WinXP SP3, 100% CPU Usage Nightmare

Printable View

11-05-2008
Teknowbabble

WinXP SP3, 100% CPU Usage Nightmare

Ever since I downloaded WinXP SP3 I think its released demonic forces
into my system.

I haven't seen anything like this since my browser got Hi-Jacked
several years ago. It's maddening.

----------------------------------------
What Initially Happened
----------------------------------------
Initially I noticed that my CPU usage went to 100% when I went into my
Gmail (email) account or I was playing certain YouTube videos.
ZoneAlarm VSMON.EXE and Microsoft IEXPLORE.EXE were the responsible
culprits according to Sysinternal Process Explorer.

-------------------
What I Did
-------------------
I uninstalled and re-installed both ZoneAlarm and Internet Explorer 7.
Unfortunately that didn't solve the problem.

--------------------------------------------
What Microsoft Support Did
--------------------------------------------
Microsoft tech support changed my swap file size and erased some
browser add-ons that were hogging IE7 system resources. I also had all
my drives scanned and fixed through the Microsoft Live Onecare System
Scan. The scanned revealed several bugs.

-----------------------------
Current Prognosis
-----------------------------
Currently I can get into Gmail with No problems. Unfortunately my
system goes to 100% CPU usage when I watch a YouTube Video. Weird!

If anyone has any thoughts, Im all ears.

Ive included my system specs and a HijackThis logfile below as well.

Thanks in Advance.

Teknowbabble

--------------------------------------
FYI, My System Setup
-------------------------------------
Intel P4 2.8 Ghz (Northwood)
800 FSB
Hyperthreading
WinXP SP3
Intel D865GBF Mobo (socket 478)
1 GB RAM (Crucial DDR400)

