What could be causing 100% cpu usage on a windows tablet pc when all non-microsoft services are disabled and all startup entries are disabled?

We have a MOTION COMPUTING tablet pc running MS WINDOWS XP TABLET PC 2005 W/SP3.It is a 1 Ghz machine with 1gb ram.It has AVG Network Edition antivirus(version 9).It is used by a doctor and he has some medical programs, ms office.We have removed AVG completely.We have disabled startup items and non microsoft services one by one and ALL altogether.Still cpu usage is 100%.The tablet APPEARS to run ok for the most part but it locks up when the medical program is accessed on a server.The tablet is used wirelessly AND wired.It does not lock up all the time.It is virus/spyware free.
There is another tablet that "locked" up as well but there are other desktop pc's that are not locking up when accessing the medical program.
These motion pc's do not APPEAR to be overheating.(ac adapter and tablet only WARM to the touch and they arent powering down). What else can we check? Thanks in advance..
robcrazeeAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

yohanesbuleCommented:
Look in the task manager, check on what caused it to get 100% CPU utilization.
Let me know here, i'll guide you through.
tnd2Commented:
Hi.

It should be better if you can list all process that still running and show CPU usage.


thepanchCommented:
most virus/spyware uses windows services name, so i think the common rundll or the svchost is the one doing troubles there, try loging in on safe mode, if the CPU is still at 100% then you have a problem in the windows core, if dont, then you have a process, doing the stuff, but get noticed that svhost at the beginning of loading windows, could be at 100% of windows utilization, but it has to drop over 3% when windows finish loading.

Try this
create a new user account and log in, the cpu still Freezes, then i must think a virus.
use diferent software to do the "clean up", like adaware, a2malware, and clamwin, be sure to run them on safe mode.

f8 after bios post to get into that mode.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

robcrazeeAuthor Commented:
Sorry.BEFORE i stopped certain processes and services the only process in task manager using double digit numbers(48% at time) was EXPLORER.EXE. The cpu usage was at 100%.But even after shutting down ALL startup items and ALL NON-MICROSOFT SERVICES then rebooting tablet, the cpu usage was STILL 100%! After doing this though the EXPLORER.EXE process was only at 4% and there was a process SVCHOST.EXE running at 97%.I'll have to post tomorrow the SPECIFIC services/processes as i'm very tired and going to bed.Not feeling well.Thanks for responses so far.
B HCommented:
i've seen windows updates (service: automatic updates) cause this on a badly outdated machine

you might also try defragging the hard drive, it might help on older machines too

if it is windows updates, you'll have to suck it up and COMPLETE all the updates, then it should be quiet - or you can alternatively disable them too

as thepanch said, most viruses run as svchost.exe, as well as most windows processes do too.  

process explorer/monitor can help you determine which service is running it up, and we can go from there

http://live.sysinternals.com/Procmon.exe
tnd2Commented:
To stop svchost.exe using up 100% system resources try this

   * Visit the Microsoft website and Download Windows Update v3 WindowsUpdateAgent30-x86.exe and save it to your C:\ drive
http://go.microsoft.com/fwlink/?LinkID=91237

   * Download this file fix_svchost.bat (right click and choose save as..) and save it to your C:\ drive
http://www.technibble.com/downloads/windows-tools/fix_svchost.bat

   * Download this file WindowsXP-KB927891.exe and save it to your C:\ drive
http://www.microsoft.com/downloads/details.aspx?FamilyId=7A81B0CD-A0B9-497E-8A89-404327772E5A&displaylang=en

   * Reboot the computer and log in to Windows XP in safe mode. To do this, press F8 just before the WindowsXP logo shows up during boot and press up to choose “Safe Mode”
   * Once Windows has loaded and you have the option of which user account to use, log on as “Administrator”.
   * Click Start > Run, choose the Browse button and find the fix_svchost.bat file you saved before, press Open, then OK.
   * A black screen will pop up and white text will scroll past. Wait for this process to finish as it could take several minutes. It will close itself when its finished.
   * Once the black screen disappears, Click Start > Run, choose the Browse button and find the WindowsUpdateAgent30-x86.exe file you saved before, press Open, then OK. Follow the prompts as it installs.
   * When Windows Update Agent finishes installing, Click Start > Run, choose the Browse button and find the WindowsXP-KB927891.exe file you saved before, press Open, then OK. Follow the prompts as it installs.
   * Reboot the computer
B HCommented:
where did you copy/paste that from
farjadarshadCommented:
I would recommend you to use a sysinternals utility called process explorer. It will tell you exactly what you want. you can download it from here

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Now move on to safe mode and run following

Antivirus (use any one)
1. Eset Nod32
2. Symantec End point
3. Kaspersky
4. Norton 360

Antimaleware and antispyware ( use all of these after updating them)

1. Malewarebytes >>          http:www.malwarebytes.org
2. Superantispyware >>     http://www.superantispyware.com/
3. Hitmanpro's Surfright >> http://www.surfright.nl/en/hitmanpro
4. Hijack this >>                   http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
5. Combofix >>                    http://www.bleepingcomputer.com/combofix/how-to-use-combofix
6. Bitdefender >>                http://kb.bitdefender.com/site/KnowledgeBase/consumer/#627
7. SPybot                            http://www.filehippo.com/download_spybot_search_destroy/
8. CCleaner                         http://www.filehippo.com/download_ccleaner/
9. Registry Cleaner             http://www.eusing.com/free_registry_cleaner/registry_cleaner.htm
10. Defraggler                     http://www.filehippo.com/download_defraggler/
robcrazeeAuthor Commented:
Thanks to all who replied.Shoutout to BRYON.What's up buddy?
I wanted to give you all some updated information. I went into SAFE MODE and the CPU USAGE is 100% as well! Only PROCESSES that are running with a percentage number are TASKMGR.EXE(40%) and EXPLORER.EXE(60%).Does this "TYPICALLY" indicate a virus/spyware? Let me know guys/girls.THANK YOU
thepanchCommented:
i think your explorer process is corrupt, i have seen it some times when you install and uninstall it, that windows does something, and the process get all the procesor available to "work" on something that doesnt exist anymore.

