weird CPU usage!?!?

BWX

Well this is strange- after having my PC on for a couple minutes, I get constant CPU usage spikes, even with nothing at all running- even after shutting off internet connection and firewall-

It is the "system" process in the task manager- it goes from 0 to 10 to 13% constantly sometimes up to 19 or 20%- Mem usage is 208k, VM size 32k, Peak mem usage 1972k, threads 41....

I just noticed it today, I am Virus and Trojan free AFAIK- I did a full system scan yesterday- came up clear. When I first start my machine it's normal- no extra CPU activity- then after a few Emails, and some surfing, I look and notice the activity.

Does anyone have any idea what this could be?? It's driving me nuts!!!

__________________

Dom

Did you check for spyware & adware?

BWX

Yup- all clean, updated Adaware and Spybot S&D- ran through both- both came up clean. I forgot where, but isn't there some online Trojan scanner or something like that? I really don't think I'm infected, but who knows. No strange startup programs either- But there must be something going on for up to 20% CPU usage for no reason-

__________________

PangingJr

Do you still using ZAP and NAV?

PangingJr

you had something similar to this prob before as i recalled and you did stated that all the viruses, trojans, spywares and etc has been checked out.. so its very hard to tell what's would be the caused of this... thiss only my educated guess but you dont have to take any precautions before taking/trying these steps..,

as of last info i have from reading some of your previous posts is you're using NAV 2002 and ZA Pro. so if youre still using both programs...

i'm going to skip the rest of testing steps prior to this and just test this...
disable the AV's real-time scan both mail and regular files scan, then 'uninstall' (not disable) the FW software. and reboot your PC.
then re-enable the AV's real-time scan and see if this helps.
if this does not help, re-install the FW and i'am out of ideas.
if this do help, try re-install the FW software and see if the prob comes back.

BWX

Yeah, I'm going to uninstall the Firewall anyway- I'm thinking ZAP is starting to suck anyway- According to this: http://www.flexbeta.net/main/comment...atid=1&id=6540 I may try Mcafee Firewall or even Norton's - after that test they seem to be better than Most, and I Sygate is ok, but setup is a bitch- I know I tried it.

But this is the problem, it only happens after I go online and surf around a little, then no matter what I do it doesn't stop- So it's kind of hard to recreate the problem if I'm not running a firewall, because I won't be connected to the internet without one.. Maybe I'll just load up a different one after cleaning out ZAP, which I heard is a little bit of a pain.
But I'll try what you said, I was thinking along the same lines- If that doesn't work I have no idea either.

__________________

BWX

Well I just found something, I shut down all windows and programs accept firewall- then I run Peerguardian and see it is "checking" 151.200.119.7

So I shut down Peerguardian and then turn it back on. It says the same thing- "checking" 151.200.119.7


So I think, I shouldn't be connected to any IP address. So I put that IP in the blocklist of PG- it doesn't block it- I put that IP in the blocklist of ZAP- still I see nothing blocking it- but every time I turn on Peerguardian it shows that IP address- when NO IE windows or any other programs are open.. Man this is irritating..

__________________

PangingJr

you and me talked about NAV 2002 in PMs,
now if you like to test it for yourself, do the steps (i hate this part man, telling you to do something) and b4 you connect to internet turn on the XP inbuilt FW and the NAV 2002, test it till you get the CPU acks up again,

if you dont see the seeame prob then..
i'd say go with NAV 2003 and Norton FW 2003.
or McAfee AV and McAfee FW,
or NAV 2003 and ZA Pro,
or NAV 2002 and Norton FW.
But dont go with NAV and McAfee together in any combination.

these are not what i reaaly like to use but they are get along well on most of the WinXP SP1.

PangingJr

maybe something else i'll look it up, in the mean time, test your softwares 1st if you would...

PangingJr

the System process and its CPU usage can be different from system to system..
mine is steadyed at most of the time but it does not mean yours is having any prob, but it can also indicate prob with some program you've running in the background.
anyway, check this out for more info..
http://groups.google.com/groups?hl=e...ic.windowsxp.*

BWX

Found same thing here

Currently my system has been up for 3:11 hours and the system process has uses up 11 minutes CPU time! That guy's was almost twice as much (20 min in 4 hours)- but still- mine's going crazy for no reason.. Weird. I'll read some more and then start uninstalling stuff.


This guy listed these in his post:
ZoneAlarm Pro
Norton Antivirus

Interesting....

__________________

No_Style

Did you turn off unecessary services? I know I had some CPU Usage before, but I turned off a lot of options in NAV and got rid of a lot of services.

__________________

BWX

Yup I turn all of the services off that I don't need- I actually run NAV bare minimum, and it only runs when I download emails- autoprotect, script blocking, etc is off.

