100% CPU Usage all the @#$% time

joshofalltrades

We have a laptop at work and it used to be pretty spry. About a week ago, however, it became absolutely worthless.

I always have ~1.6 Gigabytes of RAM free, but my CPU is always maxed out, which grinds everything to a standstill. My very first thought was "virus and/or spyware" but all-night full system scans on Ad-Aware, Spybot and AVG are clean.

We run some pretty intense programs that require a lot of processing power, but even when this laptop is idling with absolutely nothing running it's slow and unusable. We have a demo video on YouTube that we used to show clients when bringing the PC on business trips, but it's a slideshow now and so that's out.

Any suggestions? I'm open to whatever. If you need more information just ask, I'm happy to oblige.

Grizzly_Addams

Over time and regular use, any computer can become bogged down with the installation of programs and services. You haven't mentioned which version of windows you are using either. I would recommend the following:

• Uninstall any programs you are no longer using.
  
• Look at your running tasks list. This makes it easier to determine which programs are using the most of your computers resources. If you are finding many unrecognized processes, google them and determine if you need them. Remove or disable them at start-up. Disable any services you do not need as well. Especially from 3rd party software companies.
  
• Run the disk cleanup wizard. Defraging may or may not be neccessary depending on your OS.

These are the most basic steps for troubleshooting a slow computer -- if you are certain you have no virus or trojan.

You also said this happened about a week ago. Was it very sudden, or did it creep up slowly to the point of unusability? Installed any new programs? Did the laptop ever get unusually hot?

In fact a friend of mine who has had the same Dell XPS for a couple years was having alot of performance issues and aside from the standard Windows housekeeping, he opened his laptop to find societies of dust throughout, causing a heat issue which, once taken care of, significantly increased his performance.

joshofalltrades

I'm running XP. I'm uninstalling basically everything I haven't used in a month off of the PC now.

wunderbar

go into task manger, go to the process tab, and see what is using the CPU. That's the firs thing you should look at.

joshofalltrades

At the moment, Firefox is using about 95% of the CPU with the remaining 5% in things like Explorer and AVG background stuff.

If I close firefox, things get a little better but explorer.exe picks up where Firefox left off. Any ideas as to why Firefox and explorer are hogging it all?

Synthesis

This may not help, but give Malwarebyte's Anti-Malware a go. It's quite good at discovering things that are overlooked on other scanning programs, including registry modifications (that could, plausibly, cause this to happen).

Really, I would recommend it for any PC, regardless of performance.

ronya

Download and run Process Explorer (it's part of the excellent Microsoft-owned Sysinternals package of software). It's essentially Task Manager. Open it, look which process is consuming CPU, record it on some paper, then kill said process. Repeat until CPU is freed.

You've said Firefox, then Explorer. Go on...

Also, boot in safe mode and try this again. Tell us what changes. Boot in normal mode, start>run "msconfig", flip to Startup and disable everything, then restart. Tell us what changes. You can re-enable those items again if you like.

If you feel hardworking, or have a lot of free time, download Trend Micro Hijackthis, generate a log file, and post it here in a spoiler. Do not "fix checked". Do not "fixed checked". Hijackthis is one of those programs that can instantly and easily destroy your own operating system if you tell it to. Just generate a log file.

joshofalltrades

Working on safe mode stuff, here's the Hijackthis log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:19:34 PM, on 8/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ThpSrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Renick & Associates\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: HP00226447A4F7 HP00226447A4F7
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\WINDOWS\system32\ThpSrv.exe

--
End of file - 5732 bytes

Thanks for the help.

ronya

re: your log. The good news is that there's nothing apparently inappropriate in the log, so it probably isn't a virus and/or spyware.

The bad news is that there's nothing apparently inappropriate in the log, so we still have no idea what it is :P

CmdPrompt

Honestly I find the best way to do things is just to wipe everything and start over. That's obviously if you're comfortable with taking the time to move stuff off and then reinstall your programs, but it does run nicely for awhile.

ronya

Yeah, if you estimate having to spend more than ~12 hours diagnosing what is probably a nonrecurring software fault, it's often a better bet to nuke and reinstall.

Of course if it starts recurring thereafter you'll still need to diagnose it, but often the problem vanishes.

Question for OP: when you first turn on the computer, when does the 100% CPU usage start? Immediately?

Boxhead

/agree. Nuke and reinstall.

The time it takes you to diagnose could be spent reinstalling everything on a fresh OS.

Tofystedeth

HijackThis is pretty good, but AutoRuns (also from Sysinternals) is more comprehensive and easier to figure out what's what. If you fire up Process Explorer, you can track file usage, registry access, and see what processes are children of other processes. Since you've said both FireFox and Explorer are doing it, it sounds to me like a toolbar or addon for one or (probably) both of your browsers is running amok.

If you have 2-3 hours there's a couple good videos of seminars by Mark Russinovich (who wrote Process Explorer and the other Sysinternals goodies) on how to use them for troubleshooting and such which helps show how you can use them to track down what is causing specific problems or work around them.
The first is here. It deals with troubleshooting, while he mostly uses Process Explorer, he also touches on other tools such as FileMon and Autoruns.
The second is here. It focuses much more specifically on cleaning malware, which may or may not be the case with yours, but it also shows a lot of the stuff you can find out about what is going on your system.

Barrakketh

Tofystedeth wrote: »

The first is here. It deals with troubleshooting, while he mostly uses Process Explorer, he also touches on other tools such as FileMon and Autoruns.

I feel I should mention that they released Process Monitor a while back, which is more or less Process Explorer with FileMon's and RegMon's features.

Tofystedeth

Ah yes, I forgot about that one. Watches the things Process Explorer does, but has more logging and history type stuff going on. He uses that in the video too. And in fact mentions that it is basically all those 3 things combined so FileMon and RegMon aren't need anymore. *

*Unless you need those capabilities on a PreXP system. Process Monitor doesn't seem to work on those.

Nastyman

I had a problem like this in the past. I did some searching on Google and found some forums talking about killing and disabling windows automatic updates. I did so and everything was fine. Also, process explorer.

ronya

Well, be careful there. 100% CPU usage can be caused by all sorts of rubbish. Off the top of my head, the ones I've actually had to deal with: file corruption (fixed by chkdsk /r), bad sound drivers (fixed by updating said drivers), and numerous, numerous past experiences with svchost.exe eating CPU (assorted causes).

I've seen the WUAUCLT one in real life, but it isn't often the fault.

Nastyman

ronya wrote: »

Well, be careful there. 100% CPU usage can be caused by all sorts of rubbish. Off the top of my head, the ones I've actually had to deal with: file corruption (fixed by chkdsk /r), bad sound drivers (fixed by updating said drivers), and numerous, numerous past experiences with svchost.exe eating CPU (assorted causes).

I've seen the WUAUCLT one in real life, but it isn't often the fault.

Oh, yeah. I had originally typed "I don't recommend doing it, but..." at the beginning of my post. I have since nuked my pc and solved it that way. disabling the update service is not a permanent fix. (If that is indeed your problem I mean.)

krasher

I suspect this is your problem right here...

....
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p (User 'Default user')
.....

I've seen this one eat all available CPU.

Haterot

What did Process Explorer say? I had this same problem with a rig about 3 months ago. svchosts.exe was sucking up 100% of the cpu cycles. reinstalled Xp 3 times everything was fine until I installed the video drivers (most up to date) and then WHAM 100% Tried 2 different vid cards and same result. Not saying this is your problem but I had to replace the MOBO and then all was well.
Don't overlook hardware failure.