Link to home
Start Free TrialLog in
Avatar of goodnetworking
goodnetworking

asked on

tcptapi process slowing down machine

I have a windows 2000 professional machine that is very slow running any apps.  I went to Task Manager and looked at the processes.  I noticed one called tcptapi that was using up to 98% of the processor at times and 40% at the lowest.  I kill that process, but within a couple seconds it starts up again.  I searched the registry for tcptapi and found it in HKLM/Software/Microsoft/Windows/CurentVersion/Run.  It was call *tcptapi with a value of C:\winnt\cursors\tcptapi.exe.  I go to that directory and there is no tcptapi.exe there (Hidden files are being shown).  I do however find a tmp file called ipatpct.tmp.  This cannot be deleted while the tcptapi process is running.  I then log out and access the computer from another computer on the network to delete that tmp file.  So, I now have both the registry key and tmp file deleted, but once I log back in the registry key is back, the process starts back up, and the tmp file has returned.  At least this time I can stop the process without it immediately starting again.  I can remove the tmp file again, along with stopping the process, and removing the registry key, but as soon as I log off and back on, it is back.  Any suggestions?
ASKER CERTIFIED SOLUTION
Avatar of luv2smile
luv2smile

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of luv2smile
luv2smile

Also make sure you update both programs before running them.
Avatar of goodnetworking

ASKER

Thank you!  After updating Ad-Aware, it found the culprit.  It was some Spyware called Virtomundo.  I believe the file that kept running the process was called tcpole.exe.  It found a couple others related to this spyware also.  It did only find it after the program was updated though.