Re: WinXP SP3, 100% CPU Usage Nightmare
- From: Teknowbabble <teknowbabble@xxxxxxxxx>
- Date: Tue, 13 May 2008 21:19:22 -0700 (PDT)
On May 11, 6:05 am, Teknowbabble <teknowbab...@xxxxxxxxx> wrote:
Ever since I downloaded WinXP SP3 I think its released demonic forces
into my system.
I haven't seen anything like this since my browser got Hi-Jacked
several years ago. It's maddening.
----------------------------------------
What Initially Happened
----------------------------------------
Initially I noticed that my CPU usage went to 100% when I went into my
Gmail (email) account or I was playing certain YouTube videos.
ZoneAlarm VSMON.EXE and Microsoft IEXPLORE.EXE were the responsible
culprits according to Sysinternal Process Explorer.
-------------------
What I Did
-------------------
I uninstalled and re-installed both ZoneAlarm and Internet Explorer 7.
Unfortunately that didn't solve the problem.
--------------------------------------------
What Microsoft Support Did
--------------------------------------------
Microsoft tech support changed my swap file size and erased some
browser add-ons that were hogging IE7 system resources. I also had all
my drives scanned and fixed through the Microsoft Live Onecare System
Scan. The scanned revealed several bugs.
-----------------------------
Current Prognosis
-----------------------------
Currently I can get into Gmail with No problems. Unfortunately my
system goes to 100% CPU usage when I watch a YouTube Video. Weird!
If anyone has any thoughts, Im all ears.
Ive included my system specs and a HijackThis logfile below as well.
Thanks in Advance.
Teknowbabble
--------------------------------------
FYI, My System Setup
-------------------------------------
Intel P4 2.8 Ghz (Northwood)
800 FSB
Hyperthreading
WinXP SP3
Intel D865GBF Mobo (socket 478)
1 GB RAM (Crucial DDR400)
-----------------------------------------------------
HijackThis Logfile
-----------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:02:03 AM, on 5/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\DeltaIITray.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\SurfControl\CyberPatrol\CPHQ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SurfControl\CyberPatrol\cpserver.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\SurfControl\CyberPatrol\cpACtrl.exe
C:\Program Files\SurfControl\CyberPatrol\cpCCtrl.exe
C:\Program Files\SurfControl\CyberPatrol\cpkbinst.exe
C:\ALEXS-FILES\Computer\Diagnostics\procexp.exe
C:\Program Files\Intel\Intel(R) Active Monitor\iActvMon.exe
C:\Program Files\Microsoft Sysinternals\ZoomIt\ZoomIt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE
C:\WINDOWS\notepad.exe
C:\Program Files\HijackThis\HijackThis-V2-02.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL
=http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant
=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch
=
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-
B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat
\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-
A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:
\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Bridge Class - {E479EDE1-923E-11D3-B82B-00E09871521B} - C:
\Program Files\Compass\CmpsIE.dll
O3 - Toolbar: (no name) - {1F088139-2F7F-41E2-A801-42761CB3D2AC} - (no
file)
O4 - HKLM\..\Run: [DeltaIITaskbarApp] C:\WINDOWS
\system32\DeltaIITray.exe
O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel(R) Active
Monitor\imontray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime
\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [CyberPatrolNew] "C:\Program Files\SurfControl
\CyberPatrol\CPHQ.exe" /m
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs
\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft
ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES
\MICROSOFT ACTIVESYNC\WCESCOMM.EXE" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES
\MICROSOFT ACTIVESYNC\WCESCOMM.EXE" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES
\MICROSOFT ACTIVESYNC\WCESCOMM.EXE" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Printing Migration] rundll32.exe C:
\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User
'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES
\MICROSOFT ACTIVESYNC\WCESCOMM.EXE" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Printing Migration] rundll32.exe C:
\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User
'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:
\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O9 - Extra button: Send to OneNote -
{2670000A-7350-4f3c-8081-5663EE0C6C49} - C:
\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote -
{2670000A-7350-4f3c-8081-5663EE0C6C49} - C:
\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite -
{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:
\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}
- C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... -
{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:
\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
- (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583}
- C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-
d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic
\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}
- C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-
BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: myFavorites 2 - {D2BC8EE6-7E71-4c3c-
AD9A-0D7D95D11FDC} - C:\Program Files\Arcadia\myFavorites
2\myFavorites.hta (HKCU)
O9 - Extra 'Tools' menuitem: myFavorites 2 - {D2BC8EE6-7E71-4c3c-
AD9A-0D7D95D11FDC} - C:\Program Files\Arcadia\myFavorites
2\myFavorites.hta (HKCU)
O16 - DPF: Yahoo! Chat -http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio
Conferencing) -http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation
Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) -http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) -https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety
Center Base Module) -http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase95...
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class)
-http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class)
-http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) -http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller
Class) -http://h30155.www3.hp.com/ediags/gs/install/guidedsolutions.cab
O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B}
(WebResponseAttachments Control) -https://webresponse.one.microsoft.com/oas/ActiveX/FileXfer.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class)
-http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - ...
read more »
******************************
ADDENDUM
******************************
I spoke too soon.
I still had problems with certain Youtube videos going to 100% CPU
usage even with Cyberpatrol removed. Turns out that ZoneAlarm was the
culprit as well.
I turned off ZoneAlarm (firewall). Windows firewall automatically
turns on in its place. When I ran the videos that gave me problems
they operated normally.
Looks like between ZoneAlarm and CyberPatrol the two are reacting with
Windows XP SP3 and the software from Gmail and YouTube. If I was a
nuclear physicist maybe I might be able to figure all this out.
For now I'll just have to figure out what works and what doesnt and
keep my fingers crossed that I dont get some nasty virus or spyware.
Teknowbabble
.
- References:
- WinXP SP3, 100% CPU Usage Nightmare
- From: Teknowbabble
- WinXP SP3, 100% CPU Usage Nightmare
- Prev by Date: Re: Vista Sp1 & XP-Sp3 available on a disk?
- Next by Date: cant connect to windows update page
- Previous by thread: Re: WinXP SP3, 100% CPU Usage Nightmare
- Next by thread: SP1 problem
- Index(es):
Relevant Pages
|
