Link to home
Start Free TrialLog in
Avatar of merdelafuente
merdelafuente

asked on

100% CPU usage in WinXP, cant start antivirus (w/ system process log)

Hello, I've ran Spyware and adaware upon knowing that my CPU's maxed out at 100%...I couldnt start norton antivirus either...here's the process log of a hijackthis please tell me what to fix..thanks

Logfile of HijackThis v1.97.7
Scan saved at 2:40:34 PM, on 12/10/2003
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\filename.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\toshiba\ivp\ism\pinger.exe
C:\toshiba\sysstability\tsyssmon.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\WINDOWS\SM1BG.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
E:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.ebay.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [TSysSMon] c:\toshiba\sysstability\tsyssmon.exe /detect
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [Win Init] filename.exe
O4 - HKLM\..\RunServices: [Win Init] filename.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0122955E-1FB0-11D2-A238-006097FAEE8B} (CscClnt Class) - http://www.pollg.com/central/02030106/cccabs/CleverContent.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Avatar of sunray_2003
sunray_2003
Flag of United States of America image

Dear merdelafuente,

Try these aswell

a) Once your system is up and running ,go to Start --> run --> msconfig and dictate the startup programs
Also go to registry and check these entries

"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
"

b) Download the latest patches and security updates for your OS and other applications.Also go here and check if you have
latest hardware drivers http://www.microsoft.com/whdc/hcl/default.mspx

c) Check for unwanted starting services and disable them
http://www.blackviper.com/WinXP/servicecfg.htm

d) Try doing system file checking ( start ---> run --> sfc /scannow)

e) Disable System restore

f)MS blaster worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

g) Computer slows down as Norton AntiVirus Auto-Protect CPU utilization reaches 95% or higher

http://service1.symantec.com/SUPPORT/nav.nsf/b69c799adfa31ecc85256aa30052f4d0/f0c69fcb50e2eeaa85256b180068dbf5?OpenDocument&s
rc=bar_sch_nam

h) Try using this to check which one is consuming more usage
http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

How to Break Down the System Process
http://support.microsoft.com/default.aspx?scid=kb;en-us;295714

i) Run system defragmentation , Disk cleanup and run CHKDSK /r

j) Check for tweaking of windows xp here
http://www.extremetech.com/article2/0,3973,5155,00.asp

k) Test your ram using http://www.memtest86.com/ 

l) Check out windows xp tweaks here  http://www.tweakxp.com/

m)Check this http://www.microsoft.com/whdc/hwdev/platform/performance/fastboot/default.mspx
Download it from here http://www.mvps.org/sramesh2k/utils/BootVis.exe 

n) Correcting System Hang at Startup
http://www.windowsxpatoz.com/cgi-bin/performance/index.cgi?answer=1036282950&id=1036282433

o) Tweak page file
http://www.geocities.com/ziyadhosein/wxptwks.htm

p) Improve performance

Optimize Virtual Memory for Performance in Windows XP
http://www.microsoft.com/WindowsXP/expertzone/columns/mcfedries/03june16.asp

Improve Windows XP's hard drive performance with disk striping
http://techrepublic.com.com/5100-6255-1040548.html

Modify Settings to Improve Performance
http://www.microsoft.com/windowsxp/expertzone/tips/october/ruffin1.asp

Improve Core System Performance (Windows NT/2000/XP) Popular
http://www.winguides.com/registry/display.php/399/

http://www.techbargains.com/hottips/hottip12/index.cfm

Q) Restore windows xp to see if that would bring your system back to normal state

HOW TO: Restore the Operating System to a Previous State in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;306084 

HOW TO: Start the System Restore Tool from a Command Prompt in Windows XP
http://support.microsoft.com/?kbid=304449

HOW TO: Start Your Computer by Using the Last Known Good Configuration Feature in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;307852&sd=tech

