RussellJesson

I have a Vista Basic system that now runs at 100% CPU usage but looking at the Task Manager there is no process using anything close. Most of the CPU seems to be used in kernel mode.
The problem does not exist in Safe Mode and a SpyBot S&D and AVG scans show no problems. However boot back into normal mode and very slow running again.
It does not happen as soon as the system starts up but after it's been running a minute or so. Also it seems worse if the machine is not connected to the internet.
Question is there anything I can run to identify what is using all the CPU?

Thanks

Russell

Katipo

try downloading process manager.

truthseeker

The main cause I have found is actually a problem with the way explorer handles avi files!

If you have an incomplete avi file, or a damaged avi file, explorer will read it frame by frame to determine it's properties (such as video size, length etc..)

You can confirm this by starting the task manager next time it happens, I know it will takes ages to open but be patient! if you see that explorer.exe is the process using all your CPU do the following:

1. Open up regedit
2. Goto HKEY_CLASSES_ROOT\SystemFileAssociations\.avi\shellex\PropertyHandler
3. Delete the "Default" value which should be "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"

After restarting the problem should be solved. **note** You won't have any video properties any more if you right-click and avi file, but I'm sure you never use it!

If the process is not explorer.exe then there are a few other problems that could cause the same symptoms. Some people suggest that the print spooler of all things was the cause!

You could also have a keyboard issue, some logitech keyboards have some driver issues which can cause the 100% cpu usage. Also physical damage could case the problem (which could mean continuous interrupt requests and hence 100% CPU utilisation)

This webpage may also be useful for you:

http://www.computerhope.com/issues/ch000616.htm

Let me know how you go. Good luck!

RussellJesson

When looking in the Task Manager no process is using anything more than a few % of CPU. I'm beginning to suspect some sort of driver related problem as this does not occur in safe mode.
The problem is until I know what is using all the CPU it's all guess work.
The machine is a laptop.
The only thing other was some MP3 files from a suspect source were copied and played before the problem started so possibly a bad Codec?

RussellJesson

Moved on a bit. The sysinternals process explorer identified it as a svchost.exe process but it appeared to be running normal microsoft services CryptSvc, Dnccache,NlaSvc and TermService.
However there are several services listed with strange names for example FQWO and the executables all in the temp files. So from Safe Mode I disabled these. However if I restart in normal mode with services enable (using Windows Configuration Utility) shortly after I start the same svchost.exe goes to near 100%, if I disable all services I'm stuck because....
I want to update the virus checker but it requires a windows patch which refuses to install in safe mode even having downloaded it!!!! As soon as I startup with any services enabled the thing runs at 100% and effectively stops me doing anything. To add to the misery Vista stops ME doing anything like dropping priority on the svchost.exe to let me do anything else!!!!

Anybody any thoughts??

Russell

RussellJesson

This is getting more an more strange, it's svchost.exe that causes the problem and it's running cryptsvc, dnscach, ktmrm, nlasvc, tapisrv and TermService looking at the thread it's either crytsvc or ntdll that are using the CPU.

However there seems to be a problem with windows update in that I tried to update avg to version 8 and it refuses as it needs KB929547 I downloaded that and it starts to install then just stops, this is despite auto-update loading all current patches. Some other installs will not work either.

I've included a Hijack this listing:

Logfile of HijackThis v1.99.1
Scan saved at 09:37:00, on 21/05/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\sysInternals\procexp.exe
C:\Program Files\BigFix\bigfix.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\sysInternals\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.h...=PTB&M=ML6226B
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.h...=PTB&M=ML6226B
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.h...=PTB&M=ML6226B
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\google\BAE.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [BigFix] c:\program files\Bigfix\bigfix.exe /atstartup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxdev.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

nvc_vishwanatha

Hi, May i just add to this thread. I am not sure if i must be writing this in a new thread, but my problem, very closely matches with this topic. My friend's PC (Windows XP home) also has the same problem. 100% CPU usage even when idle, and checking on task manager doesnt show any single process consuming huge %age. I reinstalled windows operating system assuming it could be due to some malware, but to my surprise, the problem still persists. It take a long time to boot up also, because of this 100% CPU problem. literally around 10 mins to finish up loading all minimum start-up programs. I also ran HijackThis on that PC and didnt find any unwanted processes in it. This being a new installation, the log itself was very short. I am afraid, i dont have the log right now, i will post the log, if you ask for it. But my question is, how can this happen in a fresh OS installation. Is that, then related to some hardware problem ?

RussellJesson

Hi

One of the areas I investigated is problems with Windows Update, if you search for Windows Update and 99% CPU there is a lot of information about the problem. As a first step disable the Windows Automatic Update and see if that resolves the problem.

RussellJesson

Just to follow up the problem, the cure was to re-install Vista. There was some form of corruption whether it was malware caused I've no idea as all the scans came back negative.
The only clue I have is some dodge MP3 files were loaded on and played which might have caused a malware loaded codec to be loaded, now disabled. The other issue was the laptop was reporting traces of Norton despite, to my knowledge, nothing from them being any where near the system.