-----------------------------------------------------
HijackThis Logfile
-----------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:02:03 AM, on 5/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Digidesign\Drivers\MMERefresh.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\DeltaIITray.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\SurfControl\CyberPatrol\CPHQ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SurfControl\CyberPatrol\cpserver.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\SurfControl\CyberPatrol\cpACtrl.exe
C:\Program Files\SurfControl\CyberPatrol\cpCCtrl.exe
C:\Program Files\SurfControl\CyberPatrol\cpkbinst.exe
C:\ALEXS-FILES\Computer\Diagnostics\procexp.exe
C:\Program Files\Intel\Intel(R) Active Monitor\iActvMon.exe
C:\Program Files\Microsoft Sysinternals\ZoomIt\ZoomIt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE
C:\WINDOWS\notepad.exe
C:\Program Files\HijackThis\HijackThis-V2-02.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL
= http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant
=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch
=
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-
B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat
\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-
A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:
\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Bridge Class - {E479EDE1-923E-11D3-B82B-00E09871521B} - C:
\Program Files\Compass\CmpsIE.dll
O3 - Toolbar: (no name) - {1F088139-2F7F-41E2-A801-42761CB3D2AC} - (no
file)
O4 - HKLM\..\Run: [DeltaIITaskbarApp] C:\WINDOWS
\system32\DeltaIITray.exe
O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel(R) Active
Monitor\imontray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime
\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [CyberPatrolNew] "C:\Program Files\SurfControl
\CyberPatrol\CPHQ.exe" /m
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs
\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft
ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES
\MICROSOFT ACTIVESYNC\WCESCOMM.EXE" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES
\MICROSOFT ACTIVESYNC\WCESCOMM.EXE" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES
\MICROSOFT ACTIVESYNC\WCESCOMM.EXE" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Printing Migration] rundll32.exe C:
\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User
'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES
\MICROSOFT ACTIVESYNC\WCESCOMM.EXE" (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Printing Migration] rundll32.exe C:
\WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User
'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:
\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O9 - Extra button: Send to OneNote -
{2670000A-7350-4f3c-8081-5663EE0C6C49} - C:
\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote -
{2670000A-7350-4f3c-8081-5663EE0C6C49} - C:
\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite -
{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:
\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}
- C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... -
{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:
\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
- (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583}
- C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-
d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic
\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}
- C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-
BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: myFavorites 2 - {D2BC8EE6-7E71-4c3c-
AD9A-0D7D95D11FDC} - C:\Program Files\Arcadia\myFavorites
2\myFavorites.hta (HKCU)
O9 - Extra 'Tools' menuitem: myFavorites 2 - {D2BC8EE6-7E71-4c3c-
AD9A-0D7D95D11FDC} - C:\Program Files\Arcadia\myFavorites
2\myFavorites.hta (HKCU)
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com.../c381/chat.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio
Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation
Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) -
http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) -
https://webresponse.one.microsoft.co...veX/winrep.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety
Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase9563.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class)
- http://www.update.microsoft.com/micr...?1189590423171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class)
- http://www.update.microsoft.com/micr...?1189590308281
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) -
http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller
Class) - http://h30155.www3.hp.com/ediags/gs/...dsolutions.cab
O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B}
(WebResponseAttachments Control) - https://webresponse.one.microsoft.co...X/FileXfer.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class)
- http://www.sibelius.com/download/sof...iveXPlugin.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control
4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{12BAEC35-C285-4485-
B662-9D9AEEF6E45B}: NameServer = 205.171.3.65,205.171.2.65
O17 - HKLM\System\CS1\Services\Tcpip\..\{12BAEC35-C285-4485-
B662-9D9AEEF6E45B}: NameServer = 205.171.3.65,205.171.2.65
O17 - HKLM\System\CS2\Services\Tcpip\..\{12BAEC35-C285-4485-
B662-9D9AEEF6E45B}: NameServer = 205.171.3.65,205.171.2.65
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Unknown owner
- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (file
missing)
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. -
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Digidesign MME Refresh Service (DigiRefresh) -
Digidesign, A Division of Avid Technology, Inc. - C:\Program Files
\Digidesign\Drivers\MMERefresh.exe
O23 - Service: digiSPTIService - Digidesign, A Division of Avid
Technology, Inc. - C:\Program Files\Digidesign\Pro Tools
\digiSPTIService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS
\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS
\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPBOID.EXE
O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:
\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
O23 - Service: LightScribeService Direct Disc Labeling Service
(LightScribeService) - Hewlett-Packard Company - C:\Program Files
\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS
\system32\HPZipm12.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) -
SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite
XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) -
SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite
XII.SP1\RpcSandraSrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service
(default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices
\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC -
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

--
End of file - 10664 bytes
11-05-2008
PA Bear [MS MVP]

Re: WinXP SP3, 100% CPU Usage Nightmare

[Crossposted to WinXP General newsgroup]

We do not interpret HijackThis logs in public newsgroups, especially in this
newsgroup.

> I haven't seen anything like this since my browser got Hi-Jacked
> several years ago.

How did you go about resolving this browser hijack?

Were AVG Anti-Virus 8.0, ZoneAlarm, and CyberPatrol all running when you
installed WinXP SP3?

If you uninstall ZoneAlarm, enable the Windows Firewall and reboot, does the
behavior persist?

Have you posted about this problem in ZoneLabs Support Forum?
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Teknowbabble wrote:
> Ever since I downloaded WinXP SP3 I think its released demonic forces
> into my system.
>
> I haven't seen anything like this since my browser got Hi-Jacked
> several years ago. It's maddening.
>
> ----------------------------------------
> What Initially Happened
> ----------------------------------------
> Initially I noticed that my CPU usage went to 100% when I went into my
> Gmail (email) account or I was playing certain YouTube videos.
> ZoneAlarm VSMON.EXE and Microsoft IEXPLORE.EXE were the responsible
> culprits according to Sysinternal Process Explorer.
>
> -------------------
> What I Did
> -------------------
> I uninstalled and re-installed both ZoneAlarm and Internet Explorer 7.
> Unfortunately that didn't solve the problem.
>
> --------------------------------------------
> What Microsoft Support Did
> --------------------------------------------
> Microsoft tech support changed my swap file size and erased some
> browser add-ons that were hogging IE7 system resources. I also had all
> my drives scanned and fixed through the Microsoft Live Onecare System
> Scan. The scanned revealed several bugs.
>
> -----------------------------
> Current Prognosis
> -----------------------------
> Currently I can get into Gmail with No problems. Unfortunately my
> system goes to 100% CPU usage when I watch a YouTube Video. Weird!
>
> If anyone has any thoughts, Im all ears.
>
> Ive included my system specs and a HijackThis logfile below as well.
<snip>
12-05-2008
Teknowbabble

