CPU Usage: 100%

[wiltrot]

Hey there.
I’ve got this computer that has an Intel Celeron 500MHz processor and I’m running Windows 98se/XPhome/2000pro. The CPU usage is at a 100% at all times, even when there’s no programs running (except for the 14 processes running in the Back ground). Now you must know that these OS’s have just been installed and there are no other programs on this computer. It appears that this is only happening under XP/2000 and also when I turn off the computer (whether it is a restart or shut down, it doesn’t matter) it doesn’t want to power off completely. Windows will shut down but won’t shut off the computer or restart (the power LED goes off) the power stays on. Windows 98se does not give me any problems, regarding these issues. Help please, thanks.

[shanmuga]

Check the Taskmanager to see which program/process is hogging the Cpu.Rightclick on task bar and select task manager and click the processes tab and check under the cpu tab.

[wiltrot]

SYSTEM is what is hogging CPU, using 97-99.

[Paleo Pete]

Run Hijack This (http://mjc1.com/mirror/hjt/) and post the log here, let's see what's running, often it's things you don't want, need or even know about...

[wiltrot]

StartupList report, 1/13/2004, 7:55:24 AM
StartupList version: 1.52
Started from : D:\Documents and Settings\William L. Trotter J\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\wpabaln.exe
D:\Documents and Settings\William L. Trotter J\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = D:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Shell & screensaver key from D:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Download Program Files:

[Update Class]
InProcServer32 = D:\WINDOWS\System32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37998.7919907407

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: D:\WINDOWS\system32\SHELL32.dll
CDBurn: D:\WINDOWS\system32\SHELL32.dll
WebCheck: D:\WINDOWS\System32\webcheck.dll
SysTray: D:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 2,699 bytes
Report generated in 0.081 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

[Paleo Pete]

First, that looks like it's incomplete, no bottom section with all the registry entries where browser hijackers and so forth hide out...

From what is there, this line:

D:\WINDOWS\System32\wpabaln.exe

is the only one I see that I question, but WAIT till a few of the other folks here take a look before doing anything with it, it might just be an innocent file I'm unaware of.

500MHz is pretty much bottom end for XP, but should run win 98 and win 2000 just fine, I ran 2000 on a 350MHz machine for a while and it ran great. But for XP. that's barely enough CPU to run it.

Also, I missed the part about the OS's just being freshly installed, read too fast...sorry...

OK some more info might be a good thing...system specs, has it been on the Internet much? Have all motherboard/sound/video drivers been installed? DirectX upgraded? Is auto update or system restore possibly trying to run something? Did defrag ever start and not finish, or is it set to run automagically? Has an antivirus program been installed that might be acting up? Is the mouse cursor acting erratic, blinking etc?

[Steve]

I'm pretty sure that wpabaln.exe is one of XPs activation files.

What you posted is a StartupList log. You might want to post a regular HJT log. It could show other running programs.

[shanmuga]

wpabaln.exe related to windows product activation baloon remainder, trial version of XP ? cracked ? Not sure, but it's a legit.
@wiltrot What you have posted is the startup list part of HijackThis, You need to post the full log.Download 'Hijack This!'. http://www.tomcoyote.org/hjt/
Unzip to a convenient folder(only then whatever changes you make using HJT will be backed up for restoring later if the need arises), doubleclick HijackThis.exe, and hit "Scan".When the scan is finished, the "Scan" button will change into a "Save Log" button.Press that, save the log, Ctrl-A to Select All, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.

[shanmuga]

SYSTEM is what is hogging CPU, using 97-99
When you say SYSTEM , If it's 'User Name', what appears in the 'Image Name' in the processes tab of the Task Manager ? A screen shot If possible would be more useful.

[wiltrot]

shanmuga, I tried a screen shot but couldn't figure out how to post it. I tried it as an attachment but it wouldn't take it. I guess it was too big. System is both image and user name.

[wiltrot]

Logfile of HijackThis v1.97.7
Scan saved at 10:17:43 AM, on 1/13/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Documents and Settings\William L. Trotter J\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37998.7919907407

[wiltrot]

What are those links for? Am I supposed to download those files?

