Fix High CPU Usage on Windows XP - Troubleshooting Guide

[jai6638]

Hey... i noticed that my cpu usage is constantly at 100% thus increasing my CPU temperatures.. do u guys know what the problem could be? I've got some some toshiba junk installed that came along with my laptop but i don't think that's what's causing the problem.. Fyi, my OS is Windows Xp Home

Hijackthis log :

Logfile of HijackThis v1.99.1
Scan saved at 11:39:57 AM, on 3/18/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\gearsec.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\00THotkey.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\System32\TDispVol.exe
C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
C:\Program Files\Efficient Networks\SpeedStream DSL\SPDSTRM.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DC++\DCPlusPlus.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jai\Desktop\Downloaded Internet Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 03
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [cPadFstR] C:\Program Files\Synaptics\SynTP\CPad\cPadFstR.Exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DSL Monitor] C:\Program Files\Efficient Networks\SpeedStream DSL\SPDSTRM.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://install.wildtangent.com/Acti...iveLauncher.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqna/downloads/sysinfo.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://webcams.mtu.edu/webcam7/AxisCamControl.ocx
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yah...utocomplete.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/downloa...abasetup156.cab
O16 - DPF: {F229AB32-7BF9-4225-B78F-B4680AE6FC23} (Snapfish File Upload ActiveX Control) - http://www.snapfish.com/SnapfishUpload.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DEBC1019-FA37-4484-80FC-40FC6E022E1A}: NameServer = 195.229.241.222 213.42.20.20
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: ISEXEng - Unknown owner - C:\WINDOWS\System32\angelex.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Tmesbs32 (Tmesbs) - Unknown owner - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe" /Service (file missing)
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\UltraVNC\winvnc.exe" -service (file missing)
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

thanks

 

[Pengwuino]

Processors are suppose to run at 100%. Are you simply assuming the temperature is going up or do you have sensor programs verifying this. The whole idea of a fast CPU is to get operations done as fast as possible so once instructions are given to it, it will immediately use as much of its processing power (basically 100%) to get the operation done as quick as possible.

 

[chroot]

Pengwuino,

Incorrect. A laptop's processor is intended to run slowly during periods of inactivity, in order to save battery life. When running at full-speed, a processor uses more power, and drains the battery more quickly. Most users don't need their processor running full-blast all the time.

jai6638,

Are you suggesting that your fan is always on, even when the processor is not being fully utilized? Does the Task Manager not show any processes that are nailing the CPU? If the CPU utilization is 100%, you should see one or more processes on the list using up all of it.

What is the "SpeedFan" process? I personally use a program called SpeedSwitch XP to control my processor's speed, and it works quite well. Perhaps SpeedFan is a similar product, and it's misconfigured.

- Warren

 

[jai6638]

I realized that a process called "spoolsv.exe" is using my cpu! a quick google search indicated it is related to printers and that it can be used as a backdoor.. not sure if I should delete it? what do u think ? after having closed it, it starts again after a few min and cpu usage again shoots up..

Speedfan is like Speedswitch XP. I use to detect my cpu temps..

thanks much for your help guys.. appreciate it :)

 

[PerennialII]

I realized that a process called "spoolsv.exe" is using my cpu! a quick google search indicated it is related to printers and that it can be used as a backdoor.. not sure if I should delete it? what do u think ? after having closed it, it starts again after a few min and cpu usage again shoots up..

Speedfan is like Speedswitch XP. I use to detect my cpu temps..

thanks much for your help guys.. appreciate it :)

Deleting the file will likely cause problems with windows ... I'd investigate whether it's infected using an antivirus app and other than that see that there isn't something weird going on with the spooler, like a huge chunk of print jobs lurking somewhere...

 

[chroot]

Indeed, make sure the spooler is not desperately trying to print something on a printer that doesn't exist. Open the printer up under the control panel and kill any waiting jobs. It would not hurt to run an anti-spyware program like AdAware or SpyBot just to make sure you have no malware.

- Warren

 

[russ_watters]

Indeed, make sure the spooler is not desperately trying to print something on a printer that doesn't exist.

That would be my guess. I have the same problem occasionally on my network.

Open the printer up under the control panel and kill any waiting jobs.

Trouble-is, once *supposedly* spooled, the job will no longer show up in the print manager. Rebooting both the compuer printed from and the networked computer printed to and cycling the power on the printer generally fixes this.

 

[Pengwuino]

Oh its a laptop... that still doesn't make sense. It would run 100% on a laptop or a desktop because it wants to get the operation done as soon as possible. It just goes to 0% once hte operation is done.

 

[chroot]

Oh its a laptop... that still doesn't make sense. It would run 100% on a laptop or a desktop because it wants to get the operation done as soon as possible. It just goes to 0% once hte operation is done.