R) Also you may want to Repair:

http://support.microsoft.com/default.aspx?scid=kb;en-us;314058
Description of the Windows XP Recovery Console

http://support.microsoft.com/default.aspx?scid=kb;en-us;307654
HOW TO: Install and Use the Recovery Console in Windows XP

http://www.webtree.ca/windowsxp/repair_xp.htm

http://support.microsoft.com/default.aspx?scid=kb;EN-US;307545 

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;315341

You May Lose Data or Program Settings After Reinstalling, Repairing, or Upgrading Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;312369

Data Loss May Occur After Reinstalling, Repairing, or Upgrading Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;312368

Thanks,
Sunray
THis looks suspicious

HKLM\..\RunServices: [Win Init] filename.exe
And this O4 - HKLM\..\Run: [Win Init] filename.exe
Avatar of war1
Greetings, merdelafuente!

Doing a quick check of your HijackThis log, you seem to be free of spyware.

A virus may be locking up your AV scanner.  Check for virus with online virus scanner.

Housecall Online Scan
http://housecall.antivirus.com
or
Symantec Security Check
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym 

Best wishes, war1
merdelafuente,

Nothing look suspicious in the log.

You may want to check with some other tools here

Spyware/Adware removal tools:
------------------------------

What is spyware : http://www.spychecker.com/spyware.html

SpyBot-S&D : http://www.webattack.com/download/dlspybot.shtml 

Ad-aware : http://www.webattack.com/download/dladaware.shtml 

Trojan Remover :http://www.simplysup.com/

HijackThis : http://www.webattack.com/download/dlhijackthis.shtml 

KL-Detector  :http://www.webattack.com/download/dlkldetector.shtml

X-Cleaner Free  :http://www.webattack.com/download/dlxcleaner.shtml

SpywareBlaster  :http://www.webattack.com/download/dlspywareblaster.shtml

SpywareGuard :http://www.webattack.com/download/dlspywareguard.shtml

SpySites  :http://www.webattack.com/download/dlspysites.shtml

Keylogger Hunter :http://www.webattack.com/download/dlklhunter.shtml

Spycop: http://www.spycop.com/

BHODemon : http://www.spywareinfo.com/downloads/bhod/

Browser Hijack Blaster : http://www.wilderssecurity.net/bhblaster.html

Goodbye Spy http://www.topshareware.com/GoodBye-Spy-download-2012.htm

CWShredder: http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder

Other spyware removal instructions: http://www.pchell.com/support/click2findnow.shtml


online virus scanner:
---------------------

http://housecall.trendmicro.com/ 

http://security.symantec.com/

http://www.pandasoftware.com/activescan/com/activescan_principal.htm

http://www.pcpitstop.com/antivirus/default.asp 

DOS based : http://www.f-prot.com/download/download_fpdos.html

Thanks,
Sunray
Sunray half of what you posted doesn't even apply to this question. Why post stuff that has nothing to do with the problem?
Hi merdelafuente,

I don't trust the "filename.exe" also....
try running some online virusscan like Housecall:
http://housecall.antivirus.com/housecall/start_corp.asp

Greetings,

LucF
merdelafuente do this

Ctrl+Alt+Delete
Click the Taskmanger button
Click the Processes tab
Click the CPU column header (You may have to this twice do the ones using the most CPU cycles come to the top)
Now take note of what is using the CPU cycles the most and post them here.
Avatar of merdelafuente
merdelafuente

ASKER

I can't go online even though I am conencted to the network...

CrazyOne, anything else that looks suspicious to you? I need to present my senior project tonight and the app is running on the infected computer..
CrazyOne,

>> Why post stuff that has nothing to do with the problem?


These are list of checks that can be done to improve performance. 100% cpu need not always be spyware issue .. right ??

Thanks,
Sunray
I have to agree with CrazyOne on this one... I didn't see your virus and ad/spyware list when I posted, sorry about that, but Sunray, you do tend to post a lot of things that don't apply to the question wich is asked.
We aren't talking about performance here we are talking about CPU usuage spiking. Most of what you posted has nothing to do with that.
>You May Lose Data or Program Settings After Reinstalling, Repairing, or Upgrading Windows XP
>Data Loss May Occur After Reinstalling, Repairing, or Upgrading Windows XP
These don't have anything to do with the question wich is asked.
>>>CrazyOne, anything else that looks suspicious to you?