Re: WinXP SP3, 100% CPU Usage Nightmare

Robert, Thanks a Million!

It turns out CYBERPATROL version 7.6 was causing the problem. Shut
down Cyberpatrol and everything works fine.

After downloading Windows XP SP3, it causes a runaway situation with
the CPU going to 100% when one accesses Gmail or plays a Youtube
video.

I actually like Cyberopatrol a lot, so Im kinda of bummed this is
happening.

I will check with Cyberpatrol and see if there are any workarounds.

I am so relieved. My computer was acting so hay wire it was
ridiculous.

Thanks Again.

Teknowbabble

On May 11, 6:05 am, Teknowbabble <teknowbab...@yahoo.com> wrote:
> Ever since I downloaded WinXP SP3 I think its released demonic forces
> into my system.
>
> I haven't seen anything like this since my browser got Hi-Jacked
> several years ago. It's maddening.
>
> ----------------------------------------
> What Initially Happened
> ----------------------------------------
> Initially I noticed that my CPU usage went to 100% when I went into my
> Gmail (email) account or I was playing certain YouTube videos.
> ZoneAlarm VSMON.EXE and Microsoft IEXPLORE.EXE were the responsible
> culprits according to Sysinternal Process Explorer.
>
> -------------------
> What I Did
> -------------------
> I uninstalled and re-installed both ZoneAlarm and Internet Explorer 7.
> Unfortunately that didn't solve the problem.
>
> --------------------------------------------
> What Microsoft Support Did
> --------------------------------------------
> Microsoft tech support changed my swap file size and erased some
> browser add-ons that were hogging IE7 system resources. I also had all
> my drives scanned and fixed through the Microsoft Live Onecare System
> Scan. The scanned revealed several bugs.
>
> -----------------------------
> Current Prognosis
> -----------------------------
> Currently I can get into Gmail with No problems. Unfortunately my
> system goes to 100% CPU usage when I watch a YouTube Video. Weird!
>
> If anyone has any thoughts, Im all ears.
>
> Ive included my system specs and a HijackThis logfile below as well.
>
> Thanks in Advance.
>
> Teknowbabble

[Crossposted to WinXP General newsgroup]

We do not interpret HijackThis logs in public newsgroups, especially
in this
newsgroup.

> I haven't seen anything like this since my browser got Hi-Jacked
> several years ago.

How did you go about resolving this browser hijack?

Were AVG Anti-Virus 8.0, ZoneAlarm, and CyberPatrol all running when
you
installed WinXP SP3?

If you uninstall ZoneAlarm, enable the Windows Firewall and reboot,
does the
behavior persist?

Have you posted about this problem in ZoneLabs Support Forum?
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/
12-05-2008
PA Bear [MS MVP]

Re: WinXP SP3, 100% CPU Usage Nightmare

YW & thanks for your feedback.