Here is another thing I found about the services:

>-----Original Message-----
>Hi Eren,
>
>See if this helps:
>
>To disable unneeded startup services for a safer, faster XP, use the
>"Services" Admin Tool (Control Panel/Administrative Tools/Services).
>
>If you are a single user of a non-networked machine, you can disable the
>following items, with no ill effect.
>
>Alerter
>Clipbook
>Computer Browser
>Fast User Switching
>Human Interface Access Devices
>Indexing Service (Slows the hard drive down)
>Messenger
>Net Logon (unnecessary unless networked on a Domain)
>Netmeeting Remote Desktop Sharing (disabled for extra security)
>Remote Desktop Help Session Manager (disabled for extra security)
>Remote Procedure Call Locator
>Remote Registry (disabled for extra security)
>Routing & Remote Access (disabled for extra security)
>Server
>SSDP Discovery Service ("Universal P'n'P", & leaves TCP Port 5000 wide open)
>TCP/IP NetBIOS Helper
>Telnet (disabled for extra security)
>Universal Plug and Play Device Host
>Upload Manager
>Windows Time
>Wireless Zero Configuration (for wireless networks)
>Workstation
>
>--
>All the Best,
>Kelly
>
>MS-MVP DTS
>[AE-Windows? XP]



I checked and I have every single one of those turned off accept Workstation, which I just disabled... So that takes that out of the picture..



Look at my CPU usage just sitting here- doing nothing-- Before today it was always 0% then might go up to 4%, then back to 0%- then it might jump to 7% once in a while. That's what it has always done... Now this-


Just crazy- and it doesn't always start right when I boot up- most of the time it's when I online, surfing around or something...

__________________

FluffyChicken

http://www.sysinternals.com/ntw2k/fr.../procexp.shtml

Try this program to see what is triggering the spike.

There is another similar one but i've forgotten the name and it not free.

__________________

The_Neon_Cowboy

goto run
type command hit enter
type in netstat
will show all connections to your pc

__________________

zerodamage

I worked on a compuer with the same problem last week and it turned out to be Netsky which can bypass Norton with ease. D/L the latest Mcafee Stinger and do a scan for any of these newest worms an virus. This is only a removal tool, not a virus protection program but it works sweet. I am guessing you will find something OR after running this and finding nothing your cpu usage will go away. Happened with me.

BWX

Thanks, I'll take a look at that too.

__________________

BWX

Yup- I did that too, and when I don't have an OE window open, or a web page open, there is no connection.
I wonder if that may be because my firewall is blocking it- but maybe I am actually infected and it just cannot make a connection..

__________________

BWX

I bet this is it too- because my girlfriend just told me that a few days ago Norton caught 2 emails with viruses- She didn't tell me then though, and there is no record in the Norton logs- Then a couple days later I was pulling her email off the pop server and Norton caught 2 Netsky infected email, I deleted them, but obviously it didn't work.....


Now, as I type this, my CPU usage is 100 FREAKING %!!!!! And I keep getting this damn USB device trying to connect!!!



Here is a screenshot-- this is rediculous-- well I can't say I've never been infected anymore, becuase my girlfriend signs up for all kinds of BS using her main Email-




See right here-- http://www.hardwareheaven.com/showthre...824#post310824

"Date: 3/9/2004, Time: 12:43:06, xxxx xx xxxxx
The email attachment misc_shower.zip is infected with the W32.Netsky.C@mm virus.
The file was quarantined.



Date: 3/9/2004, Time: 12:43:06, xxxxx xx xxxxxx
The email attachment misc_shower.rtf.exe within misc_shower.zip is infected with the W32.Netsky.C@mm virus.
The file was quarantined."



I'm screwed- I guess that's what heappens when you let other people use your rig for email...

__________________

PangingJr

1) the prob when 'no internet connection'
Clean boot your XP and see if you still having this prob..
then loading Windows items only (windows 'services')..
then try loading the 3rd party 'Services' items one by one.. and then 'Startup' items...
and tell me which services or strtup items that cause the prob.
note-- reboot everytime when asked..
( How to Perform a Clean Boot in Windows XP - http://support.microsoft.com/default...=kb;ja;Q310353 )
2) the prob with the USB device errors...
try uninstalling every USB root hubs in the Device Manager and let Windows detects and reload driver for it.
after that, go to the Device Manager again and disable 'Allow the computer to turn off this
device...' on all your USB devices and USB root hubs,
and see if this helps.

3) the prob re CPU usage that occurs after internet connection..
not sure but maybe there will be something after the above 2 are fixed..

BWX

Ok, I'll try that. However I found out that the CPU usage happens no matter what- before I restarted windows a few times without my internet connection enabled, without Firewall, and no programs in startup, and "system" still was using CPU- I also did that McAfee Stinger twice- it found nothing, I did a full system scan, it found nothing, so I have no Idea.

