Erratic CPU Usage

[thunderthor]

Hello,

I am a newbie and I am posting on this thread as I dont know if I should open a new thread for a similar problem.

I have a Dell Dimension L866r with a Pentium III 866 MHz CPU and 256 MB RAM. It has Windows 2000 Professional installed with Service Pack 4 and all the updates from the windowsupdate site. I have installed McAfee Antivirus,Zone Alarm Pro and Ad-Aware SE(all with the latest updates). I use a D-Link AirPlus Wireless PCI Network Card to connect to the Internet Router.

My CPU Usage is very very erratic and very often reaches 100% and stalls the system, even when it has just booted up and even 1 program like the Windows Media Player or DivX Player running. I have found that it is SERVICES.EXE which jumps up to 90% and over CPU Usage ever so often.

I had reinstalled the operating system just a week back thinking that this problem might be because of some spyware or virus which my existant tools (Ad-Aware,McAfee,Zone Alarm) could not detect.

It is very frustrating that in between my work I am totally stuck for a couple of minutes every now and then with this situation even when all I have open is just 'Windows Explorer' and 'Microsoft Excel'. My problem is not only when I start an application or the task manager. It could happen when I am away reading a book while I am playing songs on the Windows Media Player OR while I am trying to scroll down a web page or Microsoft Word File.

Thank you very much for any reply.

Best regards,
Sudhir

PS : I had put this query in another thread before (

http://www.tek-tips.com/viewthread.cfm?qid=697527&page=1)

but I was advised that it would be better to start my own thread for this)

 

[garebo]

Thunderthor, if you checked back through all the threads here you would find several complaining about the very same thing. All or most of the time, probably most of the time, the problem is a trojan horse. Thats with the 100% cpu usage you are talking about, very familiar these days.
And it could have stayed on even though you re-installed as you would have had to reformat, even that is only a lot better and not a guarantee.

The best thing to do would be to get an online scan at one of the places that do that, trend-micro is one of the best, just google for trend-micro.

Of course we should have an up to date antivirus going at all times, along with some of the following:
spybot search & destroy
adaware
hijack this - they have websites that help with this too!
stinger - (for trojans) get it at macafee's
microsoft antispyware (formerly giant antispyware)
zone alarm or other similar
These are all free!

WE should have most or all of these are they work on different engines and catch different things and also let different things go by that they shouldnt too, thats why we should have a few of these and run them once a week or more.
After that, we will mostly still get nailed, so dont feel too bad!
Then we go to trend-micro and that might do the job. They will do an online scan and may be able to repair or help you do the repair, depends on what it finds, and trend-micro wont do you any harm!

After that,report back and let us know where you are.
You may very well have to be prepared to do a full and complete format if trend-micro cant do the job.
If you have to go that far then what i would do would be to download the diagnostic disk from the hard drive mfgr and use it to run zeroes to the hard drive (very easy to do), then use a windows 98 boot disk and fdisk and format the drive fat32, even if you are going to format it NTFS.
Then format the disk NTFS. Now its been thru being zeroed, fdisk and 2 formats, should be good to go.
You dont have to do all this, but i know i would, er have!
But if you take shortcuts you will only end up with the same 100% cpu usage and the same trojan horse causing it, but thats just my opinion of course, and you are free to do as you wish.




Good advice + great people = tek-tips

 

[LloydSev]

Personally, I would uninstall ZoneAlarm, make sure VSMON.EXE is not running after you then reboot your system, and see if the problems persist.

Computer/Network Technician
CCNA

 

[thunderthor]

Thank you Garebo and LloydSev for your responses.

I will try the Trend-micro suggestion from Garebo and also the ZoneAlarm uninstall from LloydSev and get back ASAP.

Garebo, I am quite at sea with this so I will follow the advice of experts.. at worst, I will have to take a backup of the entire HDD before I do follow the format instructions to the T, but hey.. at this point of time.. I want my computer working normally !!!!

Thanks a ton.

Cheers !!!
Sudhir

 

[garebo]

Sudhir, although in the end i could be quite right, it would be wise to try what Lloydsev said first as its quick and easy. And any other quick and easy suggestions that come up are worth trying first, although the programs i mentioned, if they are all tried and failed then you can imagine whats next.
So go for the zone alarm deal first and then do the trend-micro, and depending on what shows up then we or you can make a decision as to what should be done next. If, in the end, its a complete re-install, reformat, etc, so be it, but lets look at the easy suggestions first and see if that works. I basically laid out the way to go but there are a few things we might also try before we get to a full and complete re-install, although that is indeed a possibility as this is a rather nasty trojan, at least i am pretty sure its a trojan, has been for a lot of these same situations.


