Tracking software?

[Sublime1]

I've noticed recently that about 5 minutes after I stop using my computer and the screen saver kicks in that my CPU starts running and keeps running. If I move the mouse to stop the screen saver, the CPU stops.

It isn't the screen saver (I'm just using the basic Win XP Starfield) because it doesn't start when the screen saver does. I don't have anything scheduled to run and it happens at all times of the day. If I disconnect my modem, it seems to stutter a bit and eventually stop. If I do nothing, it runs and runs for ages.

I think it's a virus but I've run several A/V programs and they have found nothing. There are no other signs of a virus - no slowdowns, no glitches. I run a full A/V scan every week and keep a pretty clean system but obviously something is going on here.

What I'm wondering is if anyone can recommend a freeware tracking software that will let me know every program that runs on my CPU. I don't care about keystroke tracking, just about whatever this is that's running when the system is supposed to be idle. I figured if I could track what's running, I could get rid of it.

Any ideas would be greatly appreciated!
Thanks.

 

[Archean]

Please have a look at this page and see if its useful for you. If you choose to follow do post your log files here for review.

 

[DelJo63]

hmm; tracking vs installed vs running -- very broad.

windows has the TASKLIST command which can save results to disk

tasklist >running_tasks.txt​

an inventory of installed programs is available using WinAudit

But 'determining what is running when the system is sleeping' is a contradiction in terms

 

[Sublime1]

Thanks for the replies.

Archean - I already had many of the programs installed that your link referenced. So far, they haven't found much. But there are a couple there I haven't tried so I'll have at those first.

Jobeard - maybe I'm not explaining this right. When I stop using the computer I still leave it on. Think of it as leaving for lunch. I leave the power on to everything, the modem still live, etc. After one minute of no input the screensaver (WinXP Starfield) kicks in. Usually 5 minutes later, the blue light that blinks when I'm accessing a program starts to blink and then glows bright blue. You can hear the hard drive spinning and it's clear that the CPU is doing something. The second I move the mouse or touch the keyboard, it all stops.

If it was actually the screensaver, it would start when the screensaver does. But it doesn't. At times, it runs for 10 or 20 mins and then stops. But the screensaver goes merrily on.

The best I can figure out is that something waits until there is no new activity and then kicks in. What it's doing, what program it is, etc. I have no idea.

I haven't had any luck identifying it as malware but I guess I have to assume it is. As a matter of course I always disable automatic updating of all programs but I did check this too. Nothing I've installed is "phoning home".

Does any of this make sense?

 

[DelJo63]

run the tasklist>myTasks.txt and then follow-up with that file as an attachment please

 

[Archean]

I think it will be more appropriate to run it as:

tasklist /m /fi "memusage gt 1" /fi "cputime gt 00:00:01" /fo table >Process.txt

And sublime; some things can slip through AVs/Antimalwares or any such thing.

 

[Sublime1]

I don't seem to have Tasklist. I tried copying and pasting from your mesage and running that but it can't find that file. And I searched for Tasklist and it found nothing on my system.

Should I have it? Should I use the other software you mentioned?

Thanks!

 

[DelJo63]

I think it will be more appropriate to run it as:

tasklist /m /fi "memusage gt 1" /fi "cputime gt 00:00:01" /fo table >Process.txt

No, I was looking to see what services are running, like dumb Java Updates and the like

@Sublime1: should be seen dir \windows\system32\task*

 

[Sublime1]

I still can't run this. I checked the directory you mentioned and I don't have a "task" file or folder. I have Taskman and Taskmgr files but that's as close as I can come.

 

[DelJo63]

try net start> Services.txt instead.

It is not as complete but it's a start ...

 

[Sublime1]

All that does is bring up a black DOS box for a second. Then it goes away on it's own. Does it generate a file I can find somewhere?

 

[DelJo63]

1 ) get a command prompt

2) net start >services.txt

the file will be services.txt

 

[Sublime1]

That worked!

I'm attaching (I hope!) the services.txt file.

 

[DelJo63]

Services are fine;

Automatic Updates; this is the Windows Updates and you should keep it.

SystemSuite; a Security package
SystemSuite Task Manager (hmm; can you get it to Export a list of processes?)​

btw: Which versions of windows are you running anyway?