You're thinking about the wrong number. You're thinking about the utilization of the CPU, which is the number displayed in the Windows Task Manager. When that number is 100%, it means the CPU is not idling at all -- it's running one useful instruction after another, with no waiting in between.

We're talking about the processor speed, i.e. how fast it runs each instruction. The processor in a laptop can be run at a number of different speeds. When the user is just doing email or some other computationally-inexpensive stuff, there's no reason to run every instruction as fast as possible, since there aren't many instructions to be run anyway. The processor is set at to its low speed setting. It'll take a bit longer to run each instruction, but it'll use a lot less power. Since the user's not putting much demand on the processor, she'll never even notice.

In other words, laptop processors can run at, e.g. 1.5 GHz or 3 GHz. You don't need a 3 GHz processor if all you're doing is emailing; 1.5 GHz is plenty fast enough, and uses less power. On the other hand, when you're playing a very computationally-intensive game, the system realizes you're overwhelming the processor at its lower speed, and bumps it up to its full speed, 3 GHz.

- Warren

 

[Pengwuino]

Well i thought the question was why was utilization at 100%. But at 1.5ghz, wouldn't it be using 50% of the power then a 3.0ghz, thus canceling its low-power requirement with a longer-processing time?

 

[chroot]

Pengwuino,

If the processor is in a low-speed state, but its utilization is 100% for an extended period of time, it will increase its speed.

A 3.0 GHz processor only half-utilized will show 50% utilization on the Task Manager. A 1.5 GHz processor performing the same number of total operations per second will show 100% on the Task Manager.

- Warren

 

[Pengwuino]

Yah but what's the power usage comparison

 

[chroot]

The CPU uses more power when running at full-speed, even if it's doing nothing but idling.

- Warren

 

[jai6638]

Trouble-is, once *supposedly* spooled, the job will no longer show up in the print manager. Rebooting both the compuer printed from and the networked computer printed to and cycling the power on the printer generally fixes this

I'll try that... I'm currently on vacation but back home, i was having problems with my printer so i had a lot of print tasks queued.. However, I am pretty sure that i deleted all of them from my print queue... don't know how they could get "spooled"...

It would not hurt to run an anti-spyware program like AdAware or SpyBot just to make sure you have no malware.

used spybot and adaware but it didn't help..

Thanks much..

 

[Pengwuino]

The CPU uses more power when running at full-speed, even if it's doing nothing but idling.

- Warren

But if its idling... its not doing anything... so how is it using power :D

 

[chroot]

But if its idling... its not doing anything... so how is it using power :D

Is this a serious question? Do you need a serious answer, or are you just kidding me?

- Warren

 

[jai6638]

so any ideas as to what i could do to fix the problem as the spoolsv.exe process starts again every time i restart my computer?

I ran adaware,spybot, norton antivirus 2005 but it didnt help.. i checked to make sure that there were no printer jobs in queue...

 

[russ_watters]

so any ideas as to what i could do to fix the problem as the spoolsv.exe process starts again every time i restart my computer?

I ran adaware,spybot, norton antivirus 2005 but it didnt help.. i checked to make sure that there were no printer jobs in queue...

Try deleting and reinstalling your printer drivers.

 

[Chronos]

Footnote to above. Reboot before reinstalling printer drivers

 

[TsunamiJoe]

first of all, delete nortan antivirus lol that is the worst program I've ever seen in my life - but here's my suggestion

you say your using xp - so press ctrl alt dlt then click the username column so that your username is all you see - then system after it, look through the programs that are loaded up under your username and delete them - also just a brief note, some important ones that load up under your username are explorer(not IE, this is your shell), rundll32(though this can be taken out, usualy not a problem causer)

now also get a program from codestuff, called starter - it displays everything that loads up with your computer, and take stuff off that isn't associated with the c://windows folder (unless you know what it is and use it) also just a sort of extra files named packager, back-to-web, download-to-home, ebatesmoemoneymaker0, and files similiarly named are usualy adware, that most programs checking for adware don't recognise

also get a registry mechanic - most good ones cost money, but often offer a trial - download.com is a good place - also i use a program called registry mechanic of which i have...fixed, which is a beautiful program that will solve any sort of virus and such sorts of problems

also just to wonder, how come your laptop has a printer installed on it, do you just hook it up to your one at home? and also is that printer of which is installed in it new?

||||||

also just to reinforce and introduce new statements about processors -

no matter the computer, unless being overclocked(not encouraged in my opinion), the cpu will run at 0 (usualy its at about 3-7% just to keep explorer, or any screensaver running) then when you start up a program, especialy on xp, it will assign a certain amount of cpu power to that program based on its priority level, usualy set at medium, of course its a semi differint story if you have hyper threading