I really have bad news for you, but i think it might be better for you to reinstall the windows OS.
robcrazeeAuthor Commented:
Sorry everyone, was out of town for over a week! Here is an update of what i've done.
I've tried ALL of the things you all suggested with no luck.CPU usage is still at 100%!?Please
keep in mind that Procmon and Process Explorer did not show any unusual processes running
and EXPLORER.EXE and SVCHOST.EXE are the only ones with double-digit percentages.
Could it be that it's OK that it's running at 100%?It doesnt APPEAR to running slow or locking up.
Reminder:
Motion Computing LS800 Tablet pc
Windows XP Tablet Edition 2005 SP3
1GB RAM / 60GB HDD - 30GB FREE
AVG Network Edition
Tablet has been scanned and it is clean(avg, malwarebytes, advanced system care)
Original USER PROFILE was DELETED after running FILES AND SETTINGS TRANSFER WIZARD.
NEW USER PROFILE was created and FSTW brought back.

Any other help would be appreciated.THANKS!
robcrazeeAuthor Commented:
Some more information that's interesting:
100% cpu usage when booted normally to user profile.
"NORMAL" cpu usage when booted normally to ADMINISTRATOR profile.
100% cpu usage when booted to  user profile in SAFE MODE!?
"NORMAL" cpu usage in ADMINISTRATOR profile in safe mode.
***when i say "normal" for cpu usage i mean that it fluctuates depending on what's going on
for example: 50%, then it will go to 7%, etc..***
***when i say normal for the profile, i mean STANDARD BOOTUP TO DESKTOP***
***when i say "user" it's really the name of the user profile(GEORGE)***
*BASICALLY, WHEN I BOOT TO THE THE USER PROFILE IN EITHER NORMAL BOOT OR SAFE MODE
THE CPU USAGE IS 100% BUT WHEN I BOOT USING THE ADMINISTRATOR PROFILE IN EITHER MODE
THE CPU RUNS "NORMAL"
helpnetCommented:
Question... us there a network printer installed, and how is it installed.  Is it installed for both the administrator and the normal user in the same way.

I have frequently found network printers slow browsing (eg in MS office applications looking for a file to open or to set a path to save a file), and the problem can be intermittent, and bring the machine to a halt when it occurs.  Try removing network printers.  If that helps, try reinstalling as a local printer using and IP address port so you can still print across the network.

B HCommented:
it sure sounds like the george profile has some software running at startup which is running amok

compare what starts from administrator with what starts from george:

c:\docume~1\george\startm~1\progra~1\startup
with
c:\docume~1\administrator\startm~1\program~1\startup

regedit as george > hkey current user > software > microsoft > windows > current version > run
with
regedit as administrator > hkey current user > software > microsoft > windows > current version > run

or run hijackthis and post a log
robcrazeeAuthor Commented:
HELPNET - there are over a dozen printers that he uses at his practice and two hospitals(the user is a doctor).In BOTH profiles the printers are setup the same.
BRYON - Here is an attached Hijackthis file my friend.Hope you guys can make something out of it! Thanks..
dr-george.txt
B HCommented:
well you got some pretty odd entries that need to be taken care of

what is this bho?  remove it:
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)

what is this program/file?  i'd remove it unless it makes sense to you:
O20 - Winlogon Notify: mclaunch - C:\\Windows\\System32\\mclaunch.dll

what are these scheduled tasks?  find out and/or delete them from task scheduler:
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\SYSTEM32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\SYSTEM32\browseui.dll

all of those you can do from hijackthis... but this next one you can't and it needs to be dealt with IF you're not using netware:

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

if you want to deal with that, you can use LSPFIX from cexx.org
robcrazeeAuthor Commented:
Hey BRYON-
Thanks for response.Unfortunately my friend, it did not work! None of those of entries
were needed by doc and i fixed them in HiJackThis and also did LSPFIX(we've used this before
and its a nice tool for those LSP layer problems) but outcome still same.100percent cpu usage.
We dont have MS WINDOWS XP TABLET EDITION cd's so we cant do repair install but i wonder if THAT would even solve it huh? Sounds like COMPLETE REDO sound in order yeah? I'm gonna try a CLEAN USER PROFILE CREATION and see what happens as did new user profile i created was with FILES SETTINGS coming over.Let me know if you have any other things i can try.THANKS!!
robcrazeeAuthor Commented:
Well everyone, thank you all for your responses.It really sucks that i couldn't figure out EXACTLY what was wrong but i created a totally new user profile(WITHOUT bringing what came in FILES SETTINGS TRANSFER WIZARD)and just copied DESKTOP icons over from old profile and now the cpu usage is 'NORMAL'.It will dip into 100% but go back down after that particular process finishes.In the other profile it would not change from 100% even though nothing is running except the AVG antivirus. The interesting part is the tablet SEEMS to run "ok" when this condition existed!? It would run "SLOW" at times but nothing major.
The other strange-ness : 100% CPU USAGE in SAFE MODE under the original profile only but not in ADMINISTRATOR or a newly created USER!
Anyways, i have stuff from all of you i can try in the future!
I'm not going to award the points to myself.
THANKS AGAIN..
robcrazeeAuthor Commented:
These steps all HELPED in troubleshooting but not a PARTICULAR one step solved issue.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows XP

From novice to tech pro — start learning today.