CPU usage at 100% for no apparant reason

[Matt]

CPU usage at 100% for no apparant reason
Can someone tell me what cause this to happen

 

[Bruce Chambers]

Greetings --

Perhaps, but only if you first tell us what specific process(es)
is(are) consuming those CPU cycles.

Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Jack]

there is always a reason...check your starting programs...just how much
memory do you really have....

your welcome...

 

[Guest]

Bruce,

The process (es) are LSAS.EXE used by the system.
SVCHOST.exe used by system(x2)

Theere are loads of others tahn seem to be doing nothing.

 

[Matt]

Bruce,
There are some 34 processes ongoing yet I have only 4
IE windows open and task manager. Many of these
processes register as 00 under cpu. The big users are:
System
SVCHOST.exe (there are two of these)
LSAS.exe

I am trying to install Norton Internet security and i
need to open MSCONFIG via run. When I do the window
gets closed for no apparant reason.

Appreciate any help you can give.

Matt

 

[Bruce Chambers]

Greetings --

It's perfectly normal to have several instances of Svchost.exe
running simultaneously.

A Description of Svchost.exe in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314056

However, if Svchost.exe is using a large portion of your CPU
cycles, it has most likely been "hijacked" by a worm or Trojan. Have
you tried using a decent antivirus application with the most
currently-available virus definition files? A strong candidate would
be W32.Welchia.Worm.

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

There is also a legitimate service called "lsass.exe," which is
the LSA Shell. Is this what you meant, or is the process you have
really named "LSAS.EXE?" If the latter, it's probably a Trojan or
Worm component.

Because many of the newer viruses and worms can disable antivirus
applications whose definitions weren't up-to-date, try using one or
more of the free on-line scanners to double-check your system.

Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/

McAfee Security - FreeScan
http://www.mcafee.com/myapps/mfs/default.asp

Symantec Security Check
http://security.symantec.com/ssc/home.asp



Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Matt]

Bruce,

Thanks for your ongoing help.

Trend Micro have identified "Worm AGOBOT.BE" located
c:\windows\system32\isas.exe

This was not detected by Symantec. Trend are unable to
clean/delete as the file is in use. How can I get rid of
it?

 

[Mad Max]

Matt;
For assistance in ridding your system of the parasites go to---
http://216.180.233.162/~swicom/forums/
Have a look around and post in the proper place.

 

[Bruce Chambers]

Greetings --

As near as I can determine, "isas.exe" isn't a Windows file. Try
the removal instructions here:

W32.HLLW.Gaobot.BE
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.be.html

Worm_Agobot.Gen
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_AGOBOT.GEN



Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Matt]

Hi,

Everytime I attempt to follow the responses using the run
prompt the window gets closed automatically leaving me
unable to change the settings. I have looked for the
isas.exe file in "my computer" and it does not appear.
This is becoming a real problem.

 

[Andrew Lomakin [MCP - WinXP]]

get yourself an antivirus and adware scanner
use a firewall