[shanmuga]

Nothing serious with your log as is expected for a new install. If you don't require memory dump on errors, remove this entry O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k. Don't use HijackThis. Go to control panel > system > advanced > settings under the startup and recovery > select 'none' under the write debugging information.

Have you tried to boot it into safe mode? We can eliminate driver problems as safemode defaults to fail safe drivers.

[wiltrot]

shanmuga, I made the change to "none" and booted into safe mode. I see no problems in Device Manager and the CPU usage is still 100%.


as safemode defaults to fail safe drivers. I'm not sure what you mean by that.

[shanmuga]

Are we missing something basic here ? You are multi booting with celeron 500MHz...............
What about the RAM , Is it enough for running XP/2k ? Try adding more RAM , which just might free up the cpu.

[Paleo Pete]

What are those links for? Am I supposed to download those files?

I think you were referring to the links in the Hijack This log? No, those are the links set in the registry for IE to use for certain purposes...Start Page, blank page, search page etc.

as safemode defaults to fail safe drivers

That means that Safe Mode bypasses standard Windows drivers and uses only basic ones necessary to boot. Your new whiz bang XYZ 42000 Turbo video card will use standard SVGA drivers instead. 256 color, no frills...That lets Windows boot even if drivers you installed don't work and the system crashes in normal Windows mode.

I'm still wondering about system specs, and haven't seen any. We need to know some details at this point.

How much RAM? XP likes LOTS...and a 500MHz CPU is barely enough to handle XP, although win2000 should run quite well on it.

What other hardware, especially video card? And what drivers have been installed?

NIC trying to find a network?

Have you done any BIOS tweaks?

Any other software such as MS Office that might be constantly scanning drives for changed files?

Is System Restore enabled? That could be constantly scanning the system for changes to make "Restore Points". On a slower CPU that could bring the system to its knees by itself.

We need to know things like this to have an idea where to look...

[wiltrot]

This is an hand-me-down computer my father gave to me. As far as I can tell (Sandra Pro 2003) it has an Intel SR440BX Motherboard (http://support.intel.com/support/motherboards/desktop/sr440bx/Index.htm). Here's the Sandra report on the Motherboard: SiSoftware Sandra

Computer System
Manufacturer : AST Computers
Unique ID : CBECF94C-D311D749-00089FAC-CA2E9509

System Mainboard
Manufacturer : Intel Corporation
MP Support : No
Model : SR440
Version : AA746927-105
Serial Number : IUSR93201002
BIOS ID : 63-0012-009999-00101111-071595-440BX

On-board Devices
Ensoniq ES1373 Audio Device : Unknown
NVIDIA Riva 128ZX Graphics Controller : Unknown

Memory Controller
Error Detection Method : 32-bit ECC
Error Correction Capability : 1-bit
Supported/Current Memory Interleave : 1-way / 1-way
Number of Memory Slots : 2
Maximum Installable Memory : 512MB
Maximum Module Size : 256MB
Supported SDRAM Speeds : PC66, PC100
Supported Memory Types : ECC, DIMM, SDRAM
Supported Memory Voltages : 3.3V, 2.9V

Physical/BIOS Memory Banks
J6G1 (RASL-0 RASL-0) : 256MB DIMM double-bank
J6G2 (RASL-0 RASL-0) : 128MB DIMM single-bank

System Chipset
Model : Unknown (8086) Unknown (7190)
Bus(es) : ISA X-Bus AGP USB SMBus/i2c
Front Side Bus Speed : 1x 100MHz (100MHz data rate)
Max FSB Speed / Max Memory Speed : 1x 100MHz / 1x 100MHz
In Order Queue Depth : 4 req(s)

Logical/Chipset Memory Banks
Bank 0 Setting : 128MB SDRAM 8-1-1-1R 6-1-1-1W 3-2-2CL
Bank 1 Setting : 128MB SDRAM 8-1-1-1R 6-1-1-1W 3-2-2CL
Bank 2 Setting : 128MB SDRAM 8-1-1-1R 6-1-1-1W 3-2-2CL
Speed : 1x 100MHz (100MHz data rate)
Multiplier : 1/1x
Refresh Rate : 15.60µs
Power Down Mode : Yes
Fixed Hole Present : No

