high cpu usage on new system (Hijack log included)

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

dohnutman

Thread Starter
Joined
Mar 21, 2003
Messages
113
My new system has an unusually high level of cpu usage after startup. Windows was only installed a week ago and I haven't installed much software on this yet. Today was the first day I got it online and all I did was install the newest windows updates. The only things I've installed in it are nero, omega radeon drivers, videolan media player, winamp, and adobe.

I've looked at the hijack log and I don't see anything out of the ordinary. The odd thing is, the cpu usage isn't constant, it ranges from 30%-50% even when nothing is running.

I don't know if this has anything to do with it or not but my 2x 250gb sata hd's are inexplicably recognized as removable drives. I wouldn't mind getting this resolved but its not much of a problem.


edit: here are my system specs

EPoX EP-9NDA3J Socket 939 NVIDIA nForce3 Ultra ATX AMD Motherboard
AMD Athlon 64 3500+ Venice 1GHz FSB Socket 939 Processor Model ADA3500BPBOX
SAPPHIRE RADEON 9600 256M Radeon 9600 256MB DDR AGP 4X/8X Video Card
CORSAIR ValueSelect 1GB (2 x 512MB) 184-Pin DDR SDRAM DDR 400 (PC 3200)
2x WD 250gig (SATA) hds
1x Seagate 160gb ide hd
Logfile of HijackThis v1.99.1
Scan saved at 3:43:38 PM, on 1/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Radeon Omega Drivers\v2.6.87\ATI Tray Tools\atitray.exe
C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HiJack This!\HijackThis.exe
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\e0dc0b83689ce7b61aec9a92ab403ff5\update\update.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Radeon Omega Drivers\v2.6.87\ATI Tray Tools\atitray.exe"
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
 

flavallee

Frank
Trusted Advisor
Joined
May 12, 2002
Messages
83,260
I don't see any antivirus program installed and running in the background, which is going to leave your computer wide open to all kinds of "nasties".:eek:

-------------------------------------------------------------------------------------

None of the O4 running processes that I see listed

AtiPTA (atiptaxx.exe)

Acrobat Assistant 7.0 (Acrotray.exe)

NeroFilterCheck (NeroCheck.exe)

InCD (InCD.exe)

AtiTrayTools (atitray.exe)

really need to be automatically loading during startup and running in the background. Click Start - Run, type in MSCONFIG, click OK - "Startup" tab, uncheck those entries, click Apply - OK, then reboot. When the SCU window appears during reboot, ignore the message. Just place a checkmark in it, then click OK.

If you later find that you need one or more of them re-enabled, you can always go back and recheck them.

-------------------------------------------------------------------------------------

Open the SERVICES window, then change

ATI Hotkey Poller

ATI Smart


from "Automatic" to "Manual".

--------------------------------------------------------------------------------------

Keeping the number of running processes trimmed down and keeping the amount of graphic "eye candy" to a minimum can go a long ways towards improving performance and reducing the CPU load.

Other than your concern about the CPU load, how is your computer running?

--------------------------------------------------------------------------------------
 

dohnutman

Thread Starter
Joined
Mar 21, 2003
Messages
113
Yeah, I didn't install an av on it because the machine only went online once to install windows updates, but I'm in the process of installing panda internet security suite 2006. I killed those apps through taskmanager but they don't seem to be the culprit. I did what you said but it didn't do it. I've done some research and it might actually have something to do with my sata drives being recognized as removable drives. The nforce3 drivers that came with my motherboard might be doing it. Lets see what happens when I replace them with standard drivers.


edit:
ok... uninstalling the drivers also removes my sata drives and they don't reappear with standard drivers... thats good to know...
 

WhitPhil

Gone but never forgotten
Trusted Advisor
Joined
Oct 4, 2000
Messages
8,684
From TaskManager, Processes Tab, double click on the Column Header CPU to sort it descending.

What process is at the top?
 

dohnutman

Thread Starter
Joined
Mar 21, 2003
Messages
113
that's what puzzles me, none of the apps are taking up any resources, the system idle process is at 99%, but the cpu usage fluctuates constantly.
 

WhitPhil

Gone but never forgotten
Trusted Advisor
Joined
Oct 4, 2000
Messages
8,684
Well, if the idle is at 99 then the fluctuation must be brief.

If you want to try and see what is doing it, leave the Processes tab open, with CPU descending and see which task pops to the top periodically.

It is most likely one of your scheduled tasks such as Windows Update

BTW do you have any idea what
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\e0dc0b83689ce7b61aec9a92ab403ff5\update\update.exe is that you show running?

Unless you actually ran HJT while a windows update was in progress?
 

dohnutman

Thread Starter
Joined
Mar 21, 2003
Messages
113
WhitPhil said:
Well, if the idle is at 99 then the fluctuation must be brief.

If you want to try and see what is doing it, leave the Processes tab open, with CPU descending and see which task pops to the top periodically.

