"acrobat.exe" causing 99% cpu usage on 3 PCs?

Is there something malicious going on the web these days, where "Acrobat.exe" causes 99% usage.

This is the third time I've seen this in a week (on 3 diff pc's) where someone tries to read a pdf file, and the resulting process "acrobat.exe" locks up the PC (99% cpu usage)

Why would this be?
dgrrrAsked:
Who is Participating?
 
blue_zeeCommented:

After uninstalling, and BEFORE reinstalling, delete the folders:

C:\Program Files\Adobe
C:\Documents and Settings\All users\Application Data\Adobe
C:\Documents and Settings\>user name<\Application Data\Adobe
C:\Documents and Settings\>user name<\Local Settings\Application Data\Adobe

It may help.

Please note I assume you only have the Reader installed and no other Adobe software!

Zee

0
 
rindiCommented:
Download the latest version of HijackThis

http://www.hijackthis.de/downloads

run it and save the log. Paste the log to the following website

http://www.hijackthis.de/en

Follow the following exactly:

At the bottom of the page you'll see a "ANALYZE" button. Click it and you will have an analysis of your log. Now a new button, "SAVE ANALYSIS" will show up at the bottom. Your analyzed log will be saved to a page on that homepage, of which you can post the URL here. I should then be able to see if there is any software causing problems.
0
 
rindiCommented:
Sorry, the site has changed, download via http://hijackthis.de and then click on the "directdownload" button.
0
Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
johanvz1Commented:
Do what Rindi says that will definitely sort you I would have suggested
0
 
cschipperCommented:
Try to open acrobat without opening a pdf file and see if it's also locks the pc.

You may consider using acrobat reader for reading pdf's instead of acrobat, because when it's a big pdf mostly it takes some time to open it in the edit mode.
0
 
MereteCommented:
you may have what is called cool web search, firstly run a disc cleanup on all computers at start all programs accessories system tools,
this will remove all the temp internet files /history.
Check what is running using the task manager
download adaware personal and run this in safemode.
http://www.majorgeeks.com/download506.html
 also run hijackthis
0
 
blue_zeeCommented:

Acrobat Reader has always been a resource hog in some systems.

Maybe you would like to try the Foxit Reader (free):

http://www.foxitsoftware.com/pdf/rd_intro.php

It really is simple to use and much lighter than Acrobat Reader.

Zee
0
 
alberpepeCommented:
Which version of acrobat are you using?
0
 
captjjtCommented:
you may want to check to see if the three users are trying to open the same document. i have seen a similar situation with currupt pdf.
0
 
cyan990Commented:
Hi,

Depending on what version you're using, I know that there were multiple patches/revisions to fix this.  I would update to the newest if possible.

captjjt:ditto :)

Thanks,

Cyan990
0
 
HarrisIntegrationCommented:
I have seen this in several situations:
Acrobat reader browser plug-in gets corrupted.
An automatic update of the acrobat reader has corrupted the browser plug-in of the full version of acrobat.
PDF that Adobe is attempting to view inside the browser is a large file and acrobat will clock the CPU until the file is fully downloaded.

If you are seeing the problem you described outside of the web browser, the file may be corrupt or contain enhanced metadata from a newer version of Acrobat that is unrecognized by older versions of the reader.

If the users are connecting to this file through a share or something, UNinstall their current reader and install the newest version from Adobe.com.
If the users are attempting to open the file from a website or e-mail attachment, save the file to the desktop, then try to open it.  This will indicate if there are plug-in or file association problems.
0
 
MereteCommented:
Hello dgrrr any chance of some feedback.
You have not made a comment or reponded to any of these suggestion.
Hows it going?
Cheers Merete
0
 
dgrrrAuthor Commented:
Sorry for the delay - I'm trying to get to this tonight.
(I'll be working on my pc for days, then off on other people's pcs for a week, on and off)

thanks!
0
 
dgrrrAuthor Commented:
here's the hijack this analysis page:
http://www.hijackthis.de/logfiles/ebae3d44cb07a26c2a8b4d1b2f59d425.html

I did reinstall acrobat reader -- but I still have trouble when I Try to read this file:
http://support.gateway.com/s/Manuals/Servers/8504421.pdf
0
 
dgrrrAuthor Commented:
PS - don't worry much about that file-- it may be down.
I get the same result when I try to dl
http://www.irs.gov/pub/irs-pdf/fw9.pdf

What I just noticed is that since reinstalling reader, acrobat no longer launcehs -- instead, acrord32.exe launches --and hangs in the same way. (80%-99% cpu usage)
0
 
