Task Manager Problem, 100% Usage (WXP-Home)

[Suiton]

I have a problem that when I look to see how muhc CPU usage I have while I am running a program it is very high. While running AOL I have 75% CPU usage. I have 100% if I try to do something else while I'm online. I have closed all the unnecesary programs and I have 21 other processes. I have tried ramoboosting programs but that doesn't help. My computer still runs slow. Is there another way I can lower my CPU usage or do I just have to buy more RAM or a new computer?

[tom_keefer]

It would be helpful if you would tell us something about your computer like how much RAM is on board, CPU clock speed, etc., etc., etc.

<font color=purple>Tom</font color=purple>

ya'aa'tey

[foamgod]

Also, from task manager, which are the processes using up the CPU... listing them with the percentages would be helpful.

[Suiton]

Thank you for trying to help me. I'll list the programs I have running and the amount of CPU usage they're taking up. There are a lot of these that I can't close.
Taskmgr.exe 2%
explorer.exe 0%
aolwbsbd.exe 0%
wanmpspc.exe 0%
svchost.exe 0% (System)
scardsvr 0%
pctspk.exe 0%
Navapsvc.exe 0%
acsd.exe 0%
spoolsv.exe 0%
svchost.exe 23% (Local Service)
svchost 0% (Network Service)
waol.exe 2%
svchost.exe 5% (System)
svchost.exe 2% (System)
shellmon.exe 0%
isass.exe 0%
services.exe 7%
winlogin.exe 0%
csrss.exe 0%
smss.exe 0%
mscman.exe 0%
System 0%
System Idle Process 68%

Proesses 24
CPU Usage 40%

Ram 107828 KB out of 256 MB

[report_2]

CPU Usage 40% of what? 450Mhz, 1.2Ghz, 2.8Ghz or what?
(Not looking for 40% of 100%) /images/forums/icons/smile.gif

[foamgod]

Are you letting Windows manage your virtual memory btw?

[adg]

Virtual memory has nothing to do with this. Nor does the cpu clock speed????

First thing you want to do is a full system virus scan and also run both Spybot and AdAware. Let us know if you find anything and if the problem persists.

Allan
<a target="_blank" href=http://www.tweakxp.com/forum>tweakxp.com</a>

[foamgod]

The virtual memory suggestion was in reply to..

&gt;&gt; My computer still runs slow

I did suggest the virus and spyware already..

[report_2]

I personally feel the question is relevant.
"I have a problem that when I look to see how muhc CPU usage I have while I am running a program it is very high. While running AOL I have 75% CPU usage. I have 100% if I try to do something else while I'm online."

100% of what is good. Running XP on a 233Mhz would require much of the processor.

[adg]

It's not relevant - clock speed has absolutely nothing to do with anything. That service (in fact, any service) should not be eating cycles - it's almost certainly a virus or malware.

Allan
<a target="_blank" href=http://www.tweakxp.com/forum>tweakxp.com</a>

[monkey_1]

Yes, certainly is a malware problem... Look the process <a target="_blank" href=http://www.2-spyware.com/entry-mscman.html>mscman</a>...
Download and run HijackThis and paste here the results of the scan...

<font color=orange>Mono</font color=orange>

[report_2]

"That service (in fact, any service) should not be eating cycles"

Please do enlighten me as to what eats cycles then. Only malware or viruses?

I have no malware or spyware and when I just wave over the menu items in sysmon it uses cycles. To open the program to snap a screenshot it used 62% momentarily.
<a target="_blank" href=http://home.comcast.net/~bryconow/processor.jpg>See image here</a>.

The OP states "My computer still runs slow." Perhaps it is slow to start with because of the processor and reducing cycles won't help.

I personally don't doubt that the problem is malware or spyware related but would also like to know if the poster is trying to get blood from a rock.

[adg]

Programs utilize cpu time when they are doing something. Svchost.exe services should not be constantly doing anything. Programs running in the background (ie, AV scans, calculations, defrags, etc) will use cycles - but for the most part services should be relatively passive - at least most of the time.l

As I've said, clock speed is irrelevant. Utilization of that cpu is what's important. If no programs are taxing the cpu then system idle should be in the high 90's.