It is most likely one of your scheduled tasks such as Windows Update

BTW do you have any idea what
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\e0dc0b83689ce7b61aec9a92ab403ff5\update\update.exe is that you show running?

Unless you actually ran HJT while a windows update was in progress?
yeah, I was updating the system while doing the log.
I've looked at the processes tab but nothing really moves. If they do, its too fast for me to see.
 

WhitPhil

Gone but never forgotten
Trusted Advisor
Joined
Oct 4, 2000
Messages
8,684
In which case, what are you using (or looking at that makes you think you have an excessive amount of CPU being consumed?
 

dohnutman

Thread Starter
Joined
Mar 21, 2003
Messages
113
WhitPhil said:
In which case, what are you using (or looking at that makes you think you have an excessive amount of CPU being consumed?
Mainly, taskmanager, the cumulative amount on cpu usage, on the bottom where it lists the number of processes running, cpu usage, and commit charge.
 

WhitPhil

Gone but never forgotten
Trusted Advisor
Joined
Oct 4, 2000
Messages
8,684
You are obviously seeing CPU usage if you just open TaskManager, BUT when you look at the details, under Processes, nothing seems to be running long enough to be all that visible.

Just having Taskmanager itself active, will burn a few CPU cycles, plus there is "always" some system activity going on it the background that will consume some.
(on my box right now, there is a steady 4% with just the TaskManager window open)

So, to confirm ....

With "nothing" running (ie you just booted and opened TaskManager), you are seeing 40-ish CPU consumption at the bottom? And, consistently there? Or, does it regularly change up and down.

Regardless, after a fresh boot, post back another log for a peak.
 

dohnutman

Thread Starter
Joined
Mar 21, 2003
Messages
113
WhitPhil said:
With "nothing" running (ie you just booted and opened TaskManager), you are seeing 40-ish CPU consumption at the bottom? And, consistently there? Or, does it regularly change up and down.

Regardless, after a fresh boot, post back another log for a peak.
Sorry for such a late reply but I've been busy with work. Yes, Basically, thats exactly whats going on. The weird thing is that it isn't constant, it fluctuates up and down (no discernable pattern) regularly.

here's the latest log

Logfile of HijackThis v1.99.1
Scan saved at 4:44:42 PM, on 1/13/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\FIREWALL\PNMSRV.EXE
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PsImSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\apvxdwin.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hewlett-Packard\AiO\hp officejet v series\Bin\hpoant07.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\SRVLOAD.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\WebProxy.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HiJack This!\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: iTouch Configuration.lnk = C:\Program Files\Logitech\iTouch\iTouchcf.exe
O4 - Global Startup: HPAiODevice(hp officejet v series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet v series\Bin\hpoant07.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - PANDA SOFTWARE - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\FIREWALL\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe



I've also attached a scren shot.
 

Attachments

WhitPhil

Gone but never forgotten
Trusted Advisor
Joined
Oct 4, 2000
Messages
8,684
Try opening taskmanager, double clicking on CPU to sort descending (IDLE should now be at the top).
Then change the update speed settings, View > Update, to low and high. Run with each for a few minutes and see if one of the updates catches the high CPU task.

It could be Panda AV, periodically waking up. Or the Panda Firewall.
(you can try disabling the firewall and not connect to the net, and see if the symptom is there)

I don't think it's anything to be concerned about, but this is the only way I can think to even be able to see which it is.

See this page about InstallDriver Table manager.

****Just looked at your screenshot and something is strange. Well, unless that app that is using the CPU, does it very quickly and then disappears. Your list shows 2 top tasks at 98 and 2, YET the CPU usage is 25%. Now, I "think" that the number at the bottom is an average CPU over "some" period of time, and is obviously NOT a match to that of the processes. So, it would appear that whatever is running in the background, wakes up periodically, soaks the CPU (to keep the average high) and then goes to sleep again.
Try the Update speed setting, and see if on one of the updates this phantom appears?

And, in case it may be something new and strange, download and run SpyBot. Update the definitions and do a scan, and allow it to remove what it finds.
Also, run this online virus check to get a second opinion.
 

dohnutman

Thread Starter
Joined
Mar 21, 2003
Messages
113
I don't think its panda, especially since it was happening before I installed panda on it, I already have the latest version of spybot running and nothing comes up. I guess I'll try the trendmicro online av scan.

edit: alright, I set the update speed to high and I see 4 apps moving about, teatimer.exe, taskmgr.exe, srvload.exe, and hpoant07.exe. However, only teatimer.exe shows any cpu usage, the other 3 are still at 0.
 

WhitPhil

Gone but never forgotten
Trusted Advisor
Joined
Oct 4, 2000
Messages
8,684
Well, you may have found the "culprits".

They are in and out so quickly that TaskManager doesn't get an accurate snapshot of their immediate CPU usage. But over time, they sustain high bursts of CPU.

So, if you wish, you could UNselect those from startups, reboot and see if the CPU "appears" normal?
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top