CPU Usage at 100%

[Jereth]

Hi,
I'm having a problem with my PC.  It started when my wife was registering for a free Disne cruise through an e-mail offering from Fisher-Price.  The e-mail looked legitimate, and we do subscribe to the fisher price mailer, so I don't believe it was 'malicious'.

In any case, after clicking on the e-mail, the PC seemed to lock up.  After about 15 min of un-responsiveness, I performed a hard-shud-down.  There was no response from any normal shut-down methods (start-menu and task manager).

Since then, any atempt to do anything has been EXTREAMELY slow.  At one point, I was able to get into the task manager.  From here, I could see that CPU usage is constantly at 100% (from the performance tab) and the the 'System' process cycles through values from 92 to 98% CPU usage.

Now, on attempts to start-up, the system will come to the 'user' selection screen.  After selecting a user (it seems any of the current users, but I've only tried 2 of the 4, with the same results), it seems to hang up.  It does proceed a little, but VERY slowly, and never seems to make it to the normal desk-top.  The farthest it has now gotten is displaying the desk-top graphic, but none of the desk-top icons or the task bar appear.

I AM able to start up in safe mode, but I'm not sure where to go from there.

I took this from one of my earlier posts, so you can see what version of windows I'm running.  I've had a couple auto-updates since then, but I don't recall the details of the changes.

Logfile of HijackThis v1.98.2
Scan saved at 4:25:03 PM, on 3/30/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)



I'm posting this from an alternate PC, so i don't know if I'll be able to post any logs.

Any thoughts on what I can do?

[guestolo]

EDIT >>I just seen what version of hijackthis your running
Please update it>>you can get the latest version from my signature below

Hijackthis will fit on a floppy
So you can save it from one computer and transfer to another computer
Ensure you copy and paste it to the infected computer from the floppy
To a permanent folder

You can download hijackthis from my signature below
I prefer to see a log from the infected computer in normal mode, but if you can only operate at Safe mode that's fine for now

Directions after you have hijackthis on the infected computer
Open Hijackthis
Do a SCAN and Save a Log file---Save the log----copy and paste the WHOLE contents of the log  here... Don't try and fix anything yet----It is all important

You can transfer the log to the floppy again and post it from the other computer

[Guest]

Heh, well, unfortunately, my lap-top does not have a floppy.  But, I was able to start up in safe mode with network.  Also, I did have the latest version, I'd just copied that from an earlier scan.  sorry for the confusion.

In any case, here is the log:

Logfile of HijackThis v1.99.1
Scan saved at 1:46:37 PM, on 4/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.verizon.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2003\Pop3trap.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\PC-cillin 2003\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\PC-cillin 2003\tmproxy.exe

[Jereth]

Bah!  Forgot to log in!  That last post was by me.  Again, sorry for any confusion, and thanks for the help!

[guestolo]

Jereth, the log looks clean in safe mode
Unfortuately Hijackthis doesn't show all the running processes when your in safe mode
as it would in Normal mode
So it's hard to figure out if a bad process is running on normal startup

Is there any way of performing a scan with Hijackthis in Normal mode and posting the log??

One note: This is the second time I have heard about high CPU usage and freezing in normal mode when the hijackthis log looked clean
and PCCillin is installed
I did some hunting around, not sure what version of PCCillin your using but check out this link and let me know if it applies
http://kb.trendmicro.com/solutions/search/...olutionId=24264

[Jereth]

Bingo!  That did it.  I'm not running 2005, but this did the trick anyway.  I'm up in normal mode, and all is well.  I'll send that feedback to Trend as well.

Thanks for the help!

[guestolo]

Thanks for the info Jereth, I can let the other user know as well
In a way I'm glad you posted your problem
 http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/biggrin.gif\' class=\'bbc_emoticon\' alt=\'\' />

[Guest_Rick_*]

Greetings Questolo,

I too have the problem that Jereth has.  In fact, I too have Pccillin.  I can get to the desktop, but shortly thereafter everything comes to a screeching halt.

When I attempt to 'Turn off' the computer a window pops up informing me that CLS_PCCGuide is attempting to shut down.  After it attempts to shut down I get another window informing me that the program 'is not responding.'

Since I can't run in normal mode I won't download the hijackthis program.  Let me know how I may be able to contribute.

Rick

[guestolo]

Rick did you check out the link I supplied to Jereth???

Sounds like you may be running an older version of PCCillin
If you want to check out a Hijackthis log you can transfer it from one computer to another
Vice versa to post the log

Remember to save Hijackthis to a permanent folder
Please Read This