What is "TCrtlIOHook.exe"??

I have this executable "TCrtlIOHook.exe", that is using about 90% of my CPU resources. I am able to end the process but it restarts on every reboot.  My OS is windows XP pro and I have a Toshiba Tecra A3. I ran Ad-Aware, Norton 2005 and Stinger I am still having the same problem!!
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Hi fcobuzzi,
Download HijackThis, run it, save the log file and analyze it. Both download and analyze can be done at www.hijackthis.de
Remove all the red-exclamation marks entries and the yellow question mark entries from the analysis.
Later, run this drill:

Good Luck!
If this doesn't fix your problem, run regedit and go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Look for TCrtlIOHook and delete its entry.
Now start explorer and search for TCrtlIOHook.exe (it should be somewhere in c:\windows or subdirectories.
Delete this file.

You're set.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
El ConquistadorSenior Database AdministratorCommented:
There is a site out there with an extensive library that lists almost all processes running, it allows you to do a search for processes running. But I can't seem to locate the site, mainly in part to the fact that I can't remember the name of the site. If someone knows which site it is perhaps they can list it and then you can do your search for this process.
I believe concretesailors is refering to the "LIUTILITIES" homepage (http://www.liutilities.com/products/wintaskspro/processlibrary/) now called "Uniblue". Ever wondered if for example the "mdm.exe" process listed under your task manager is a useful one or Malware? you can find the answer in that link ...or just do a search under Google looking for the keywords "Liutilities  mdm.exe". The top list in that page shows the "Fake Processes" while the bottom one the real ones.

An easy way to get rid of malware, or actually any process , would be with the "MSCONFIG" command. (Start->run-> type MSCONFIG ), then click on the "Startup" TAB and deselect any Process that might look fishy..(or even a valid process that you want to deactivate for a while). MSCONFIG won't uninstall the checked process, but hopefully, it won't be executed on next reboot. Then you can at least find out which process was the one that was slowing down your PC and get rid of it (with Regedit, your favorite Spyware/Anti Virus...etc).

There's a new thread that is very related to your question and might help you with more details http://www.experts-exchange.com/Miscellaneous/Q_21358242.html     called "Slow performance in Windows XP related to CPU usage?".  Although "TCrtlIOHook.exe" might not be slowing you down, there you can read more about how getting rid of it (if it turns out to be Malware...).
Glad that you solved your problem. However, did you not find the entry in HijackThis Log? I'm just wondering whether a manual clean is better than HJT.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.