Memory Module(s)
Memory Module 1 : KGM100x64C2128 11000000 256MB 16x(16Mx8) SDRAM PC133U-333-542 (CL3 upto 133MHz)
Memory Module 2 : TF307A 256MB 8x(32Mx8) SDRAM PC133U-333-542 (CL3 upto 133MHz) (CL2 upto 100MHz)

AGP Bus
Version : 1.00
Speed : 67MHz
Current Data Transfer Rate : 2x 67MHz (134MHz data rate)
Side Band Enabled : Yes
Aperture Size : 64MB

LPC Hub Controller 1
Model : Unknown (8086) Unknown (7110)
ACPI PM Enabled : Yes
Random Number Generator Enabled : No
Multiplier : 1/4x
Speed : 8MHz
DMA Multiplier : 1/2x
DMA Speed : 4MHz

LPC Legacy Controller
Type : SMSC LPC v1
Version : 42.01
No Enabled Devices : 4

USB Controller 1
Model : Unknown (8086) Unknown (7112)
Version : 1.10
UHCI Interface : Yes
Channels : 2
Speed : 48MHz
Legacy Emulation Enabled : No

System SMBus Controller 1
Model : Intel PIIX4 SMBus / compatible
Speed : 16kHz

Expansion Slot(s)
J4D1 (1h) : AGP-2x 32-bit 3.3V PME FullLength (Unknown (10DE) Unknown (0020))
J4C1 (2h) : PCI 32-bit 3.3V PME FullLength Available
J4B1 (3h) : PCI 32-bit 3.3V PME FullLength Available
J4A1 (4h) : PCI 32-bit 3.3V Shared PME FullLength Available
J4A2 (1h) : ISA 16-bit 5V Shared FullLength

Port Connector(s)
J1J1 - USB1 : USB - None / USB
J1J1 - USB2 : USB - None / USB
J1H1 - COM A : Serial Port 16550A Compatible - None / DB9 pin female
J10B1 - COM B : Serial Port 16550A Compatible - None / 9 Pin Dual Inline
J1G1 - LPT1 : Parallel Port ECP/EPP - None / DB25 pin male
J1K1 - Keyboard : Keyboard Port - None / PS/2
J1K1 - PS2Mouse : Mouse Port - None / PS/2
J10E1 - Floppy - None : None - Floppy / None
J9E2 - PRI IDE - None : None - ATA / None
J9E1 - SEC IDE - None : None - ATA / None
J1F1 - VIDEO INTERFACE PORT - None : Video Port - None / None
J1E1 - GAME : Joystick Port - None / DB-15 pin female
J1E1 - Audio Mic In : Audio Port - None / Mini-jack
J1E1 - Audio Line In : Audio Port - None / Mini-jack
J1E1 - Audio Line Out : Audio Port - None / Mini-jack
J2D1 - Telephony IN - None : Audio Port - None / None
J2D2 - AUX IN - None : Audio Port - None / None
J2D3 - VIDEO - None : Audio Port - None / None
J2E1 - CDIN - None : Audio Port - CD-ROM Sound Input / None
J10C2 - Wake On Ring - None : None - None / None
J9J3 - Wake On LAN - None : None - None / None
J8E1 - SCSI LED - None : None - None / None
J9H2 - Control Panel - None : None - None / None
J10J1 - Power Supply Fan - None : None - None / None
J4K2 - CPU Fan - None : None - None / None
J8E2 - Configuration Jumper - None : None - None / None

Performance Tips
Notice 224 : Tip not found!
Warning 2507 : Tip not found!
Warning 2508 : Tip not found!
Warning 2545 : Tip not found!
Tip 2524 : Tip not found!
Tip 2 : Tip not found!

[wiltrot]

I have gone into the BIOS but can't see anything where tweaking would help. The BIOS is pretty simple, not much there. It's not AWARD or AMI, looks proprietary to me. I'am suspicious of one thing and that is - the spec from Intel shows the Celeron processor support only goes up to 433 MHz and yet it has a 500 MHz installed. I put two 256 RAM chips in it but it only show 384 mb. The Bus speed of course on the two chips is 133, it should still work (which it does). I will give the BIOS another look.

[wiltrot]

Okay my bad, this thing has a Pentium 3 processor.:rolleyes: