CPU Usage Near 100% After Full Scan, SDwAV 9 Must Be Uninstalled

[Secret-HQ]

It's taken me a couple of weeks to figure this out, but Spyware Doctor with AntiVirus 9 is causing chronic unresponsiveness on my computer after a Full Scan is run.

Problems started on November 7, a couple of days after I'd updated to SDwAV 9.0.0.888. A Full Scan was scheduled to run overnight, but when I checked in the next morning, the computer was running painfully slow and the Windows UI was slow to respond to any mouse clicks or keystrokes. I had to force a restart with Process Explorer, and the sluggishness continued during my next Windows session — which began with a painfully slow startup and ended abruptly with a blue screen error citing PCTCore.sys as the likely culprit. (More details here.)

I peformed a bunch of troubleshooting steps, including running System Restore to restore the PC to its state from a couple of days earlier. Post-Restore, I had no problems.

A couple of days later (November 9), I ran another Full Scan (to make up for the one that didn't finish earlier in the week), and SDwAV stalled out again. I paused and stopped the Full Scan and restarted Windows. Things seemed to run O.K. for the next couple of days.

On November 13, I left the computer on overnight to run its Full Scan and woke up to another BSOD error. I restarted and returned to work as usual, though I noticed Spyware Doc's History was empty and not accumulating any new items — so I performed another uninstall/reinstall.

I also deleted the Windows pagefile and did some other incidental troubleshooting during this period, thinking there might be a culprit other than SDwAV.

On November 20, another Full Scan ran, and I resumed work afterward without restarting the computer. I eventually encountered another BSOD, after which I noticed the SDwAV icon was missing from the system tray and the Windows UI was once again incredibly unresponsive.

Suspecting Spyware Doctor, I uninstalled and ran without spyware protection for a couple of days (being verrry careful in my web surfing) and reinstalled Spyware Doc on November 27 (yesterday). I updated to 9.0.0.898 and ran a Full Scan overnight.

Last night's Full Scan took 14 hours to complete — scans with version 8 typically took about 5 hours; version 7 took about 12. I worked a bit while the scan completed, and then restarted when it was over.

On restart, the Windows UI was again painfully slow to respond. Process Explorer showed 100% CPU usage, though I couldn't find any EXEs or SVCs using massive resources in the process view. I restarted again and had the same problems during my next session. So I've once again uninstalled Spyware Doctor with AntiVirus and am running like a charm.

It's only today, looking back over my troubleshooting logs, that I've noticed the problem occurs after running a Full Scan (and sometimes only after shutting down the Windows session during which the Full Scan was run).

My next step will be to reinstall SDwAV but avoid running a Full Scan. Hopefully someone can figure out what's going on, though, since I've grown to rely on that scan for a thorough shakedown once a week.

Help!

[Secret-HQ]

Here's an update on what I've done since my initial post near the end of November:

1. Uninstalled and reinstalled Spyware Doctor with AntiVirus 9.0.0.898.
2. Disabled all scheduled scans.
3. Uninstalled again.
4. Scanned the registry for all instances of the string "Spyware Doctor," backed them up, and deleted them from the registry.
5. Uninstalled all disabled SD or PCT drivers from Device Manager:
   
   • PC Tools Browser Defender Driver
   • PC Tools Data Store
   • PC Tools Extended File Attributes
   • PC Tools Spyware Doctor Driver
   • pctgntdi
   • PCToolsProtectInjDrv
   • PCTSDInjDriver32
   • TfFsMon
   • TfNetMon
   • TfSysMon
6. Reinstalled.
7. Had two more BSODs.
8. Uninstalled again.
9. Scanned and deleted "Spyware Doctor" from the registry again.
10. Uninstalled Registry Mechanic, just in case there were shared components.
11. Removed all the PCT, SD, and RegMech entries I could find in the registry.
12. Uninstalled all the disabled PCT drivers from Device Manager.
13. Booted into Safe Mode and scoured the Device Manager for any drivers not seen on my first pass under each Windows user in turn.
14. Installed Spyware Doctor with AntiVirus 9.0.0.898.
15. Experienced the same chronic unusability.
16. Gave up on a fix (at least for the time being).
17. Uninstalled SDwAV.
18. Installed Microsoft Security Essentials instead.