MereteCommented:
you should have acrobat and reader already installed with windows. Look in control panel add remove programs to confirm.
install acrobat here
http://www.adobe.com/support/downloads/detail.jsp?ftpID=1309
Set it to update or notify you of updates they should both be version7.

re-run your hijthis and fix all what it finds, looks like you have a couple of toolbars nasties.
Nasty   The entry Search &Dictionary has been identified as nasty. O8 - Extra context menu item: Search &Dictionary - C:\Program files\Lexico\Toolbar\dictionary.htm    
Nasty The entry Search &Thesaurus has been identified as nasty.
 O8 - Extra context menu item: Search &Thesaurus - C:\Program files\Lexico\Toolbar\thesaurus.htm    

O16 - DPF: {F0E2D69A-DC2F-4E9B-A993-684FB1C21DBC} - http://dictionary.reference.com/tools/toolbar/lexico.cab   
Possibly nasty   Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed!
   Check if you know this site and fix it if you do not.

O17 - HKLM\System\CCS\Services\Tcpip\..\{920B5D29-1638-4314-A5EB-A4202206F77B}: NameServer = 68.87.76.178,68.87.66.196    
Possibly nasty   If this Domain does not belong to your ISP, or your firms network, these entries should be fixed. 'SearchList' entries should be fixed too.
   Do you know the IP or Domain '68.87.76.178,68.87.66.196'? If not, fix this entry.

Then run a disc cleanup from start all programs accessories system tools.
delete all your cookies and history temp IE files in the disc cleanup.

run/scan your hddusing  your updated anti virus program.

  please also run a scan for corrupt files at start run type in sfc /scannow

when was the last time you ran a windows update?
 
0
 
rindiCommented:
I'd also remove these, as they aren't necessary, and you could replace the NAV with a less resource-hungry Antivirus software, like Avast!

http://avast.com

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
0
 
blue_zeeCommented:

Uninstall Acrobat Reader and try or at least test Foxit Reader.

Zee
0
 
dgrrrAuthor Commented:
I downloaded two diff online pdf files locally.  They freeze the same as the online verssions.

I uninstalled acrobat v6, tried the link you mentioned, (v5.0.5 -- ?) was some kind of update, didn't allow installation.
uninstalled acrobat reader  v7.0.7, , and reinstalled - no diff

scanned my HD, with up to date antivirus and spybot -- no help

my computer is updated on windows udpate.

Hmmm -- and when I removed those entries with hijack his killed my internet, had to rebuild winsock stack (xpwinsockfix). Also, didn't affect the acrobat freezing.

I tried FoxItReader -- it loads the files fine. But I'd still like to find out why acrobat/reader is fucked...

AS for the symantec av prog, I closed it / shut it down, and the acrobat problem persists.
0
 
MereteCommented:
Yeah this is an extratc from adobe, I figured you maybe sick of links.

Freeze when you start Adobe Reader or Acrobat (6.0-7.x or 3D on Windows)
Issue
When you try to start Adobe Reader or Adobe Acrobat, the application immediately quits, appears to freeze, or returns the error "Can't find Acrobat Plug in."

Details
The process "acrobat.exe" uses 95% or more of the capacity of the system processor. (Acrobat 6.x)

The process "acrobat.exe" uses 25% or less of the capacity of the system processor. (Acrobat 7.x or 3D)

Acrobat 6.0 or Adobe Reader 6.0 was installed on the computer.

Solutions

Do one or more of the following solutions:
Solution 1: Delete the temporary files that Acrobat or Adobe Reader creates, and then install the update or upgrade.

Acrobat 6.0 and Adobe Reader 6.0 may not delete the temporary files that they create during normal processes, such as filling in forms. Because Acrobat and Adobe Reader check temporary files at startup, an excess of temporary files can cause a long delay during startup or appear to be a freeze.

To delete temporary files:

1. Choose Start > Run, and type command in the Open text box. Click OK.

2. Type the following commands and press Enter after each command:

c:

cd\

del acr*.tmp /s

Note: Many lines of text will fill the Command.com window as this process runs. Wait for the process to complete (when the text has stopped for about 10 seconds), and then continue to the next step.
3. Type exit to close the Command.com window.
4. Install the 6.0.1 update, or upgrade to 7.0 or later.

Important: Before you upgrade to Acrobat 7.x or Adobe Reader 7.x1, remove Acrobat 6.x or Adobe Reader 6.x from your system. For instructions, see the Related Documents section of this document.

