Something using 20% CPU in Background

[RickG]

Hello-

There's something that starts running that uses 20% CPU when doing nothing. Mouse hangs up, audio skips etc. When I shutdown it stays away for awhile but eventually comes back. Task manager shows the 20% under performance, but not any usage under processes. Spybot and PCcillin don't show anything. Is there any other program that looks a whats using CPU resource's?

Thanks- Rick

XP Pro
AMD 4400 X2
2 gigs XMS 3500

[tashi]

Hi

Have you ran an on-line anti virus scanner as opposed to a resident AV. Sometimes malware eats cpu.


Panda Online Scan (http://www.pandasoftware.com/activescan/com/activescan_principal.htm)

Bit Defender Virus Scan (http://www.bitdefender.com/scan/licence.php)

Trend Micro Online Scan (http://housecall.trendmicro.com/)

Mcafee Virus Scan (http://us.mcafee.com/root/mfs/default.asp?cid=9914)


I like this free Process Viewer for Windows:
http://www.teamcti.com/pview/prcview.htm

[RickG]

Hello-

I ran Trendmicro's house call and it found 19 adw's, toj',s and boh's I might have some of the acronyms wrong. I had it do an auto clean, of these 5 couldn't be removed. I was reading the info on the remaining 5 and an error happend and closed house call. They all ended with P3P/history/XXXX, I think one was bfast and another might have been fastclick, didn't have time to write them down. Why doesn't PcCillins internet security pick these up but, house call does? I have also found RXtool and The Best Offers, neither will delete.

Thanks

[RickG]

Hello-

Went into safe mode deleted all registries asociated with rxtool and the best offers, hopefully. Deleted there folders and everything else I could find with there name on it. Still working on the rest

Rick

[tashi]

Sounds good and when you have finished with that part if you would like to post a Spybot-S&D log.


Open SpyBot, check for and get any updates available.
Close all browsers, check for problems and fix everything found in red
Then on the toolbar menu select mode and switch to advanced mode, on the left lower down select tools, and view report, ensure all the options are selected near the bottom except

Uncheck[ ] do not report disabled or known legitimate Items.
uncheck[ ] Include a list of services in report.
Uncheck[ ] Include uninstall list in report.

Now select (near the top) view report.
Press export in the save in box choose a place such as your my documents folder, then in your next post near the bottom select the "browse" button; navigate to and attach or post that report.

All AV's not being equal, an on-line scanner sometimes picks up stuff a resident AV doesn't. It doesn't hurt to run one every couple of weeks.

[RickG]

Hello-

Thanks for the help, I attached the report it ws to long to post. Computer seems to be running alot better, boots faster as well. I'm still get a few PcCilin pop ups

ADW_ALTNET.C Located at
C:\Documents and Settings\Rick\Local Settings\Temp\p2psetup.exe

ADW_ALTNET.C Located at
C:\System Volume Information\_restore{65A05A19-172A-4E20-AF52-B8F2FCF51C13}\RP153\A0036590.exe


ADW_ALTNET.C & ADW_TOPSEARCH.A located at
C:\DOCUME~1\Rick\LOCALS~1\Temp\V798R0a03236

System restore is turned off, thought it already was. Oh yeah and I got a "Virtual Bouncer access violation at address 005A751C in module "spybotSD.exe" read of address 037AFFFF" on that last scan

Thanks

[LonnyRJones]

Those warnings about ALTNET.C are from pccilin ?

Please get another SSD report, this time after checking for problems.. as Tashi suggested.

[RickG]

Hello-

Yes the warnings are from PCcillin. Here's a new report, no problems found.

[LonnyRJones]

Im not seeing any of the current crop of spybots/virus/trojans

It would be a good idea to clear your temps with a program such as
System Security Suite.
http://www.igorshpak.net/
Extract it from the zip file and run setup.exe
after the install you can delete setup.exe and the downloaded zip file
Start the program Check all the boxes under the 'Items to Clear' (except perhaps cookies) tab and click 'Clear Selected Items'. You will be prompted to reboot, do so.


Post a log from the panda online scan, Tashi linked earlyer.