Allan
<a target="_blank" href=http://www.tweakxp.com/forum>tweakxp.com</a>

[Suiton]

Cpu usage 40% of 1.2 GHZ.

[Suiton]

I don't know if I am. How do I check that and if I am why does it matter?

[Suiton]

I didn't know how to paste the results here but I scanned my comp with Hijack this and there were a lot of parasites. I couldn't delete them because I had the unregistered version. I could try to get the registered program and delete all of the parasites and see if the problem is fixed. Is that what you wanted me to do?

[foamgod]

Under control panel&gt;system&gt;advanced&gt;performance setting.

I think it matters because a larger paging size doesn't necessarily means better speed.

[adg]

Don't worry about your pagefile or clock speed.

Just cut and paste your HiJack This log. If nobdy here can help with it (and I'm not sure), you can click on the link in my signature and post the log in our HiJack This Log forum.

Allan
<a target="_blank" href=http://www.tweakxp.com/forum>tweakxp.com</a>

[report_2]

I have HijackThis and there was no registering it.
http://forums.majorgeeks.com/showthread.php?t=35407 (http://www.majorgeeks.com/download3155.html>http://www.majorgeeks.com/download3155.html</a>

At)

At that same page is a link for a tutorial of how to use HijackThis:
<a target="_blank" href=http://forums.majorgeeks.com/showthread.php?t=38752>http://forums.majorgeeks.com/showthread.php?t=38752</a>

You should be able to 'fix' problems with HijackThis, at least with the version found on the first page.

You can open the HijackThis.log with Notepad.
Go to Edit, Select all.
Edit, Copy
and then paste it here if that is the route you will be taking.

[report_2]

Suiton sent me the Hijack This log in a PM but I repost it here to go along with the concept of the forum.