-- To install the Acrobat 6.0.1 update, download the update from the Adobe website at www.adobe.com/support/downloads and then follow the online installation instructions.

-- To upgrade to Adobe Reader 7.x, remove Adobe Reader 6.0 from the computer, and then install Adobe Reader 7.x from the Adobe website at www.adobe.com/products/acrobat/readstep2.html .

 For instructions on removing Adobe Reader 6, see Related Records.

-- To purchase Acrobat 7.x, visit the Adobe Store at http://store.adobe.com/store/main.jhtml , or call Customer Services at 800-272-3623. Install Acrobat 7.x from your installation media and uninstall Acrobat 6.x when the installer prompts you.

-- If you have Acrobat 7 or Reader 7 already, download the latest updates from the Adobe website at www.adobe.com/support/downloads and then follow the online installation instructions.
---------------------------------------------------------------------

Solution 2: Re-create the Updater folder.

Re-create the Updater folder to make sure it doesn't contain damaged or corrupt files.

To re-create the Updater folder:

1. Enable Windows to show hidden files and folders. For instructions, see the documentation included with Windows.

2. Delete the Updater folder from Documents and Settings\ [user profile] \Application Data\Adobe\Acrobat\ [ Acrobat version number]

3. Restart Acrobat or Adobe Reader. A new Updater folder is created during startup.

------------------------------------------------------------------------------------------
Solution 3: Repair Acrobat or Adobe Reader.

If you repair Acrobat, you need the Acrobat CD-ROM (or access to the installation files on a network) to complete this solution.


To repair Acrobat or Adobe Reader:

1. Choose Start > Settings >  Start > Control Panel  and then double-click Add/Remove Programs.

2. Click Change or Remove Programs, and then click Adobe Acrobat [version number] or Adobe Reader [version number] .

3. Click Change/Remove or Change.

4. In the Setup dialog box, click Next, select Repair, and then click Next.

5. Follow the on-screen instructions to complete the repair.
----------------------------------------------------------------------------------------------------------

Solution 4: Log in to a new user account.

Create a new user account that has administrative privileges, and then log in to that account before you start Acrobat or Adobe Reader.

Background information

During usage, Acrobat and Adobe Reader create temporary files, which are stored in the Windows\Temp and Documents folder and the Settings\ [user profile] \Local Settings\Temp folder. Acrobat and Adobe Reader may create excessive temporary files and not delete them when you quit the application. Excessive temporary files can overload the system processor and cause the application to freeze or close; deleting these files frees up the processor. This issue is resolved in Acrobat 6.0.1and later and Adobe Reader 6.0.1 and later. If Acrobat 6.0 was ever installed on the system and not successfully updated or removed, this problem may continue to occur.

Acrobat or Adobe Reader may also freeze or close for the following reasons:

-- The Updater folder or its contents is damaged. Re-creating this folder can resolve the problem.

-- Acrobat or Adobe Reader application files, shortcuts, or registry entries are missing or damaged. Repairing Acrobat or Adobe Reader restores these items.

-- The user account is damaged.
================================================
How to create a new user account:
http://windows.about.com/od/useraccounts/ss/createuser.htm

How to copy data from a corrupted user profile to a new profile
http://support.microsoft.com/?kbid=811151


--------------------------------------------------------------------------------

Related Documents

327455: Install and remove Acrobat products using the command line (6.x on Windows)
http://www.adobe.com/support/techdocs/327455.html
327675: Remove Adobe Reader 6.x (Windows XP and 2000)
http://www.adobe.com/support/techdocs/327675.html
322804: Remove Acrobat 6.0 Professional (Windows XP and 2000)
http://www.adobe.com/support/techdocs/322804.html
330706: Remove Acrobat Standard 6.x (Windows XP and 2000)
http://www.adobe.com/support/techdocs/330706.html

0
 
dgrrrAuthor Commented:
Thanks you guys -- it was the temp files. Thiis is what fixed it - -altho you were both on the right track at the end.
start / run / cmd
c:
cd\
del acr*.tmp /s
0
 
dgrrrAuthor Commented:
PS -- I also found that I had old installations of acrobat 6 on two different partitions. In addition to deleting acrobat temp files as you say above, I deleted all old acrobat prog dirs (after using add-remove programs as well)
0
 
blue_zeeCommented:

Thank you.

Glad to read you're out of trouble.

Zee
0
 
MereteCommented:
your wellcome good to see a solution.
I did suggest running a disc cleanup in my comment  after fixing the hijackthis scan.
This a normal proceedure and includes the temp folder as well.
Merete
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.