system.exe takes 100% of CPU cycle

[Sheamus]

Hi,

I'm running a Win XP Pro SP2 system, with 256MB ram.

My PC regularly runs to 100% CPU. Task manager lists the offending
process as "system.exe". I installed "Process Explorer for Windows"
from www.sysinternals.com which allowed me to get a more accurate
picture of what was going wrong. Basically, whenever my CPU cycle goes
insane, "USBPort.sys" is actually calling up at least 97% of the CPU
cycle.

I've fully patched my PC. I've run several different anti spyware
apps, plus I have up to date antivirus on my PC.

Has anyone seen this problem before, and can anyone suggest a way to
fix this?

Regards,
Sheamus

 

[Guest]

Upgrade and add more RAM. It's probably doing a lot of "Pagefile" swapping
between the hard drive and the 256MB of RAM that you have installed. Get a
total of at least 512, but 1 GB would be better and faster. You might want to
also use the help button to allow Windows to make the pagefile a little
bigger until you do...

Mack

 

[Sheamus]

There page file has already a) been moved to a separate hard drive and
b) been enlarged quite a bit.

While RAM does need increasing, I don't think thats the problem here.
It shouldn't make the USB drivers spaz out the way they have been
surely?

 

[Guest]

What all do you have plugged into the USB ports? Is you other drive (where
you have the Pagefile going) an external hard drive?

If so, and that's where you designated the Pagefile to be, that may be why
it's locking up (doing a lot of pagefile swapping because of your limited
RAM...). Try putting the pagefile on the main C:\ drive. Set the minimum size
for at least 512MB. I set mine to 1024MB initial and 1024MB max so it stays
static.

Let me know...
Mack

 

[Steve]

On Tue, 4 Apr 2006 14:03:19 -0700, Big_Mack1

"System.exe" is a dangerous trojan providing backdoor access
http://www.greatis.com/appdata/d/s/system.exe.htm

I'm surprised no one has jumped in with that reply.

.. steve ..

 

[Sheamus]

Big Mack,

The drive in question is a secondary SATA drive - internal, not
external. It's set to 1012MB max, but I think it's at something like
720MB min. I'll look at changing it when I get home tonight.

 

[Sheamus]

Not this time, my antivirus is up to date, and their library lists the
spybot range of trojans as very old - mine should cope fine.

 

[Steve]

Not this time, my antivirus is up to date, and their library lists the
spybot range of trojans as very old - mine should cope fine.

Yes but Sheamus, System.exe is a virus, a trojan, it shouldn't be on
your system, It's not part of Windows. There are other posts in this
newsgroup about System.exe crashing their system or causing
application hangs etc. System.exe IS the problem, get rid of it as
per the link I gave you.

... Steve ..

 

[Guest]

Steve's right! Great job, oh master...
Why didn't I think of that??? (Perhaps because I have no coffee in my cup
right now...?)

Here's a link to a Norton (Symantec) website search results for
"system.exe", along with all of the VARIATIONS of that virus's filename.
Steve's right-if it's a system file, it would be like "system.sys", NOT AN
EXECUTABLE (".exe") look at the size of the "system.exe" file on your system
and write down it's EXACT size by highlighting it and right-clicking on it,
then clicking on "properties".

The problem is that if you just delete the file, then the next time you boot
up, the registry keys will tell it will look for that file and if it doesn't
find it, it will go to the original file's location (hackers usually change
the original filename to disguise it), and it will copy itself right back
where it is now.

The Norton link will tell you which files to delete, and also which registry
keys it resides in and how to edit the registry keys so that it get's
eliminated completely.

But the first thing you have to do is look at the exact size (ex: 47,395
bytes) to establish which variant of the virus you have in order to use the
right "fix" according to Norton's virus removal instructions.

Here's the link to my Norton website search of "system.exe":

http://search.symantec.com/custom/u...=100&st=1&context=gbh&qt=system.exe&x=16&y=10

Great job, Steve...!
Mack

 

[Steve]

Steve's right! Great job, oh master...
Why didn't I think of that??? (Perhaps because I have no coffee in my cup
right now...?)

Here's a link to a Norton (Symantec) website search results for
"system.exe", along with all of the VARIATIONS of that virus's filename.
Steve's right-if it's a system file, it would be like "system.sys", NOT AN
EXECUTABLE (".exe") look at the size of the "system.exe" file on your system
and write down it's EXACT size by highlighting it and right-clicking on it,
then clicking on "properties".

The problem is that if you just delete the file, then the next time you boot
up, the registry keys will tell it will look for that file and if it doesn't
find it, it will go to the original file's location (hackers usually change
the original filename to disguise it), and it will copy itself right back
where it is now.

The Norton link will tell you which files to delete, and also which registry
keys it resides in and how to edit the registry keys so that it get's
eliminated completely.

But the first thing you have to do is look at the exact size (ex: 47,395
bytes) to establish which variant of the virus you have in order to use the
right "fix" according to Norton's virus removal instructions.

Here's the link to my Norton website search of "system.exe":

http://search.symantec.com/custom/u...=100&st=1&context=gbh&qt=system.exe&x=16&y=10

Great job, Steve...!
Mack

Thanks, however I don't think Sheamus is reading this, or he's
convinced that because his Malware detector doesn't show it that we're
both talking through our nether ends.

A fellow (barely) drives his car into a garage. One wheel is missing.
He says to the mechanic "There's something wrong with the car, it
handles badly and pulls to the left."

The mechanic says "well, of course, your left front wheel is missing!"

"Oh I know that, but could you find out what's wrong with the car?"

.. Steve ..

 

[Sheamus]

Steve,

I haven't read it because I have been away from my PC for a little
while. No need for the bloody sarchasm.

Sheamus

 

[rootj4m13]

Alough steam.exe is a backdoor, it is also a gaming engine, do you run
steam (the program) and any steam games?

Often steam has problems with cross platform comatibility issues,
usually special editions and 64 bit windows.

 

[Steve]

Steve,

I haven't read it because I have been away from my PC for a little
while. No need for the bloody sarchasm.

Sheamus

Well, I said:
""System.exe" is a dangerous trojan providing backdoor access
http://www.greatis.com/appdata/d/s/system.exe.htm"

And you said:

"Not this time, my antivirus is up to date, and their library lists
the spybot range of trojans as very old - mine should cope fine."

Suggesting that even though the Trojan was named, you couldn't HAVE a
trojan because you had spybot, and/or that the Trojan could not be
causing the 100% CPU usage. What could I think?

... Steve ..