—

Also worth noting: I'd been running on two Vista machines and one XP machine (under several different configurations). One Vista PC had the problems described here, but the other never did. I've since moved to running SDwAV on the Vista machine that never had problems and on a Win7 machine, where it has no problems.

From observing both my machines and those of others who run SDwAV, it seems that the 9.x versions are consistently buggy on WinXP. I've found at least one minidump fingering PCTCore.sys on every XP machine running SD9 where I was able to look. I can't speak to Vista, since I'm the only one I know still running it — and my experiences on two largely similar machines has been wildly inconsistent.

[jimboc007]

Hi Secret-HQ,

Apologies for not assisting on the issues you have been facing until now.

Have you any update on these issues? Do they continue with the latest v9.0.909 build?

See the following link for the download info of this build:

http://www.pctools.com/kb/article/la...ation-324.html

I am still using Vista Ultimate 64 bit SP2 on my gaming PC (see my forum profile for more info) and I am willing to assist in any way that I can. I also have 2x Windows 7 Ultimate 64 bit SP1 PCs (I am not totally out of touch with newer technology and hope to install Windows 8 Consumer Preview in a VM next weekend).

I am currently not facing any issues with the v9.0.909 build. The 898 build had some slow down when its Cookie Guard was enabled (about 8% constant CPU usage).

Please let me know if I can be of assistance.

Thanks.
jimboc007

[Secret-HQ]

Apologies for not assisting on the issues you have been facing until now.

No apologies necessary, Jim! I haven't been following this thread since I'd finally given up on Spyware Doctor with AntiVirus after several months of troubleshooting with no satisfying resolution.

Have you any update on these issues? Do they continue with the latest v9.0.909 build?

I did try .909 on the Windows Vista computer and had the same issues. I also upgraded on the other Vista machine and the Win7 machine, both of which continued to run swimmingly. I did not, however, attempt to reinstall SDwAV on other computers or test it on other configurations past my last post to the forum on January 13.

My SDwAV subscription finally expired this weekend, and I'm a bit torn as to whether I should renew. While I've been running SDwAV smoothly on the other two computers, I've been running Microsoft Security Essentials just as smoothly on my main PC, which sees the most action around here. It also has less impact on performance than Spyware Doc during infection scans, and its GUI has been less intrusive. (I spent a lot of time grooming the Global Action List each time I installed Spyware Doc to prevent false positives.)

This morning, I installed SDwAV 9.0.0.1218 and so far haven't encountered any problems — but that was the case during my previous problems, as well. We'll see how well it holds up after a restart, a Full Scan, and a batch of Tuesday Microsoft updates — all of which seem to have triggered performance issues in the past.

If I leave it on the computer that long. So far, with the subscription expired, I've had to contend with nags to renew, a constantly red icon in the tray (since I can't clean any of the false positives detected on an initial scan), and a couple of irritating false positives (since I haven't taken time to manually add all the necessary exceptions to my Global Action List just for a test drive).

As much as I've enjoyed Spyware Doctor in the past, it's been a consistent thorn in my side (and impediment to productivity) for fully half of the last year. I can't say I'm looking forward to paying $40 to buy back into the hassles I've been free of while I've been running MS Security Essentials.

So that's where I am — trying to give SDwAV a fair shake but a lot shorter on good will and time to invest in troubleshooting than when my problems first began.

[Secret-HQ]

Restarted, only to find that Maxthon 3 (web browser) couldn't connect to any web sites. (Strangely, other browsers could and pings resolved with no trouble.)

Restarted again and received another BSOD fingering PCTCore.sys.

Uninstalled Spyware Doctor with AntiVirus.

Uninstalled lingering drivers from Device Manager (PC Tools Browser Defender Driver, PC Tools Data Store, PC Tools Spyware Doctor Driver, pctgntdi, PCToolsProtectInjDrv, PCTSDInjDriver32).

Removed all the traces I could find from the registry.

Restarted.

Reinstalled Microsoft Security Essentials.