In general, any program that has an online updating feature(AU), will run it when scheduled OR during system IDLE time. Idle time also kicks-in the screen saver, so guess what we expect to happen? Screen Saver starts, and so does the Auto Updates :0

I can't see ALL of your running programs w/o the TASKLIST or somethink like it, but I think you're ok.
You might disconnect the system from your router/modem and let the system go into
screen saver and see if the disk still rattles. If does not, then it's the AU running.

 

[Sublime1]

Sorry, I should have said. I'm running WinXP home edition.

The System Suite Task Manager is actually scheduled events, all of which notify you they are about to begin with a 10 sec. countdown and all of which take place from 1AM to 5AM. This is something I checked first, thinking that perhaps I had put PM instead of AM on the scheduled times. But the Scheduler is running fine and generates a report of each event - all of which are right on track.

I did try disconnecting the modem and the disk stutters a bit and then stops after a minute or so.

I have the Automatic Updates turned off. I just checked and it's definitely off.

Normally, I do Windows updates about once a month or once every 6 weeks. It's possible this problem started after I did my last batch of last year. But if it's really the updater, how come when I checked a week ago there was a huge pile of updates waiting for me dating back 6 weeks? Shouldn't the updater have actually done them? Or is it just spinning it's wheels trying to access or download and repeatedly failing?

If it's the updater then I guess that's OK. Annoying, but OK.

 

[Bobbye]

One other thing you can do is:

When you system is 'out to lunch', right click on the Taskbar> Task Manager> Processes tab.

The only CPU usage you should see is system Idle, System and taskmgr. They will add up to 100%. See what process is also using the CPU (other than 1 or 2%), identify it.

That should help. Very low tech.

 

[Sublime1]

Thanks Bobbye. I actually tried that but the second I touch the mouse, the thing that's running stops.

By the time I click through, it's long gone.

That's why I was concerned and that's why I was looking for a way to see exactly what's been running while I'm not using the system.

 

[Archean]

Well follow the Bobbye's instructions but leave Task Manager running (with process tab focused), when you are not using your system; and turn off all power management features. I dont know if always ontop option in task manager's option menu will keep it on the screen while that screensaver of yours is running; but I guess its worth a try.

 

[DelJo63]

I dont know if always ontop option in task manager's option menu will keep it on the screen while that screensaver of yours is running; but I guess its worth a try.

sadly it doesn't

 

[Archean]

yup suspected that funnily i never thought of doing it ever before the other day when i read your post, despite using PCs for almost 20 years

 

[Sublime1]

Thanks all for the replies.

I tried the Task Manager thing. Shut the screen saver off, put the Task Manager on top on the Processes tab and waited. But nothing happened. Maybe because the Task Manager refreshes itself and that's enough to stop the other thing from running.

If it's really the Windows Updater, is there a way to turn that off? I've got Automatic Updates turned completely off using Control Panel - System - Automatic Updates. Is there someplace else I should be turning it off?

Or some program other than the Task Manager that will tell me what's running when the system is supposed to be idle?

Appreciate all the help here guys.

 

[Bobbye]

The problem is getting muddled here. Disable the screen saver. Use msconfig to stop all auto-updates and other non-essential programs. Open the Security Center in the Control Panel> Automatic Updates> be sure 'disabled auto-updates' is checked> Apply> OK.

Reboot. (ignore and close nag message- check 'don't show again first.) Stay in Selective Startup. Don't open or launch anything. Right click on Taskbar> Task Manager> Processed tab> double click on top frame of Image Name to sort in descending order and watch the usage. Only System, System Idle and taskmgr should show any activity. If anything else does over 1-2%, check name and look for description in Google.

 

[Archean]

Thanks all for the replies.
Maybe because the Task Manager refreshes itself and that's enough to stop the other thing from running.

By default Task Manager refreshes its info once every second; having seen your replies it seems useless to keep trying Task Manager to tell what it can't.

Because, as you earlier said that the activity stutters and stops & runs only when screen saver runs when you disconnect your pc from internet. So IMHO you'll be served much better with TCPView, it gives you detail of all opened TCP and UDP endpoints on your computer (that also include local / remote addresses & TCP connections status) including the name of the process that owns the endpoint. It also gives you information about processes/programs running in background and accessing internet.