Cycle.exe pinning cpu at 100%, what is it? Help

[Guest]

I have a windows 2000 server that restarted last night for an update. When
it came up the CPU was pinned at 100% running a process called cycle.exe. I
couldn't kill the process. Found out it was attached to a service called
"evenstop". Restarted in safe mode, changed "evenstop" service to manual and
everything is fine. Did a virus check and everything was fine(also this
server gets no internet traffic, it's behind a firewall).
I know that cycle.exe has to do with wins, Also no errors in the event log.
I also have a service running called "eventask" as well that is suspious.
Both these processes are using srvany.exe as their executable, one executes
cycle.exe and one executes svchost.exe(when you look them up in the registry).
Does anybody know if these are legitamite processes?evenstop & eventask
What is cycle.exe?
Any help would be very appreciated, I haven't been able to find any info on
this stuff.

 

[Rick]

I have a windows 2000 server that restarted last night for an update. When
it came up the CPU was pinned at 100% running a process called cycle.exe. I
couldn't kill the process. Found out it was attached to a service called
"evenstop". Restarted in safe mode, changed "evenstop" service to manual and
everything is fine. Did a virus check and everything was fine(also this
server gets no internet traffic, it's behind a firewall).
I know that cycle.exe has to do with wins, Also no errors in the event log.
I also have a service running called "eventask" as well that is suspious.
Both these processes are using srvany.exe as their executable, one executes
cycle.exe and one executes svchost.exe(when you look them up in the registry).
Does anybody know if these are legitamite processes?evenstop & eventask
What is cycle.exe?
Any help would be very appreciated, I haven't been able to find any info on
this stuff.

Have you checked Google? Cycle.exe comes back with 200 hits.

 

[Guest]

Yes rick I checked no luck, most are about a game, one about gaobot, but
didn't apply to me.

 

[David H. Lipman]

1) Download the following four items...

McAfee Stinger
http://vil.nai.com/vil/stinger/

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download Sysclean.com and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt281.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) Update Adaware with the latest definitions.
3) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode
5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using the three
utilities; Trend Sysclean, Stinger and Adaware
7) If you are using WinME or WinXP, Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) If you are using WinME or WinXP, create a new Restore point


* * * Please report your results ! * * *

Dave





"stevekane (please nio email) @hotmail.com" <stevekane(please nio
email)@[email protected]> wrote in message
| I have a windows 2000 server that restarted last night for an update. When
| it came up the CPU was pinned at 100% running a process called cycle.exe. I
| couldn't kill the process. Found out it was attached to a service called
| "evenstop". Restarted in safe mode, changed "evenstop" service to manual and
| everything is fine. Did a virus check and everything was fine(also this
| server gets no internet traffic, it's behind a firewall).
| I know that cycle.exe has to do with wins, Also no errors in the event log.
| I also have a service running called "eventask" as well that is suspious.
| Both these processes are using srvany.exe as their executable, one executes
| cycle.exe and one executes svchost.exe(when you look them up in the registry).
| Does anybody know if these are legitamite processes?evenstop & eventask
| What is cycle.exe?
| Any help would be very appreciated, I haven't been able to find any info on
| this stuff.
|

 

[Guest]

David,
All this came up empty(Thanks for the help though), Cycle.exe is a
legitamate WINS file. Does anybody have any experience with cycle.exe? Any
info would be appreciated.
Thanks,
Steve

 

[David H. Lipman]

I realize that a filename can be legitimate, however, an infector can be named "anything"
and it is to the infector's benefit to mask itself by using the name of a legitimate file.

I am glad it turns out it is NOT an infector.

Dave




| David,
| All this came up empty(Thanks for the help though), Cycle.exe is a
| legitamate WINS file. Does anybody have any experience with cycle.exe? Any
| info would be appreciated.
| Thanks,
| Steve
|
| "David H. Lipman" wrote:
|
| > 1) Download the following four items...
| >
| > McAfee Stinger
| > http://vil.nai.com/vil/stinger/
| >
| > Trend Sysclean Package
| > http://www.trendmicro.com/download/dcs.asp
| >
| > Latest Trend Pattern File.
| > http://www.trendmicro.com/download/pattern.asp
| >
| > Adaware SE (free personal version v1.05)
| > http://www.lavasoftusa.com/
| >
| > Create a directory.
| > On drive "C:\"
| > (e.g., "c:\New Folder")
| > or the desktop
| > (e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")
| >
| > Download Sysclean.com and place it in that directory.
| > Download the Trend Pattern File by obtaining the ZIP file.
| > For example; lpt281.zip
| >
| > Extract the contents of the ZIP file and place the contents in the same directory as
| > sysclean.com.
| >
| > 2) Update Adaware with the latest definitions.
| > 3) If you are using WinME or WinXP, disable System Restore
| > http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
| > 4) Reboot your PC into Safe Mode
| > 5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of your
| > platform and clean/delete any infectors/parasites found.
| > (a few cycles may be needed)
| > 6) Restart your PC and perform a "final" Full Scan of your platform using the three
| > utilities; Trend Sysclean, Stinger and Adaware
| > 7) If you are using WinME or WinXP, Re-enable System Restore and re-apply any
| > System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
| > 8) Reboot your PC.
| > 9) If you are using WinME or WinXP, create a new Restore point
| >
| >
| > * * * Please report your results ! * * *
| >
| > Dave
| >
| >
| >
| >
| >
| > "stevekane (please nio email) @hotmail.com" <stevekane(please nio
| > email)@[email protected]> wrote in message
| > | > | I have a windows 2000 server that restarted last night for an update. When
| > | it came up the CPU was pinned at 100% running a process called cycle.exe. I
| > | couldn't kill the process. Found out it was attached to a service called
| > | "evenstop". Restarted in safe mode, changed "evenstop" service to manual and
| > | everything is fine. Did a virus check and everything was fine(also this
| > | server gets no internet traffic, it's behind a firewall).
| > | I know that cycle.exe has to do with wins, Also no errors in the event log.
| > | I also have a service running called "eventask" as well that is suspious.
| > | Both these processes are using srvany.exe as their executable, one executes
| > | cycle.exe and one executes svchost.exe(when you look them up in the registry).
| > | Does anybody know if these are legitamite processes?evenstop & eventask
| > | What is cycle.exe?
| > | Any help would be very appreciated, I haven't been able to find any info on
| > | this stuff.
| > |
| >
| >
| >