Windows XP Processes using 100% CPU

[Guest]

Hi,

Few weeks back I found that the HelpService of Microsoft is taking almost
100% cpu for absolutely no reason, and I cant use my laptop. So I searched
the internet and found out that

many people have already facedthis issue, and as per suggestions, I disabled
this service from starting up automatically. All were fine after that.

Suddenly from yesterday the defrag.exe has started popping up and using my
cpu 100%. I tried to kill the process with no luck. Searching the net did not
really help. If I reboot the laptop, it starts working fine, but the process
reappears after some time and makes the machine unusable.

When I investigated, yes my harddisk was 30% defragmented, and I tried to
defragment that. One drive went fine, but the C drive did some, and then
reported that there are few files (which are my movie files, mainly avi,
created from my camcorder) which cant be defragmented.

But I am clueless about one thing, even if my drive is fragmented, why on
earth XP would run defrag.exe without my permission (and the admin wont be
able to kill it!)?

I scanned for virus/trojan infection, but none was found!

Now I am here asking for help. Please let me know:

1. why this is happening, first the Help service and now defrag?

2. why cant I kill this process although I am the admin? Is there any tool
that would help me kill processes which XP dont want me to kill, but I want
to get rid of? I know XP is very smart, but I want control of my processes,
when it makes mistake ;-)

My machine configuration:
- Win XP SP2 with latest April 11 patch
- Centrino 1.7GHz
- 512 MB RAM
- 80 GB HDD

Please HELP!

 

[Guest]

Hi again,

Although nobody has replied yet, I decided to post few more observation:

The process that runs is defrag.exe and the commandline parameters are:

defrag.exe -p 26c -s 00000b64 -b c:

Now when I searched the MS website for the commandline arguments, I could
not found so many parameters for defrag.exe! Is this a virus?

I have already ran the following online malware checks:

MS Malicious Software Removal Tool
Symantec Security Check online
Computer Assocaite eTrust Antivirus Web Scanner

All of them say that all is fine!

I am geting more clueless....

 

[Pegasus \(MVP\)]

Hi again,

Although nobody has replied yet, I decided to post few more observation:

The process that runs is defrag.exe and the commandline parameters are:

defrag.exe -p 26c -s 00000b64 -b c:

Now when I searched the MS website for the commandline arguments, I could
not found so many parameters for defrag.exe! Is this a virus?

I have already ran the following online malware checks:

MS Malicious Software Removal Tool
Symantec Security Check online
Computer Assocaite eTrust Antivirus Web Scanner

All of them say that all is fine!

I am geting more clueless....

- Run msconfig.exe and check the tasks listed under the Startup tab.
- Open the Control Panel and check the tasks under the Task Scheduler.

 

[Guest]

- Run msconfig.exe and check the tasks listed under the Startup tab.
- Open the Control Panel and check the tasks under the Task Scheduler.

I checked the startup...and I know all the applications that are there, and
nothing is new there. (this problem started occuring since last 2 days).

In the Scheduled Tasks, there is nothing.

I have also checked HKLM\Software\Microsoft\Windows\curentversion\Run, and
it looks fine, no mention of Defrag.exe.

 

[Mac]

As a temporary solution until you figure out why it is auto-starting - just
rename defrag.exe

 

[Guest]

Thanks for your help, but I have a better temporary solution in hand:

I have installed ProcesGuard to let me know when this guys starts up, and I
have already strangled defrag.exe brutally when it wanted to run ;-)

But obviously I want to know the reason, as it is the 2nd instance that one
Microsoft process is trying to claim 100% cpu, and I am not at all happy
about it!

 

[Pegasus \(MVP\)]

This is unlikely to work because the WinXP system file
protection will immediately attempt to replace the file.

 

[Guest]

Some more ideas, please.

 

[Kerry Brown]

http://www.sysinternals.com/Utilities/ProcessExplorer.html

This may help give you a better idea what is happening. You need to figure
out what is starting the rogue processes. Do you have any scheduled tasks
enabled? What is the malware status of the computer?

There are more process and thread utilities here if the above doesn't help:

http://www.sysinternals.com/ProcessesAndThreadsUtilities.html

 

[Guest]

The malware status of the laptop looks great... have taken several opinions
including MS Malicious Software Removal Tool (as mentioned in my earlier
posts).

There are no scheduled tasks.

I am using ProcessExplorer, but it does not give any clue why defrag.exe is
starting.

I have used ProcessGuard to stop it from starting, but that is an interim
fix, not a solution.

Please help!

-S Laha

 

[Kerry Brown]

The MS Malicious Software Removal Tool only targets very specific malware.
Scan with the following programs in safe mode.

http://www.lavasoft.de/ free

http://www.spybot.info/en/index.html free

http://www.ewido.net/en/ free trial

Read the following link.

http://www.aumha.org/secure.htm

Check out some of the other utilities at
http://www.sysinternals.com/ProcessesAndThreadsUtilities.html

particularly Autoruns and Pmon.

 

[Guest]

The malware status is ok.

I have found out using ProcessExplorer that the defrag.exe is being fired by
svchost.exe and the commandline parameter is :

defrag.exe -p 26c -s 00000b64 -b c:

as mentioned before.

So I am still clueless.

Any help?

Thanks.

 

[Kerry Brown]

If you're absolutely sure about the malware then I'm out of ideas.

http://www.google.com/search?hl=en&q=defrag.exe+virus&btnG=Google+Search

 

[Bob I]

It's possibly the layout optimizer function attempting to tune up the
PC. Try running chkdsk /F and see if the issue resolves itself after that.

The malware status is ok.

I have found out using ProcessExplorer that the defrag.exe is being fired by
svchost.exe and the commandline parameter is :

defrag.exe -p 26c -s 00000b64 -b c:

as mentioned before.

So I am still clueless.

Any help?

Thanks.


:

 

[Guest]

I did Google, and checked manually each registry items form possible malware
entries, as the articles were suggesting...it was a lot of pain! But it lead
to nothing.

Suddenly I have found a strange solution:

I renamed 'defrag.exe' from system32, and WinXP immediately brought a new
one. Once this new file is there, I have not seen the defrag.exe popping up
again... and it is already 4 hours fo running! Was the old kid a rogue child
then?

-S Laha

It's possibly the layout optimizer function attempting to tune up the
PC. Try running chkdsk /F and see if the issue resolves itself after that.

 

[Bob I]

Possibly a corrupted defrag.exe I suppose. Good to hear you resolved it.

 

[Guest]

Yes, fingers crossed, but looks like the problem has got resolved!

Looks like I am learning more of WinXP internals due to the problems it
throws up!

Thanks to you all, for your support.

 

[Kerry Brown]

Glad you got it resolved.