Not right off hand but those two filename.exe entries concerns me
Hey LucF are you working? LOL
ok here the frontrunners..

svchost.exe - 14, 704K (with 2 other svchost.exe running but with lower memory usage)
ezSP_Px.exe - Fluctuating
explorer.exe - 18, 964K

OK guys. May be we are thinking the same way.

I thought worst case he might have to repair the OS to solve the 100% cpu issue atleast that is what I have seen in few cases.
May be i tend to really give all the general fixes ... I just gave him a list so that he can use those like disable system restore , do system file checker ,
 break down the system process and check which one is causing more cpu usage .

I am sorry if you think I am giving direct answer to the question

Thanks,
Sunray
>> May be we are thinking the same way

should be .. May be we are not thinking the same way

Sunray
>Hey LucF are you working? LOL
No I'm at home working behind my own computer at the moment where QP is working ;-)
Sunray, maybe we are not thinking the same way, but still I think you sometimes post too much, as I stated above.
ezSP_Px.exe -- I think you have SONY machine ( http://www.liutilities.com/products/wintaskspro/processlibrary/ezsp_px/)
explorer.exe - close all windows and check if that would help
svchost.exe - http://www.liutilities.com/products/wintaskspro/processlibrary/svchost/

Sunray
LucF,

You know everybody does that..

Thanks,
Sunray
I have a Toshiba and I dont have any related Sony software installed...
Where'd CrazyOne go? :)
merdelafuente,

oops!  I was telling about the ezSP_Px.exe process. It is not sony . it should be any japanese company.

Thanks,
Sunray
Is this a virus of some sort? why can't i run Symantec antivirus?
Most of the followin really has notthing to do with the stated problem sunray. In your zeal to post first it may be better to read the question more thoroughly before posting

e) Disable System restore

f)MS blaster worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

h) Try using this to check which one is consuming more usage
http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

i) Run system defragmentation , Disk cleanup and run CHKDSK /r

j) Check for tweaking of windows xp here
http://www.extremetech.com/article2/0,3973,5155,00.asp

k) Test your ram using http://www.memtest86.com/ 

l) Check out windows xp tweaks here  http://www.tweakxp.com/

m)Check this http://www.microsoft.com/whdc/hwdev/platform/performance/fastboot/default.mspx
Download it from here http://www.mvps.org/sramesh2k/utils/BootVis.exe 

n) Correcting System Hang at Startup
http://www.windowsxpatoz.com/cgi-bin/performance/index.cgi?answer=1036282950&id=1036282433

o) Tweak page file
http://www.geocities.com/ziyadhosein/wxptwks.htm

p) Improve performance

Optimize Virtual Memory for Performance in Windows XP
http://www.microsoft.com/WindowsXP/expertzone/columns/mcfedries/03june16.asp

Improve Windows XP's hard drive performance with disk striping
http://techrepublic.com.com/5100-6255-1040548.html

Modify Settings to Improve Performance
http://www.microsoft.com/windowsxp/expertzone/tips/october/ruffin1.asp

Improve Core System Performance (Windows NT/2000/XP) Popular
http://www.winguides.com/registry/display.php/399/

http://www.techbargains.com/hottips/hottip12/index.cfm
Run the online virus check, if you have not done so already.
>> Is this a virus of some sort?

which one you are asking about. If you are asking about ezSP_Px.exe process , the answer is NO

are you getting any error when you run symantec. if yes , what error ?

try restarting the machine and check to see if you are able to run

Sunray
>You know everybody does that..
I try not to do that, and I've never seen me do that.

>svchost.exe is a common filename used by virusses nowadays, you should really try one of the online virusscanners provided to sort that out.
>>>Is this a virus of some sort? why can't i run Symantec antivirus?