Logfile of HijackThis v1.98.2
Scan saved at 9:02:35 PM, on 9/7/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ClientMan\mscman.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Program Files\America Online 9.0\aolwbspd.exe
C:\Documents and Settings\Steven Steigman\Desktop\Steven\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://awebfind.biz/sp.htm
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://awebfind.biz/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://awebfind.biz/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\sb.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://awebfind.biz/sp.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.132/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.132/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://awebfind.biz/sp.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50036
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://awebfind.biz/sp.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://awebfind.biz/sp.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.132/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchant.com/sp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://awebfind.biz/sp.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://awebfind.biz/sp.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://www.gonnasearch.com/iesearch.php?ref=sb
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.ieplugin.com/q.cgi?q=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchant.com/r=6&s=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.132/index.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.132/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R3 - URLSearchHook: XTSearchHook Class - {6E6DD93E-1FC3-4F43-8AFB-1B7B90C9D3EB} - C:\Program Files\Sqwire\s.dll (file missing)
O1 - Hosts: 65.77.208.252 auto.search.msn.com
O2 - BHO: (no name) - {00A0A40C-F432-4C59-BA11-B25D142C7AB7} - c:\PROGRA~1\CLIENT~1\run\2IN188~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: CommonName - {A3E3F04C-F98C-4295-95EF-41C57425B077} - C:\Program Files\CommonName\Toolbar\CNBarIE.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Intelligent Explorer - {69135BDE-5FDC-4B61-98AA-82AD2091BCCC} - C:\WINDOWS\systb.dll (file missing)
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL (file missing)
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
O3 - Toolbar: ez Search Bar - {CCE83E45-30B2-4BAE-B1F5-25D128D27A43} - C:\WINDOWS\System32\ezSearch.dll (file missing)
O3 - Toolbar: SuperBar - {5487E1FA-F4B3-4221-927A-7F02F0251ABB} - C:\Program Files\SuperBar\SuperBar.Dll (file missing)
O3 - Toolbar: bits dog live - {2E2674FC-A56C-C54F-B4E1-A1F6E53FEB2D} - C:\PROGRA~1\MOREAN~1\listdelete.dll (file missing)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0. dll
O3 - Toolbar: &Search Toolbar - {57E69D5A-6539-4d7d-9637-775DE8A385B4} - C:\Program Files\Sqwire\t.dll (file missing)
O4 - HKLM\..\Run: [winnet] C:\PROGRA~1\COMMON~2\ADDRES~1\winnet.exe
O4 - HKLM\..\Run: [updmgr] C:\Program Files\Common files\updmgr\updmgr.exe
O4 - HKLM\..\Run: [WinTime] C:\WINDOWS\system32\wintime.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [4S2NSLA3QS#366] C:\WINDOWS\System32\Erl6AX.exe
O4 - HKLM\..\Run: [IEDriver] C:\WINDOWS\System32\IEDriver\IEDriver.exe
O4 - HKLM\..\Run: [Dsi] C:\WINDOWS\System32\dp-k13w13.exe
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKCU\..\Run: [ClientMan1] C:\Program Files\ClientMan\mscman.exe
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\System32\msmc.exe
O4 - HKCU\..\Run: [ClockSync] C:\PROGRA~1\CLOCKS~1\Sync.exe /q
O4 - HKCU\..\Run: [ContentService] C:\WINDOWS\System32\winservn.exe
O4 - HKCU\..\Run: [Aaou] C:\Documents and Settings\Steven Steigman\Application Data\amee.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O8 - Extra context menu item: Add A Page Note - C:\Program Files\CommonName\AddressBar\createnote.htm
O8 - Extra context menu item: Bookmark This Page - C:\Program Files\CommonName\AddressBar\createbookmark.htm
O8 - Extra context menu item: Email This Link - C:\Program Files\CommonName\AddressBar\emaillink.htm
O8 - Extra context menu item: Power Search - res://C:\PROGRA~1\COMMON~1\MSIETS\msielink.dll//iemenu
O8 - Extra context menu item: Search using CommonName - C:\Program Files\CommonName\AddressBar\navigate.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: (no name) - {1A00C40B-DA85-4aa3-A67F-582D9347EECD} - C:\WINDOWS\System32\IEDriver\TD.exe
O9 - Extra 'Tools' menuitem: MaxSpeed - {1A00C40B-DA85-4aa3-A67F-582D9347EECD} - C:\WINDOWS\System32\IEDriver\TD.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: (no name) - {A80F2DB2-80A9-4834-8F5A-4AB70F4EF4C3} - C:\WINDOWS\systb.dll (file missing)
O9 - Extra 'Tools' menuitem: IMI - {A80F2DB2-80A9-4834-8F5A-4AB70F4EF4C3} - C:\WINDOWS\systb.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {7F241C00-DAB6-11d5-AAA8-0001028DF1BC} - file://C:\Program Files\EbatesMoeMoneyMaker\System\Temp\ebates_scrip t0.htm (file missing) (HKCU)
O9 - Extra button: Support - {D50708A9-AF74-4515-8C07-7EAF61604D30} - C:\Program Files\Internet Explorer\SIGNUP\Presario.htm (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inetadpt.dll
O11 - Options group: [CommonName] CommonName
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
O16 - DPF: {1000026A-8230-4DD4-BE4F-6889D1E74167} - http://cr.stop-popup-ads-now.com/download/cabs/BANN8005/stoppop.cab
O16 - DPF: {1671869C-25B3-4C80-9446-8AE6111F8765} (MaxisHotDateTeleX Control) - http://thesims.ea.com/teleport/hotdate/NPC/MaxisHotDateTeleX.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50003/btiein.cab
O16 - DPF: {2DAE59A1-B355-4653-8D33-33A3A8F8C078} (MaxisVacationTeleX Control) - http://thesims.ea.com/teleport/vacation/MaxisVacationTeleX.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20020713/qtinstall.info.apple.com/samantha/us/win/QuickTimeInstaller.exe
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {525A15D0-4938-11D4-94C7-0050DA20189B} (SnoopyCtrl Class) - http://aol.ea.com/downloads/games/common/snoopy/iesnoopy.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521958} - http://wwb.ieplugin.com/adcampaigns/webplugin.cab
O16 - DPF: {65E7DB1D-0101-4100-BD66-C5C78C917F93} - http://install.wildtangent.com/bgn/partners/aolim/install.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {A19A291A-9653-4498-93F6-5BA06CF699D8} - http://download.peopleonpage.com/pop/ads/247/ax/PopLoad.cab
O16 - DPF: {A1DC3241-B122-195F-B21A-000000000000} - http://www.blowsearch.com/TB/The_Ultimate_Browser_Enhancer.exe
O16 - DPF: {A27CFCAE-9351-4D74-BFFC-21EB19693D8C} - http://www.xupiter.com/search4/install/XupiterToolbarLoader.cab
O16 - DPF: {A44B714B-EE0F-453E-9300-A69B321FEF6C} (MaxisSimsFamilyTeleX Control) - http://thesims.ea.com/teleport/families/MaxisSimsFamilyTeleX.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://kr.pristontale.com/nprotect/nprotect/npx.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {D9EC0A76-03BF-11D4-A509-0090270F86E3} - http://download.spywarelabs.com/install/1203030306/VBouncerOuter1203.EXE
O16 - DPF: {EB6AFDAB-E16D-430B-A5EE-0408A12289DC} - http://download.mediacharger.com/movieplace.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3704FEE7-E1A3-4E4A-9B67-9CEAB1D3F6BD}: NameServer = 205.188.146.146
O17 - HKLM\System\CS2\Services\Tcpip\..\{3704FEE7-E1A3-4E4A-9B67-9CEAB1D3F6BD}: NameServer = 205.188.146.146
O18 - Protocol: ayb - {07C0D34D-11D7-43F7-832B-C6BB41726F5F} - C:\DOCUME~1\STEVEN~1\APPLIC~1\sidrnaooash.dll (file missing)
O18 - Protocol hijack: cn - {9346A6BB-1ED0-4174-AFB4-13CD4EC0AA40}
O18 - Protocol: relatedlinks - {CD8D1CAA-FE4A-45DF-A06C-028AAF1821DE} - C:\PROGRA~1\COMMON~1\BTLINK\btlink.dll
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll
O18 - Filter: text/html - {CC905FF6-B553-496C-9DFA-CFF65ADCD0FC} - c:\program files\clientman\run\searchrep4acf6c0b.dll

