacklisted" site.  If the site listed is the site intended (in other words, it is set to the setting you wish it to be set to), add this listing to your ignorelist.  If not, then selecting this item will reset your browser to the default setting for this item.

I have already deleted the potential threat. We'll see what happens next.

After doing a search of my hard drive there are no instances of rundll.32

However, I have found a "rundll32.log" file with the following content inside:   3 11/12 08:05:24 2808 Windows SharePoint Services log file  

What is this?

Regarding your post:
" Comment from JorgeArteaga
Date: 02/18/2005 11:13AM PST
 Author Comment  

I have found two versions of rundll32.exe located in:
C:\WINDOWS\system32
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\8b5e9cdb91dddbb342695fbdc36fe0e4\backup

Is the second one illegal?

However, my search also showed there are SEVERAL other files with names like "RUNDLL32.EXE-12083663.pf" located in:
C:\WINDOWS\Prefetch"

Experience has shown me that usually every single virus is additionaly stored in C:\WINDOWS\Prefetch - so yes that rundll32.exe could be a potential virus as stated here:

http://www.liutilities.com/products/wintaskspro/processlibrary/rundll32/

System process which windows needs to run are usually in system32 folder... not in Prefatch. There for it isn't normal for files to be run off prefetch folder.

To be honest with you I would go with luv2smile advice. Do the following:

1. Download Hijackthis and execute it.
2. Save the logfile and go to www.hijackthis.de to analyze the file
3. The site will tell you what files are suspicious and which are safe and should not be deleted.
4. Post the log file here. Sometimes the site cannot detect viruses that easy. We on the other hand can.
5. While some Pro around here looks at your log file go to http://housecall.trendmicro.com - and scan your computer through a free online virus scanner. That site happens to be my faviourte for these type of things. Even if you have an antivirus installed on your PC. For some reason I personally find online scans to be more acurate than installed antivirus scanners...

The scanner should pick up many if not all viruses. We will then tell you what entrys to fix through hijackthis (and www.hijackthis.de will also) .. and once your all finish .. your PC should start working like a charm ...

Remeber to post the log here so we can help you out, and to scan it on the site in case we miss something ...

I have followed almost every step you have suggested (except editing the registry, which I would prefer not to do). Below is the result of running "Hijackthis" I hope it provides some clues. Thanks!



Logfile of HijackThis v1.99.1
Scan saved at 11:03:12 AM, on 2/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\efax\HotTray.exe
C:\Program Files\Common Files\efax\Dllcmd32.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\HPZipm12.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://altertranslations.intranets.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [S3TRAY2] S3Tray2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [UC_Start] C:\IBMTools\Updater\ucstartup.exe
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: j2 Tray Menu.lnk = C:\Program Files\Common Files\efax\HotTray.exe
O4 - Global Startup: Live Menu.lnk = C:\Program Files\Common Files\efax\Dllcmd32.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java141\jre\bin\NPJPI141.dll
O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java141\jre\bin\NPJPI141.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://idcp.idisc.es/XUpload.ocx
O16 - DPF: {FA9740A2-5802-42E2-B509-81186EEB3C42} (WABControl Class) - https://www.linkedin.com/cab/wabctrl.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

After analyzing the log from Hijack this in www.hijackthis.de the result shows some SAFE entries, UNKNOWN entries, and NASTY entries. However, the only nasty entry is actually related to the web address of my company's intranet site.

Perhaps the problem is related to one of those "Possibly Nasty" items. Please advise. Thanks!

Acorrding to the logfile ... your system should be clean and running properly.

You shouldn't remove anything ... every entry there is safe ... at least thats what I see from here.

Do you still notice your PC running at 100%?

If it is... is it still the rundll32.exe file?

Do you know what the [BMMGAG] rundll32.exe entry in your log file (unknown) is?  You have a few other 'unknowns', a nasty that indicates it should be fixed by hijackthis, and some other questionable entries.  However, given your posts and the direct relationship of the mentioned entry I would, if I were you, want to know what it was, and why it's running.  If you don't know, or can't find out, consider creating a system restore point and removing the indicated entry.  If it doesn't fix the problem you can fall back to the restore point.  If it fixes it, but it turns out something else fails due to the removal of it, then your situation, and your questions, should be why that is occuring.  If you DO know what it is I would STILL consider removing it (with a fallback point) to determine whether, or not, it is the cause of the problem.  Good luck.

Well, after following almost all of your recommendations my systems is worse not better. The main change has been that I have updated my PC with every patch and update from Microsoft. Now the 100% CPU usage occurs when I start the PC and also at more frequent intervals.

I will try following "jrs 50" suggestion, and will post again.

Does the same thing happen in safe mode?

On a more basic level, have you run MSCONFIG to identify what items are being launched using RUNDLL32?    You could turn them off one by one in MSConfig until you find the one that is causing the 100% CPU usage, then, once identified, comment it out in the registry.

Maybe you should uninstall ThinkPAD software and reinstall it.

Aparently thats what is making your PC overwork.

Is reinstallation an option?

After installing all Windows updates the system got worse. However, after repairing Office and eliminating my intranet's web address from Internet Explorer's list of intranet's sites the situation improved a bit. Now the problem appears after 4-6 hours.

I have unchecked perhaps half of proceeses listed in MSCONFIG startup tab, and so far that has not worked. I will continue trying.

This is not the first time this happens. Some months ago the same thing happened and I opted for reinstalling the whole OS and programs. It worked fine until a couple weeks ago, and the only thing I can remember having done was to install IBM's Rapid Restore Ultra program.

If all your suggestions don't work I will have to resort to reinstall everything again. My main fear however is that since I don't know what is causing this the problem can reappear if I unknowingly repeat whatever is causing it.

Aby other recommendation?

Well, I still haven't finished checking all processes one by one. However, I have noticed Winword.exe uses a lot of memory (around 60 MB), even when it is not running. I also made sure Outlook was closed, and it still kept using that amount of memory.

Is that normal? Thanks.

Thanks for that last comment. I wil try to follow your suggestions. However, please notice when the problem occurs it is rundll32 the culprit (it takes 99 percent of the CPU). I just asked about Winword.exe because it captured my attention the amount of memory it uses and because when sorting according to CPU usage it is near the top, but it is not using any significant amount of CPU.

Ok, I'll be waiting for the screenshot and will be happy to recomend any prior actions :-)
If you can't take a screenshot, at leat specify the exact name of the process taking up so much processor. Not Rundll32 but the process uncer Rundll32 .. occuping that amount of processor.

Good luck.

By the way, you can upload the screenshot to a site such as ImageShack for Temp Image hosting:

http://imageshack.us/

The problem is solved. After following almost all of your suggestions and removing one by one every process I did not come to a solution. Then I decided to upgrade the BIOS and drivers for my IBM laptop and incredibly the problem is gone.

I thought you all would like to know about this in case someone else consults about the same issue.

I also want to thank you all for the time dedicated to this problem, and will accept (although it didn't solve the problem) the suggestion that I found more approximate to solving the issue.

Have a great week.

Jorge