I'll be uninstalling SDwAV from the other two PCs as well. It's been a good ride, but I'm at the limit of my ability (and patience) for troubleshooting it.

[Chomas]

Hi Secret-HQ,
What kind of the error code appears on the Screen of Death?

If you have BSOD too after the clean re-install of PCTSDwAV then you can use Nirsoft's free BlueScreenView to interpret the Bug Check (BC) codes in your BSOD minidump files and then post the results as follows:

1. Download BlueScreenView here.
2. Unzip the downloaded file (no installation required) and double-click BlueScreenView.exe to run.
3. When scan is completed, go to Edit | Select All.
4. Go to File | Save Selected Items and save the report as a text file named BSOD.txt.
5. Attach BSOD.txt to your next post.
Best Regards

Mikołaj

[Secret-HQ]

Thanks for your interest, Chomas!

Unfortunately, I'm at the point of diminishing returns with troubleshooting. My daily logs tell me I've invested almost 20 hours in troubleshooting over six months with no significant improvement, so as much as it pains me to leave Spyware Doc behind, I can't afford to keep tinkering with it when I'm getting along fine with the competing product. If someone makes an astonishing breakthrough relevant to my issues, I'll be chomping at the bit to come back, but for now, it's best to shut down my inquiries and move on to other projects.

I do still have all my earlier minidumps and BSOD messages, including a few BlueScreenView reports. If anyone's interested, they can contact me through Secret-HQ.com.

Here's a representative NirSoft BlueScreenView report from December 11:

==================================================
Dump File         : Mini120611-01.dmp
Crash Time        : 12/6/2011 12:43:29 AM
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : 0x8be44970
Parameter 2       : 0x00000000
Parameter 3       : 0x8464fc54
Parameter 4       : 0x00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+98379
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.0.6002.18484 (vistasp2_gdr.110617-0336)
Processor         : 32-bit
Crash Address     : ntoskrnl.exe+98379
Stack Address 1   : ntoskrnl.exe+4ddd4
Stack Address 2   : PCTCore.sys+46c54
Stack Address 3   : ntoskrnl.exe+b1466
Computer Name     : 
Full Path         : C:\Windows\Minidump\Mini120611-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 6002
Dump File Size    : 155,672
==================================================

(I was never able to suss out the specific gremlin, but as best I can tell it's some sort of driver conflict with PCTCore.sys.)

[jimboc007]

Thanks for your interest, Chomas!

Unfortunately, I'm at the point of diminishing returns with troubleshooting. My daily logs tell me I've invested almost 20 hours in troubleshooting over six months with no significant improvement, so as much as it pains me to leave Spyware Doc behind, I can't afford to keep tinkering with it when I'm getting along fine with the competing product. If someone makes an astonishing breakthrough relevant to my issues, I'll be chomping at the bit to come back, but for now, it's best to shut down my inquiries and move on to other projects.

I do still have all my earlier minidumps and BSOD messages, including a few BlueScreenView reports. If anyone's interested, they can contact me through Secret-HQ.com.

Here's a representative NirSoft BlueScreenView report from December 11:

==================================================
Dump File         : Mini120611-01.dmp
Crash Time        : 12/6/2011 12:43:29 AM
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : 0x8be44970
Parameter 2       : 0x00000000
Parameter 3       : 0x8464fc54
Parameter 4       : 0x00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+98379
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.0.6002.18484 (vistasp2_gdr.110617-0336)
Processor         : 32-bit
Crash Address     : ntoskrnl.exe+98379
Stack Address 1   : ntoskrnl.exe+4ddd4
Stack Address 2   : PCTCore.sys+46c54
Stack Address 3   : ntoskrnl.exe+b1466
Computer Name     : 
Full Path         : C:\Windows\Minidump\Mini120611-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 6002
Dump File Size    : 155,672
==================================================

(I was never able to suss out the specific gremlin, but as best I can tell it's some sort of driver conflict with PCTCore.sys.)

Hi Scott,

Thanks for the update.