Teknowbabble wrote:
> Robert, Thanks a Million!
>
> It turns out CYBERPATROL version 7.6 was causing the problem. Shut
> down Cyberpatrol and everything works fine.
>
> After downloading Windows XP SP3, it causes a runaway situation with
> the CPU going to 100% when one accesses Gmail or plays a Youtube
> video.
>
> I actually like Cyberopatrol a lot, so Im kinda of bummed this is
> happening.
>
> I will check with Cyberpatrol and see if there are any workarounds.
>
> I am so relieved. My computer was acting so hay wire it was
> ridiculous.
>
> Thanks Again.
>
> Teknowbabble
>
>
> On May 11, 6:05 am, Teknowbabble <teknowbab...@yahoo.com> wrote:
>> Ever since I downloaded WinXP SP3 I think its released demonic forces
>> into my system.
>>
>> I haven't seen anything like this since my browser got Hi-Jacked
>> several years ago. It's maddening.
>>
>> ----------------------------------------
>> What Initially Happened
>> ----------------------------------------
>> Initially I noticed that my CPU usage went to 100% when I went into my
>> Gmail (email) account or I was playing certain YouTube videos.
>> ZoneAlarm VSMON.EXE and Microsoft IEXPLORE.EXE were the responsible
>> culprits according to Sysinternal Process Explorer.
>>
>> -------------------
>> What I Did
>> -------------------
>> I uninstalled and re-installed both ZoneAlarm and Internet Explorer 7.
>> Unfortunately that didn't solve the problem.
>>
>> --------------------------------------------
>> What Microsoft Support Did
>> --------------------------------------------
>> Microsoft tech support changed my swap file size and erased some
>> browser add-ons that were hogging IE7 system resources. I also had all
>> my drives scanned and fixed through the Microsoft Live Onecare System
>> Scan. The scanned revealed several bugs.
>>
>> -----------------------------
>> Current Prognosis
>> -----------------------------
>> Currently I can get into Gmail with No problems. Unfortunately my
>> system goes to 100% CPU usage when I watch a YouTube Video. Weird!
>>
>> If anyone has any thoughts, Im all ears.
>>
>> Ive included my system specs and a HijackThis logfile below as well.
>>
>> Thanks in Advance.
>>
>> Teknowbabble
>
>
>
> [Crossposted to WinXP General newsgroup]
>
> We do not interpret HijackThis logs in public newsgroups, especially
> in this
> newsgroup.
>
>
>
>> I haven't seen anything like this since my browser got Hi-Jacked
>> several years ago.
>
>
> How did you go about resolving this browser hijack?
>
> Were AVG Anti-Virus 8.0, ZoneAlarm, and CyberPatrol all running when
> you
> installed WinXP SP3?
>
>
> If you uninstall ZoneAlarm, enable the Windows Firewall and reboot,
> does the
> behavior persist?
>
>
> Have you posted about this problem in ZoneLabs Support Forum?
14-05-2008
Teknowbabble

