Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

cpu usage 100 percent


  • Please log in to reply
33 replies to this topic

#1 gvl2669

gvl2669

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:51 AM

Posted 19 February 2010 - 09:47 AM

Hello-

Newbie here that needs some help please after tearing my hair out for the last week.
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)

I noticed on Monday that my Mozilla Firefox icon was missing and went an installed the latest 3.6v. My computer became extremely slow and the Task Manager showed that there was a svchost.exe (SYSTEM) that was running at 99% constantly (or a little under that). I removed that version and rolled back to the 3.5.8v and still the same.

After Googling.. I did the following: defrag, registry cleanup, Malywarebytes, CCleaner, disk cleanup, Spybot and still nothing. I ran HiJackthis and don't really understand it. I posted it to a couple of sites but they didn't really help.

I ran Process Explorer and it showed that one svchost.exe as "kernel32.dll!CreateThread+0x22" and the stack for the thread reads:

"ntkrnlpa.exe!NtBuildNumber+0xe
ntkrnlpa.exe!RtlUpcaseUnicodeString+0xbe
ntkrnlpa.exe!ZwYieldExecution+0x4f3
hal.dll+0x2ef2
ntdll.dll!NtDeviceIoControlFile+0xc
WS2_32.dll!recv+0x6f"

I've done more research on this and I still can't figure it out. What am I doing wrong please? Help!

Thank you! Sorry if I sound stupid, but I'm trying..

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:51 AM

Posted 19 February 2010 - 10:06 AM

How to determine what services are running under a SVCHOST.EXE process - http://www.bleepingcomputer.com/tutorials/list-services-running-under-svchost.exe-process/

Louis

#3 gvl2669

gvl2669
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:51 AM

Posted 19 February 2010 - 10:21 AM

Thank you Louis for posting a reply.. I guess I posted the wrong information..

After reading the tutorial.. it says:

DcomLaunch DCOM Server Process Launcher C:\\WINDOWS\system32\rpcss.dll
TermService Terminal Services C:\\WINDOWS\System32\termsrv.dll

Does that help any?

Thanks..
-Grace

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:51 AM

Posted 19 February 2010 - 10:35 AM

Well...that DCOM Launcher Service seems to have been prominent in a number of recent suspected malware instances posted in this forum.

You might take a look at Possibly Related Threads.

Louis

#5 gvl2669

gvl2669
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:51 AM

Posted 19 February 2010 - 10:40 AM

sigh.. yeah I already went through all of those and then some.. they did nothing... :thumbsup:

#6 techextreme

techextreme

    Bleepin Tech


  • BC Advisor
  • 2,125 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pittsburgh, PA
  • Local time:10:51 AM

Posted 19 February 2010 - 10:51 AM

Can you give us a little information about your system please:

Motherboard
Processor
Memory

Techextreme

"Admire those who attempt great things, even though they fail."

-- Seneca

 


#7 gvl2669

gvl2669
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:51 AM

Posted 19 February 2010 - 11:25 AM

:thumbsup: Thank you!

Motherboard says: ASUSTek Computer INC/Model: Amberine M 1.03/Chipset: ATI Xpress 200(RS480) Rev 10/Southbridge ATI SB400/LPCIO SMSC/Bios Brand Phoenix Tech LTD/version 3.14

Memory: Type DDR/Channels # Dual/Size: 1024 MBytes

Processor: AM Athlon 64 3400+

I hope that's right.. :flowers:

-Grace

#8 techextreme

techextreme

    Bleepin Tech


  • BC Advisor
  • 2,125 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pittsburgh, PA
  • Local time:10:51 AM

Posted 19 February 2010 - 11:31 AM

What did Malwarebytes find ( if anything ) when you ran a scan with it?

Would this computer happen to be a Compaq Presario SR... Model?

Techextreme

"Admire those who attempt great things, even though they fail."

-- Seneca

 


#9 gvl2669

gvl2669
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:51 AM

Posted 19 February 2010 - 11:45 AM

Malwarebytes found nothing.. and I ran the FULL scan too...

Actually it's an HP Pavilion a1330e

#10 techextreme

techextreme

    Bleepin Tech


  • BC Advisor
  • 2,125 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pittsburgh, PA
  • Local time:10:51 AM

Posted 19 February 2010 - 11:53 AM

Have you updated any drivers on your computer lately?

Have you run Windows Update or installed Updates lately?

Did you recently install Service pack 3?

Techextreme

"Admire those who attempt great things, even though they fail."

-- Seneca

 


#11 gvl2669

gvl2669
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:51 AM

Posted 19 February 2010 - 12:09 PM

none of them actually.. I even ignore the add-ons for Firefox cause I'm so paranoid.. the only things was that Mozilla because it had mysteriously disappeared from my desktop..

#12 gvl2669

gvl2669
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:51 AM

Posted 19 February 2010 - 01:05 PM

oh and every once in a while I can hit CTRL ALT DEL and it unfreezes the computer for a few minutes..

#13 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:02:51 PM

Posted 19 February 2010 - 01:07 PM

Delete your Firefox Profile, and then remove Firefox then reinstall. Something in your firefox profile is causing this.

#14 gvl2669

gvl2669
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:09:51 AM

Posted 19 February 2010 - 01:11 PM

ok this is going to sound REALLY stupid.. but forgive me OK? :thumbsup:

Is that the same thing as deleting the entire Firefox Program and reinstalling.. or no?


Thanks!

#15 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:02:51 PM

Posted 19 February 2010 - 01:13 PM

When you remove/uninstall firefox your profile remains to keep bookmarks and other things. It doesn't get removed.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users