There are a few nasties there...particularly sp.htm entries. There are also several toolbars, some missing files and is the 'hotdate' item something you wanted to be there?

Some of these items may be as part of an install you wanted and if you delete them they will render the associated program as unusable.

Personally, I would take the suggestion of using , <a target="_blank" href=http://www.lavasoftusa.com/software/adaware/]AdAware 6 by Lavasoft[\url] and running [url=http://www.majorgeeks.com/download4086.html>CWShredder (http://www.safer-networking.org/en/index.html>Spybot) before using the 'fix' in Hijack This. They are all free.

After running them all if you find a program that no longer works you may as well note it and then do a proper uninstall of it.

If when done you find that you can not longer connect to the internet then run the <a target="_blank" href=http://www.cexx.org/lspfix.htm>LSP fix</a> found at the bottom of that page and is for WinXP.

HTH

[report_2]

This morning I was introduced to the <a target="_blank" href=http://hijackthis.de/index.php?langselect=english>HijackThis Analysis website</a> and I pasted your log into it. It found many things.
You can save the analysis to your hard drive. It tells you what to do about the things it found.

I recommend you use it.

[tom_keefer]

Holy Moly, if this thing really works it's going to be one heck of a tool.

<font color=purple>Tom</font color=purple>

ya'aa'tey

[adg]

It's nothing new and in the past it's been the cause of some major problems (people being advised to delete things that lock up the system, etc.). I believe it has recently been revamped, but it's still not quite as good as having someone who knows what he is doing evaluating the log.

Allan
<a target="_blank" href=http://www.tweakxp.com/forum>tweakxp.com</a>

[report_2]

The problem is that Hijack This is an Advanced user tool that is used all too often by those that are not.

I see the site really narrows down the searching though so as far as I am concerned it does offer a lot.

My personal problem with posted HJT logs is the stuff that is showing that is needed or wanted by the poster. I would prefer they eliminate those items before posting it to save some time studying it. Or, at least, note that they are something desirable.

That site also provides the link to those whom specialize in analyzing the logs from HJT.