Re: WinXP SP3, 100% CPU Usage Nightmare

On May 11, 6:05 am, Teknowbabble <teknowbab...@yahoo.com> wrote:
> Ever since I downloaded WinXP SP3 I think its released demonic forces
> into my system.
>
> I haven't seen anything like this since my browser got Hi-Jacked
> several years ago. It's maddening.
>
> ----------------------------------------
> What Initially Happened
> ----------------------------------------
> Initially I noticed that my CPU usage went to 100% when I went into my
> Gmail (email) account or I was playing certain YouTube videos.
> ZoneAlarm VSMON.EXE and Microsoft IEXPLORE.EXE were the responsible
> culprits according to Sysinternal Process Explorer.
>
> -------------------
> What I Did
> -------------------
> I uninstalled and re-installed both ZoneAlarm and Internet Explorer 7.
> Unfortunately that didn't solve the problem.
>
> --------------------------------------------
> What Microsoft Support Did
> --------------------------------------------
> Microsoft tech support changed my swap file size and erased some
> browser add-ons that were hogging IE7 system resources. I also had all
> my drives scanned and fixed through the Microsoft Live Onecare System
> Scan. The scanned revealed several bugs.
>
> -----------------------------
> Current Prognosis
> -----------------------------
> Currently I can get into Gmail with No problems. Unfortunately my
> system goes to 100% CPU usage when I watch a YouTube Video. Weird!
>
> If anyone has any thoughts, Im all ears.
>
> Ive included my system specs and a HijackThis logfile below as well.
>
> Thanks in Advance.
>
> Teknowbabble
>
> --------------------------------------
> FYI, My System Setup
> -------------------------------------
> Intel P4 2.8 Ghz (Northwood)
> 800 FSB
> Hyperthreading
> WinXP SP3
> Intel D865GBF Mobo (socket 478)
> 1 GB RAM (Crucial DDR400)
>
> -----------------------------------------------------
> HijackThis Logfile
> -----------------------------------------------------
>
> Logfile of Trend Micro HijackThis v2.0.2
> Scan saved at 6:02:03 AM, on 5/11/2008
> Platform: Windows XP SP3 (WinNT 5.01.2600)
> MSIE: Internet Explorer v7.00 (7.00.6000.16640)
> Boot mode: Normal
>
> Running processes:
> C:\WINDOWS\System32\smss.exe
> C:\WINDOWS\system32\winlogon.exe
> C:\WINDOWS\system32\services.exe
> C:\WINDOWS\system32\lsass.exe
> C:\WINDOWS\system32\svchost.exe
> C:\WINDOWS\System32\svchost.exe
> C:\WINDOWS\system32\svchost.exe
> C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
> C:\WINDOWS\system32\spoolsv.exe
> C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
> C:\Program Files\Digidesign\Drivers\MMERefresh.exe
> C:\Program Files\Common Files\LightScribe\LSSrvc.exe
> C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
> C:\WINDOWS\system32\HPZipm12.exe
> C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
> C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
> C:\WINDOWS\System32\svchost.exe
> C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
> C:\WINDOWS\Explorer.EXE
> C:\PROGRA~1\AVG\AVG8\avgrsx.exe
> C:\WINDOWS\system32\DeltaIITray.exe
> C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
> C:\PROGRA~1\AVG\AVG8\avgtray.exe
> C:\Program Files\SurfControl\CyberPatrol\CPHQ.exe
> C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
> C:\Program Files\Microsoft ActiveSync\wcescomm.exe
> C:\WINDOWS\system32\wscntfy.exe
> C:\WINDOWS\system32\ctfmon.exe
> C:\Program Files\SurfControl\CyberPatrol\cpserver.exe
> C:\PROGRA~1\MICROS~4\rapimgr.exe
> C:\Program Files\SurfControl\CyberPatrol\cpACtrl.exe
> C:\Program Files\SurfControl\CyberPatrol\cpCCtrl.exe
> C:\Program Files\SurfControl\CyberPatrol\cpkbinst.exe
> C:\ALEXS-FILES\Computer\Diagnostics\procexp.exe
> C:\Program Files\Intel\Intel(R) Active Monitor\iActvMon.exe
> C:\Program Files\Microsoft Sysinternals\ZoomIt\ZoomIt.exe
> C:\Program Files\Internet Explorer\iexplore.exe
> C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
> C:\WINDOWS\system32\taskmgr.exe
> C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE
> C:\WINDOWS\notepad.exe
> C:\Program Files\HijackThis\HijackThis-V2-02.exe
>
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
> about:blank
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL
> =http://go.microsoft.com/fwlink/?LinkId=54896
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant
> =
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch
> =
> O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-
> B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat
> \ActiveX\AcroIEHelper.dll
> O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-
> A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
> O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:
> \PROGRA~1\SPYBOT~1\SDHelper.dll
> O2 - BHO: Bridge Class - {E479EDE1-923E-11D3-B82B-00E09871521B} - C:
> \Program Files\Compass\CmpsIE.dll
> O3 - Toolbar: (no name) - {1F088139-2F7F-41E2-A801-42761CB3D2AC} - (no
> file)
> O4 - HKLM\..\Run: [DeltaIITaskbarApp] C:\WINDOWS
> \system32\DeltaIITray.exe
> O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel(R) Active
> Monitor\imontray.exe
> O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime
> \qttask.exe" -atboottime
