Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

100% CPU usage - possible Spyware/Malware infection - Help!


  • Please log in to reply
4 replies to this topic

#1 zeshan

zeshan

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:06:07 PM

Posted 27 February 2010 - 03:16 AM

Hello guys, It's me again :thumbsup: it been a long year and a half hehe

Okay onto the problem. 2 days back, sitting on me laptop, wanting to watch the olympics I tried getting some live stream online. As I very well knew, this was risky, however I had done this before( seen stuff on live stream) and had no problems whatsoever. It was not to be this time. While running the stream, NOD32 detected some possible threats and cleaned them I guess. I should have stopped the live stream then, but I did not.

Immediately, I noticed that a fake security program called "SECURITY TOOL" was downloaded on to my laptop and it was giving me fake warnings continuously. I did a google search and came upon this video - with instructions on how to remove the program. It was rather simple, involving locating the program, renaming, rebooting, deleting the program file and then deleting the rootkey.

The fake program was gone, my troubles however weren't. I immediately noticed that my computer had gone horribly slow. I could not run anything properly, even internet seemed to not work. I did a few scan on spybot search and destroy, nod32 and Malwarebyte's anti-malware and all of them found some spyware/malware. They cleaned it up as well, however the system is still too slow.

I noticed that SVCHOST.Exe under the user name of SYSTEM is using nearly 99% of CPU usage and perhaps is the culprit behind this. I tried stopping it, but my computer shut down instantly as expected. I do not know if it is SVCHOST or some malwares that are causing this problem. I have had no problem like this before, I did have vundo.trojan on my system a year and half back, but it was cleaned thnks to buckeye_sam of this forums.

I will post required logs when asked for ;)
Would be grateful if someone could help
Zeshan

PS: sorry for the long article

BC AdBot (Login to Remove)

 


#2 SpaceCadetDan

SpaceCadetDan

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:07 PM

Posted 27 February 2010 - 02:49 PM

svchost.exe contains the Windows Update process. There are been numerous reports of this kind of problem.

What OS are you running?

Have you installed all latest fixes and service packs?

#3 zeshan

zeshan
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:06:07 PM

Posted 27 February 2010 - 05:31 PM

I have Windows XP professional with service pack 3 currently.

#4 SpaceCadetDan

SpaceCadetDan

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:07 PM

Posted 27 February 2010 - 06:41 PM

Check out this link - http://support.microsoft.com/kb/927891

#5 zeshan

zeshan
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:06:07 PM

Posted 28 February 2010 - 02:03 AM

Most or nearly all of the symptoms shows in the link is not shown by my laptop and I already have all of the updates required by Microsoft <-- I have automatic updates and I checked today manually for updates as well.

When I go to the System Configuration Utility by doing msconfig on run and then going to startup tab, I see a startup item which I have no idea what it is. I tried searching for it online, but I did not get any result whatsoever. This is what it shows.

ucowusehihevur and under the command section it says rundll32.exe "C:Windows\ucowusehihevur.dll", Startup
This item is currently launched amongst other things during start up. Do you guys know what it might be for? or is it a malware that is causing svchost.exe to take nearly 100% of CPU usage???




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users