About 2)- I have a usb mouse, so it will be hard to uninstal all the hubs, but I think I can navigate through windows with the ALT and keyboard controlls.. I think that USB problem has something to do with the CPU usage problem because when that happens my CPU usage is pegged at 100%..


I used a packet sniffing program and found that a server from my own ISP was hammering me with packets every two seconds. it was 10.160.160.1, from port 67 to port 68 the packet size is always about 338 or 339 (I think in bytes) And the description is :
From port 67 (use) Bootstrap Protocol Server
To port 68 (use) Bootstrap Protocol Client

That server is hitting me with those packets every 2 seconds- When I block 10.160.160.1, it doesn't seen to make any difference, but as soon as I allow that IP to make contact, it starts hitting me again...
It probbaly has nothing to do with my problem, but it is annoying too- I'll try what you said and see if that helps.. I dunno- I have no Idea whats goingn on, bt it's probably going to require a reinstalation of windows.. which really sucks.

__________________

PangingJr

maybe they are checking that you're running some kind of server or something on your PC,
if you still using ZA, try setting all to the program's default,
make a note of whatever you have on present setting so you know what to reset...
anyway, let try all things one by one, stop me anytime whenever you like to quit and go for reformat..

BWX

LOL- yeah, I think one thing at a time is the only way to fiigure this out-

Well, I just actually called my ISP and told them that 10.160.160.1 was hammering me with packets- I talked to a level 2 tech that was really cool- I let him scan all my ports remotely from where he was with my firewall turned off- he said it looked good but a few ports were open- I'm not running a server so I dont' have anything to hide anyway.

The 10.160.160.1 IP I kept seeing sending me packets actually had a server from my ISP in the packet- Here's the weird thing, the tech said that it was not one of their servers and he had no idea what it was- He said he could FTP to it, but could get no other info- He did think it was from my area though, I said if it was one of their customers, he better shut them off and write them a letter...

Basically I just blocked that IP and I don't se that traffic Anymore- BUT I don't see where the firewall has blocked it... Maybe the government is after me, who knows.. But I think I'm getting side tracked with this, because the extra CPU usage happens even with the internet connection turned off.

So after all that- (1 hour plus conversation with ISP)
-I'm going to try this- http://support.microsoft.com/default...=kb;ja;Q310353 and see what happens-

But I might do the thing with my USB drivers first just to make sure that isn't the problem. Man, this is just nuts.

__________________

BWX

Well, I decided to to uninstall the USB controller first because it was the easiest thing to do-


As soon as I did that- the CPU usage went right to zero and stayed there- So I rebooted and let windows work its magic and it installed the devices again. After that the cpu usage was normal - that being zero most of the time while spiking to 4% or sometimes 7% and then back to zero..

Now when I look at CPU time usage in task manager the 'system' process has on;t 5 seconds out of the 24 minutes the PC has been running.

The strange thing is, this has never happened before and it makes me wonder what went wrong and why it happened in the first place? Oh well, at least it's fixed now for the time being.

Thanks everyone for the suggestions- who knows how much time that saved me!

__________________

PangingJr

Glad its better now. keep us all up to date whenever you've more prob.
only one more left i'll keep trying to have you upgrade the NAV 2002.
you've updated your others softwares all the time you just cant overlook computer viruses these days.

BWX

Unfortunately after some testing and uninstalling and reinstalling my USB hub, then uninstalling and reinstalling my mouse drivers, the problem has persisted, but if I go and uninstall my USB hub, the CPU usage goes to zero- So I'm not sure why it start back up when I reinstall it. It's not even a major problem, more annoying that anything- but I know somethings' wrong...

I'm going to start uninstalling and reinstalling drivers and some programs including Firewall and Antivirus programs, and if that doesn't do it, I guess I'll start backing things up and reinstall, it's been since August that I reinstalled windows, and that was just a repair. I think it may be time for a format C to make sure everything is good from the start.

__________________

PangingJr

start backing things up 1st, make a backup is always 1st priority.

FluffyChicken

I wouldn't worry about the NetSky virus, Norton has been catching it properly and you are not getting infected.

If it does get through anyone Norton AV it's eiyher because they have the email protection turned off or are using very old definitions and just haven't boithered to keep it upto date within the past couple of months

BWX232, norton has correctly caught and stopped the virus.

__________________

zerodamage

That is not true. I've had several computers come into my place with problems that had completely updated Norton 2003 and 2004 and it did not detect the Netsky on the system.

PangingJr

any AV can miss viruses and trojans, some AV catches all sorts of viruses the other AV's missed.
not just the netsky there're some trojans that NAV miss like aol_trojan, fakeftp, magichorse, tryit, subseven and more here..http://www.hackfix.org/miscfix/icons-av-all.shtml

about upgrading to newer version...
not just about improving virus detection, you'll get a newer or a different scan engine that provides better performance than an earlier version did on manual scan, and you'll also have an improve real-time scan that runs along with Windows all the time which is your system performance related.