> O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
> O4 - HKLM\..\Run: [CyberPatrolNew] "C:\Program Files\SurfControl
> \CyberPatrol\CPHQ.exe" /m
> O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs
> \ZoneAlarm\zlclient.exe"
> O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft
> ActiveSync\wcescomm.exe"
> O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
> O4 - HKUS\S-1-5-19\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES
> \MICROSOFT ACTIVESYNC\WCESCOMM.EXE" (User 'LOCAL SERVICE')
> O4 - HKUS\S-1-5-20\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES
> \MICROSOFT ACTIVESYNC\WCESCOMM.EXE" (User 'NETWORK SERVICE')
> O4 - HKUS\S-1-5-18\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES
> \MICROSOFT ACTIVESYNC\WCESCOMM.EXE" (User 'SYSTEM')
> O4 - HKUS\S-1-5-18\..\RunOnce: [Printing Migration] rundll32.exe C:
> \WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User
> 'SYSTEM')
> O4 - HKUS\.DEFAULT\..\Run: [H/PC Connection Agent] "C:\PROGRAM FILES
> \MICROSOFT ACTIVESYNC\WCESCOMM.EXE" (User 'Default user')
> O4 - HKUS\.DEFAULT\..\RunOnce: [Printing Migration] rundll32.exe C:
> \WINDOWS\System32\spool\migrate.dll,ProcessWin9xNetworkPrinters (User
> 'Default user')
> O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:
> \Program Files\Microsoft Office\Office12\ONENOTEM.EXE
> O9 - Extra button: Send to OneNote -
> {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:
> \PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
> O9 - Extra 'Tools' menuitem: S&end to OneNote -
> {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:
> \PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
> O9 - Extra button: Create Mobile Favorite -
> {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:
> \PROGRA~1\MICROS~4\INetRepl.dll
> O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}
> - C:\PROGRA~1\MICROS~4\INetRepl.dll
> O9 - Extra 'Tools' menuitem: Create Mobile Favorite... -
> {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:
> \PROGRA~1\MICROS~4\INetRepl.dll
> O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
> C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
> O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
> - (no file)
> O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583}
> - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
> O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-
> d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic
> \xpnetdiag.exe
> O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}
> - C:\Program Files\Messenger\msmsgs.exe
> O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-
> BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
> O9 - Extra button: myFavorites 2 - {D2BC8EE6-7E71-4c3c-
> AD9A-0D7D95D11FDC} - C:\Program Files\Arcadia\myFavorites
> 2\myFavorites.hta (HKCU)
> O9 - Extra 'Tools' menuitem: myFavorites 2 - {D2BC8EE6-7E71-4c3c-
> AD9A-0D7D95D11FDC} - C:\Program Files\Arcadia\myFavorites
> 2\myFavorites.hta (HKCU)
> O16 - DPF: Yahoo! Chat -http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
> O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio
> Conferencing) -http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
> O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation
> Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
> O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) -http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
> O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) -https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
> O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety
> Center Base Module) -http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase95...
> O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class)
> -http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
> O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class)
> -http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
> O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) -http://chat.yahoo.com/cab/yacsui.cab
> O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller
> Class) -http://h30155.www3.hp.com/ediags/gs/install/guidedsolutions.cab
> O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B}
> (WebResponseAttachments Control) -https://webresponse.one.microsoft.com/oas/ActiveX/FileXfer.cab
> O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class)
> -http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
> O16 - ...
>
> read more »

******************************
ADDENDUM
******************************

I spoke too soon.

I still had problems with certain Youtube videos going to 100% CPU
usage even with Cyberpatrol removed. Turns out that ZoneAlarm was the
culprit as well.

I turned off ZoneAlarm (firewall). Windows firewall automatically
turns on in its place. When I ran the videos that gave me problems
they operated normally.

Looks like between ZoneAlarm and CyberPatrol the two are reacting with
Windows XP SP3 and the software from Gmail and YouTube. If I was a
nuclear physicist maybe I might be able to figure all this out.

For now I'll just have to figure out what works and what doesnt and
keep my fingers crossed that I dont get some nasty virus or spyware.

Teknowbabble