The mini dumps may be of assistance to PC Tools in troubleshooting this (as Chomas has mentioned). Right now I have Spyware Doctor 9.0.0.912 running fine on my Windows 7 64 bit Ultimate PC SP1. My other PCs (Windows 7 Ultimate 64 bit SP1 and Windows Vista 64 bit SP2) have version 9.0.0.909 installed again with no issues (details of my PC can be found in my profile.

I haven’t had a lot of time recently to keep manually upgrading these (I really wish Smart Update would do this for me!) so this is why they are a little out of date. My main security software Symantec Internet Security 2012 automatically installs new versions of the program for me.

Since you are not the only one experiencing BSODs with this version (for example, see the following thread: http://www.pctools.com/forum/showthread.php?69641-Bsod ) I will hold off installing the new 9.0.0.1218 version since it is more difficult to downgrade to an older working version of Spyware Doctor since the new much smaller stub installers always download the latest version.

I can downgrade to an older version simply by restoring my PCs to an earlier backup image (one of a set of images I create on a regular basis, especially before such an upgrade). However this is time consuming (30 minutes to 1 hour).

Probably in about 2 weeks I will upgrade one of my PCs to the new version and steadily roll-out the new version if all goes well. (I am quite confident that everything will be fine).

The only steps that I could suggest to you would be to install Spyware Doctor 9.0.0.1218 on a new installed copy of Windows Vista or Windows 7 and then test the product by using the PC for some time (but not installing many if any other programs). I am suggesting this, simply to narrow down the potential causes.

As you say, there does appear to be a conflict with the PCTCore.sys driver with something else on your computers.

I am suggesting this step only, since I realize that you previously carried out a long list of troubleshooting steps as suggested by me with no effect/benefit from them.

Please let me know if I can be of further assistance.

Thank you.
jimboc007

[Chomas]

Thanks for your interest, Chomas!

Unfortunately, I'm at the point of diminishing returns with troubleshooting. My daily logs tell me I've invested almost 20 hours in troubleshooting over six months with no significant improvement, so as much as it pains me to leave Spyware Doc behind, I can't afford to keep tinkering with it when I'm getting along fine with the competing product. If someone makes an astonishing breakthrough relevant to my issues, I'll be chomping at the bit to come back, but for now, it's best to shut down my inquiries and move on to other projects.

I do still have all my earlier minidumps and BSOD messages, including a few BlueScreenView reports. If anyone's interested, they can contact me through Secret-HQ.com.

Here's a representative NirSoft BlueScreenView report from December 11:

==================================================
Dump File         : Mini120611-01.dmp
Crash Time        : 12/6/2011 12:43:29 AM
Bug Check String  : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code    : 0x00000050
Parameter 1       : 0x8be44970
Parameter 2       : 0x00000000
Parameter 3       : 0x8464fc54
Parameter 4       : 0x00000000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+98379
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.0.6002.18484 (vistasp2_gdr.110617-0336)
Processor         : 32-bit
Crash Address     : ntoskrnl.exe+98379
Stack Address 1   : ntoskrnl.exe+4ddd4
Stack Address 2   : PCTCore.sys+46c54
Stack Address 3   : ntoskrnl.exe+b1466
Computer Name     : 
Full Path         : C:\Windows\Minidump\Mini120611-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 6002
Dump File Size    : 155,672
==================================================

(I was never able to suss out the specific gremlin, but as best I can tell it's some sort of driver conflict with PCTCore.sys.)

Hi Secret-HQ

Thank You for the file.

Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).
Another common cause is the installation of a faulty system service.
Disabling memory caching of the BIOS might also resolve it.
How much RAM do you have?

You Can do this :
Can You please put cd disc with Win Xp or 7 , and run the Recovery Console by clicking R
CHKDSK /p /r or
chkdsk drive:c [/p] [/r]

I agree with, jimboc007 that, "The only steps that I could suggest to you would be to install Spyware Doctor 9.0.0.1218 on a new installed copy of Windows Vista or Windows 7"

Best Regards

Mikołaj

[jimboc007]

Hi Secret-HQ

Thank You for the file.

Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).
Another common cause is the installation of a faulty system service.
Disabling memory caching of the BIOS might also resolve it.
How much RAM do you have?

