100% CPU - but no obvious spyware

[Quantum_Chris]

My computer: hp compaq nx9005, AMD Athlon, Windows XP Home SP2.

As soon as I turn on my computer the CPU runs at 100% and the cooling fan turns on max. The process System (not System Idle Process) is at 90%+ when no applications are running. I have run Microsoft anti-spyware, ad-aware, spybot and have Symantec antivirus. Any ideas?

Chris.

 

[DelJo63]

How much ram is installed and what's the free space on the HD?

get Process Explorer from www.sysinternals.com
run it on an Admin account
click on the busy System name
at the bottom of the window, you'll find all the items 'System' is responsible for.
You will not see %CPU each, but at least you can find 'the usual suspects'
and can start to investigate.

you will see a long list of
File \Device\Tcp
file \device\NetBT_Tcpip_{......}
key HKLM\System\ControlSet001\Service\...
Process xxx.exe(pid)
Thread system(pid): nnn

If you have hispeed DSL/Cable, try disconnecting it from the system before
you boot to eleminate all networking.

 

[Quantum_Chris]

248MB RAM and 5GB free out of a 30GB HD.

I've run the program and can see lots of things in the bottom panel under system, any advice about what to do now? Anything in particular that shouldn't be there?

Thanks

 

[Paragon33]

PIO Only??

Maybe your UDMA has been reset to PIO Only from errors.
Right click My Computer and click Properties/Hardware/Device Manager. Click the plus mark for IDE/ATA/ATAPI controllers and the right click Primary IDE Channel. Click Properties/Advanced Settings and check the slots for Transfer Mode and Current Transfer Mode. The first shoud be set for DMA if Available; if it is set for PIO only, Change it, then apply and OK out. Then shutdown the computer for at least 15 seconds. On reboot go back to the same spot and see if it took. Then check the other device on Primary IDE Channel and the two on the Secondary IDE Channel for the same thing. See if that helps any.

 

[RealBlackStuff]

You need more harddisk space. And you should at least DOUBLE your RAM.
Poor Windows does not know WHERE to put stuff in the pagefile.

 

[Paragon33]

Page File

That is assuming he HAS a Page File. W-XP sometimes on a reinstall will turn the Page File setting to None by default. I agree with you, Realblackstuff, that he either needs to dump a bunch of "stuff" or get a 60gb Harddrive. 5gb is barely enough to do an effective defrag; 15% is a figure I remember

 

[Nodsu]

The lack of RAM would actually mean less CPU usage since the thing would be sitting idle waiting for paging operations..

Quantum_Chris: start by disabling things. Disable/uninstall your antivirus program. Disable/uninstall your firewall program. Get the latest drivers for all your hardware. Disable/uninstrall any third party driver-level programs like CD emulators etc.

 

[Quantum_Chris]

I checked both devices on both channels and they were already all set to DMA if available. I also checked the page file and it was set to custom: initial 288MB, max 576MB. I'll take some stuff off the HD (I'm in the process of moving my mp3s to my mp3 player) and do a defrag...

 

[Quantum_Chris]

Sorry Nodsu, just saw your post. I'll also try to disable that stuff.

 

[Crimsonite]

Check for files that are running within the Windows file system such as: Spyalert.exe, crutor.exe, ga8510e.exe, ga8610c.exe, spx.exe, shx.exe...etc. Some others I forgot their names. Usually bringing up the Task Manager and you can view the files that are currently running. However, ending the task of such spyware files and removing their registry files cannot get rid of them. MicroSoft's Anti-Spyware, Spybot, Adware and the rest of the Spyware removers cannot remove these files. These are the system files of spywares called wwwCOOLSEARCH.COM. They have advanced their coding methods and came up with some of today's most deadly spywares. My suggestion is backup your files and docs and such, and reformat the drive.

 

[Crimsonite]

There is a one method though, that MIGHT prevent most spywares being installed on your system. Here's what you do:

For Win2k:
1>Start = Control Panel = Administrative Tools = Services
Scroll down until you see "Messenger", it says "Sends and receives messages transmitted by administrators or by the Alerter service." Stop the service by clicking "Stop", and disable it by using the pull-down menu and choose "Disable", then click on "Log On" tab, on the bottom white box doubleclick on "Profile 1" and it should change to "Disable".
2>Scroll down to TCP/IP NetBIOS. Now if you are running on a network and you often need to access other comps on it, then don't disable this, but do click "Stop", then from the pull-down menu choose "Manual", then click on "Log On" tab, on the bottom white box doubleclick on "Profile 1" and it should change to "Disable". Otherwise, stop it and disable it all the way.
3>If you are not sharing a network printer with other comps in the household nor do you need to access other comps, then disable "File and printer sharing for MicroSoft Networks".
4>Go to LAN setting properties, see if there's NWLink NetBIOS and NWLink IPX/SPX/NetBIOS compatible transport protocol. If you do, uncheck NWLink NetBIOS.
5>Click on "Internet Protocol(TCP/IP)", click on "Properties", click on "Advanced", click on the "WINS" tab. Now if you don't need to access other comps nor do you share printer, the click on "Disable NetBIOS over TCP/IP".

For WinXP:
Start=Control Panel=Performance=Administrative Tools=Services and go by the same steps as above. Then go to Internet Connection & LAN settings for the same procedures.

I'm a tech for a computer company and this is what I tell all my customers to do when they have spyware problems, and they are all happy with the end results. Hope these will also help you!

 

[Quantum_Chris]

Well after a few months of this problem it is finally sorted - I just thought I'd let you know. Today, for no good reason, I took the battery out of my laptop, put it back and now its fixed! Seriously. It no longer runs at 100% CPU and a whole lot of other problems are gone - the computer shuts down by itself after clicking turn off (I dont have to hold the switch down), I can use word without it crashing etc. If anyone can explain that I'll be impressed.

 

[DelJo63]

google for 'smart battery technology' - - some batteries have LOGIC in them!

 

[Rick]

Well after a few months of this problem it is finally sorted - I just thought I'd let you know. Today, for no good reason, I took the battery out of my laptop, put it back and now its fixed! Seriously. It no longer runs at 100% CPU and a whole lot of other problems are gone - the computer shuts down by itself after clicking turn off (I dont have to hold the switch down), I can use word without it crashing etc. If anyone can explain that I'll be impressed.

I imagine (if it is a known issue and the company actually cares to fix it), there's probably a new BIOS for your computer which address the issue.