It is possible. What I would do is take this disk out of this machine and slave it to another disk in another machine that is running Win2000 or XP and then use the virus scanner in that machine to scan this disk.
Antivirus closes automatically...no errors, I can't run it

Re: online scanning, I cant connect to the internet...

I only have like an hour to do this..but I'll give it a try
>>>ok here the frontrunners..

You check the memory usuage what you need to do is check the CPU usage

Click the CPU column header (You may have to this twice do the ones using the most CPU cycles come to the top)
Now take note of what is using the CPU cycles the most and post them here.
merdelafuente please use Hijack this to remove the two following because the look very suspicious

HKLM\..\RunServices: [Win Init] filename.exe  

And this O4 - HKLM\..\Run: [Win Init] filename.exe  
opps sorry

svchost.exe
filename.exe

figures are fluctuating though
merdelafuente,

May not be possible for you to try fix this issue within an hour if you have your deadline.. just a suggestion.
May be you finish your project first.

Thanks,
Sunray
ok, did that but i still have a 100% CPU usage
You should check wich process is using the most cpu power as CO already stated
not a deadline, project is done but the application is designed to run on the infected comp..I have to show it to my professor later..im giving it a try though..

do i need to reboot after fixing those files?
>do i need to reboot after fixing those files?
Yes you should
ok on the CPU process, I still have that filename.exe even after the deletion and also, SVChost.exe is at 65-70
Still, check the process wich is using all the cpu power, kill this proces.
hey, can I get in on this?   :)  

As there is so much to read here, I may be redundant in asking if you tried starting up in safe mode and cking for virii?  Or spyware?

Boy, what a thread!!!!

FE
merdelafuente,

If you look back at my "unpopular" long list given in my first comment , check the software in point h

Thanks,
Sunray
hey FE, nope havent tried that but hold on i'll do it
uhrmmm another dumb ?? -- how do you boot up XP in safe mode?
ASKER CERTIFIED SOLUTION
Avatar of CrazyOne
CrazyOne
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
in simple terms , restart the machine.
press F8
it will give you  a list of options
choose safe mode .. and press enter

Sunray
Press F8 just after the post screen and you should get a menu. Just choose boot to safe mode
k tnx
Fatal_Exception,

you listening ??

Thanks,
Sunray
:)  Sure, just takes a while to read all the comments.  :)

FE
Sorry, I should have posted it with my comments.  My bad.

FE
Join the discussion ..  

Sunray
Ok, SOLVED!! spike is gone it was the filename.exe...thanks very much guys, really appreciate it!
:)  Got here just in time!

FE
Sunray to Sunray.... Better luck  next time

Sunray
One of those Forest through the Trees things!
Just as an addendum, there is a partially related issue with Office 2000 SP3 causing 100% CPU usage (red-lining):

http://www.computerworld.co.nz/webhome.nsf/0/772219967C8006CACC256C80000A757C?OpenDocument

"...there are early reports that SP3 can cause 100% ('red-line') CPU usage on machines running Outlook. Veteran Office product reviewer and author, Woody Leonhard briefly covered this issue in the latest issue of his 'Office Watch' newsletter, suggesting that Microsoft knows of this bug, which seems to have been re-introduced after being fixed early in the service pack beta testing period. Microsoft has not made any public comment on the issue as this newsletter goes to press, so we suggest that users consider Leonhard's comments before deciding whether to obtain and install the service pack. We have included a link to the relevant issue of Leonhard's 'Woody's Office Watch' below, as well as a link to Microsoft's announcement of the service pack's availability".

Woody's Office Watch Vol 7 No 54 - woodyswatch.com
http://woodyswatch.com/office/archtemplate.asp?v7-n54

Office 2000 Update: Service Pack 3 - microsoft.com
http://office.microsoft.com/downloads/2000/o2ksp3.aspx


So what did it turn out to be, in the end?