You Can do this :
Can You please put cd disc with Win Xp or 7 , and run the Recovery Console by clicking R
CHKDSK /p /r or
chkdsk drive:c [/p] [/r]

I agree with, jimboc007 that, "The only steps that I could suggest to you would be to install Spyware Doctor 9.0.0.1218 on a new installed copy of Windows Vista or Windows 7"

Best Regards

Mikołaj

Hi Secret-HQ and Chomas,

I suggested installing Windows again since Secret-HQ (Scott) previously followed many troubleshooting steps in the following threads and they did not resolve the issue:

http://www.pctools.com/forum/showthr...DwAV-8.0.0.654

http://www.pctools.com/forum/showthr...ystem-To-Crawl

If the RAM of the PC needs testing, I would also suggest programs such as Memtest or Memtest86

Both are used by running them from a bootable CD (thus eliminating software and drivers for the time being from the troubleshooting process).

I have used Memtest86 before and it also tests the L2 cache of the CPU.

My preferred stability testing program for CPUs is IntelBurnTest. This stresses the CPU, northbridge (of the mainboard) and RAM much more than Prime95 and can find a fault (stability issue) faster too. Not only this but it creates significantly more heat than other burn tests for testing the effectiveness of your CPU cooling solution.

I would recommend that your cooling solution is more than up to the task when running Intel BurnTest since it creates far more heat far quicker than Prime95. There is even a disclaimer with the program stating that they are not responsible if you “fry” your CPU
-------------------------------------------------------
Here is an extract from the Intel BurnTest readme:
-------------------------------------------------------
A program that simplifies the usage of Intel(R) Linpack. Linpack by Intel(R) is an extremely stressful program that will put even the most powerful X86/X64 CPU in the world at its knees. Load temp under Linpack will be up to 22*C higher than the competing software Prime95. This program will make usage of Linpack easier and more practical.

Benefits of using Linpack:
1. More accurate than Prime95 Small FFTs/Blend (under x64 OS).
2. Takes less time to tell if your CPU/RAM is unstable than Prime95 (usually something like 8 minutes Linpack vs 40 hours under Prime95).
3. Use the same stress-testing engine that Intel uses to test their products before they are packed and put on shelves for sale.

Keep in mind, use this program at your own risk. By using this program, you agree that neither I nor Intel shall be responsible for including, but not limited to: burned up CPU, fried motherboard, spontaneous room temperature increase...

IntelBurnTest, Copyright © 2011-2012 Xtreme Gaming Studio. Linpack, Copyright © Intel(R) Corporation.

-------------------------------------------------------
I have also seen OCCT recommended but with mixed results.

I don’t use Prime95 for stability testing any longer because I have found that the amount of heat it causes a CPU to generate is far from the maximum amount of heat the CPU can actually generate. Yes, Prime95 loads the CPU to 100% across all cores but does not create the maximum amount of stress on the CPU or the maximum amount of heat. If I run Prime95 on my Intel Core i7 980X, it can be up to 5 to 10 degrees cooler than the maximum temperature when running Intel BurnTest. In other words 60 to 65 C, when Intel BurnTest consistently stays around 70 degrees C (no higher than 70).

If you would like to test you GPU (i.e. your graphics card) try playing the game, Crysis 2 with DirectX11 enabled (can give up to 99% GPU usage even in an SLI system (2x Geforce GTX 480)) or use the GPU client of Folding@Home.

Crysis 2 can cause instability issues due to insufficient GPU voltage on some Nvidia GPUs and is a great way of finding out if your PC is fully stable for playing games. My GTX 480s consistently stay at 91 degrees C while playing this game but are fully stable.

If using Folding@Home you can push your GPU even harder by enabling the adv-methods beta work units and you can create up to another 8 degrees of additional heat (GPU load still remains at 99%).

My other two Geforce GTX 580, reach 93 degrees C with these larger work units. They typically run at 85 C – 86 C with regular work units. A nice benefit of such stability testing is that you are benefiting the research of some or the world’s most common illnesses.
I hope this information is of assistance to you.

Please let me know if I can be of further assistance.

Thank you.
jimboc007