Good advice + great people = tek-tips

 

[micker377]

Quick question: when you run the anti-virus and anti-spyware, are you turning off your System Restore. If you do remove a "baddy", System Restore may be putting it right back in.

 

[thunderthor]

Good Morning to all of you,

I have uninstalled Zone Alarm Pro and when I rebooted the vsmon.exe was not running. I will report the computers performance after using it a little while.

micker377 I do not know if Windows 2000 has a System Restore. Please tell me if it does.

Thanks and have a great day...

Cheers !!!
Sudhir

 

[LloydSev]

no Windows 2000 does not have System Restore.

I mentioned ZoneAlarm as because VSMON.EXE has a history of having erratic CPU usage of 100% on certain people's PCs.

Computer/Network Technician
CCNA

 

[thunderthor]

I have uninstalled Zone Alarm Pro and rebooted to check that VSMON.EXE wasnt there.

I ran the Trend-Micro House Call Online Virus Scanner and found a low threat virus - W97M_IIS.GEN in a word document.

But I still seem to be having the 100% CPU usage problem. though it seems to be more spaced than earlier. So I get to work on the computer for more time than before, before it hits the 100% usage.

Thanks a lot

 

[garebo]

Let me tell you this: I dont want to be right in my assessment as that would mean a total, complete reformat and re-install.
I had this issue and tried everything. I have all of the software mentioned above and more, all up to date. Nothing i did would solve the issue. In the meantime I was making a trade deal with another person and i ended up with an MSI NEO2 mobo and simply built myself a new computer. I still have my old computer and it still has the same problem you have. I am on quite a few forums and nothing i did of all the suggestions helped any, safe mode, system restore turned off, etc. I ran every online scan and every prog that i could get my hands on.

So now you have 2 choices, in my opinion.
You can continue trying to fix this or simply rebuild your system. A rebuild takes time but you can put more than that into trying to fix the problem, as i did. Plus a new install is a good thing anyway.
Of course you are free to do it as you wish but i would suggest you follow as i mentioned above, go to h drive mfgr website, download their diagnostic disk, use the program in it that runs zeroes on your hard drive. Then
use a windows 98 boot disk and fdisk and format the drive fat32, even if you are going to format it NTFS.
Then format the disk NTFS via win 2k or win xp. Now its been thru being zeroed, fdisk and 2 formats, should be good to go and free of this trojan, which is what i believe it is. Its someone out there using a program that is taking control of your computer and using the computing power is what was explained to me. Or its some brat with nothing better to do just messing around but the results are the same.
We're here to help whatever way you go with this.








Good advice + great people = tek-tips

 

[bcastner]

Use process explorer to try and identify the specific process or service responsible:

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml140060

 

[thunderthor]

Thanks a ton Garebo... Will try what you are suggesting in terms of wiping.. as soon as I am done with the backup of the HDD.

bcastner:
Thanks for the response. Process Explorer is constantly on, on my system ever since I ran into this problem. It is a cool utility. THat was how I observed that my SERVICES.EXE was taking up 100% of my CPU.

 

[bcastner]

If you highlight services.exe, does it not show dependent service entries in the lower panel?

 

[thunderthor]

Yes it does. The list is as below :

svchost.exe - mcvsftsn.exe
spoolsv.exe
svchost.exe
mcvsrte.exe
regsvc.exe
mstask.exe
WinMgmt.exe
svchost.exe
McShield.exe

 

[bcastner]

As a rather good guess, update McAfee, or check their Forums.

You can possibly reduce the overhead of WinMgmt.exe:

http://support.microsoft.com/default.aspx?scid=kb;en-us;830075

 

[thunderthor]

Thanks bcastner.

My McAfee is updated with auto-update. And my WinMgmgt is configured to log 'errors only'.

Could you please recommend any McAfee Forum?

Thanks

 

[thunderthor]

I searched on Tek-Tips and got the McAfee Forum. Do you think that McAfee can be causing the high CPU Usage ?

 

[LloydSev]

McAfee had a bug about a month ago, which caused 100% CPU usage.

It wouldn't be to hard just to uninstall it, reboot and see if it occurs again..

either that or just disable active monitoring..

easiest way to rule it out or find the culprit.

Computer/Network Technician
CCNA