CPU usage spikes every 5 seconds

Only when online, CPU usage spikes to 40%-80% every 5 seconds. The spike
half-width is about 1-2 seconds. This problem has gone away twice for a few
days, but then returned. A malware forum did not respond to my question,
indicating that it was unknown to forum users. McAfee, CounterSpy, MBAM and
HijackThis can find no problems.

Please give us a link to the forum thread where you posted your HijackThis
log for review by an expert in such matters.

edpb wrote:
> Only when online, CPU usage spikes to 40%-80% every 5 seconds. The spike
> half-width is about 1-2 seconds. This problem has gone away twice for a
> few
> days, but then returned. A malware forum did not respond to my question,
> indicating that it was unknown to forum users. McAfee, CounterSpy, MBAM
> and
> HijackThis can find no problems.

This goes to my post in Castle Cops Trend Micro Hijackthis logs:

http://www.castlecops.com/modules.ph...topic&t=226619

Thanks for taking an interest -- sorry for the delay -- it took a while to
find it.

"PA Bear [MS MVP]" wrote:

> Please give us a link to the forum thread where you posted your HijackThis
> log for review by an expert in such matters.
>
> edpb wrote:
> > Only when online, CPU usage spikes to 40%-80% every 5 seconds. The spike
> > half-width is about 1-2 seconds. This problem has gone away twice for a
> > few
> > days, but then returned. A malware forum did not respond to my question,
> > indicating that it was unknown to forum users. McAfee, CounterSpy, MBAM
> > and
> > HijackThis can find no problems.
>
>

I see two (2) MBAM logs in your post but no HijackThis log.

Have you read the appropriate Announcements and "Stickies" here? =>
http://www.castlecops.com/f67-Trend_...This_Logs.html

Especially this one =>
http://www.castlecops.com/t102301-Hi...e_Posting.html

edpb wrote:
> This goes to my post in Castle Cops Trend Micro Hijackthis logs:
>
> http://www.castlecops.com/modules.ph...topic&t=226619
>
> Thanks for taking an interest -- sorry for the delay -- it took a while
> to
> find it.
>
> "PA Bear [MS MVP]" wrote:
>> Please give us a link to the forum thread where you posted your
>> HijackThis
>> log for review by an expert in such matters.
>>
>> edpb wrote:
>>> Only when online, CPU usage spikes to 40%-80% every 5 seconds. The
>>> spike
>>> half-width is about 1-2 seconds. This problem has gone away twice for a
>>> few
>>> days, but then returned. A malware forum did not respond to my
>>> question,
>>> indicating that it was unknown to forum users. McAfee, CounterSpy, MBAM
>>> and
>>> HijackThis can find no problems.

I have finished the Malware Removal and Prevention process again and I have
run HijackThis and uploaded the log (at least I think I did) to Castle Cops
HijackThis Logs. Let's see what happens. Thank you for all your help -- I
seem to need hand holding.

"PA Bear [MS MVP]" wrote:

> I see two (2) MBAM logs in your post but no HijackThis log.
>

Link to your thread, please?

edpb wrote:
> I have finished the Malware Removal and Prevention process again and I
> have
> run HijackThis and uploaded the log (at least I think I did) to Castle
> Cops
> HijackThis Logs. Let's see what happens. Thank you for all your help --
> I
> seem to need hand holding.
>
> "PA Bear [MS MVP]" wrote:
>
>> I see two (2) MBAM logs in your post but no HijackThis log.

Just found your reply. My HijackThis log is at

http://www.castlecops.com/modules.ph...topic&t=226761

Thank you again -- There have been no replies on Castle Cops -- Ed

"PA Bear [MS MVP]" wrote:

> Link to your thread, please?
>
> edpb wrote:
> > I have finished the Malware Removal and Prevention process again and I
> > have
> > run HijackThis and uploaded the log (at least I think I did) to Castle
> > Cops
> > HijackThis Logs. Let's see what happens. Thank you for all your help --
> > I
> > seem to need hand holding.
> >
> > "PA Bear [MS MVP]" wrote:
> >
> >> I see two (2) MBAM logs in your post but no HijackThis log.
>
>

To PA Bear et al: I'm surprised that no one has recognized the CPU usage
pattern that I described. I think that the furious activity that occurs
every five seconds but only when I'm connected indicates that my machine has
been hijacked into one of those botnet things. It seems that the only way to
solve this problem is to switch to a new computer. I know that copying even
one file from my present computer to a new one can copy the problem into the
new computer as well. So, I would transfer data one folder at a time until
the spikes come back or until all my data is transferred. Wish me luck. edpb

> To PA Bear et al: I'm surprised that no one has recognized the CPU usage
> pattern that I described.

Just because no one's replied to your CastleCops threads doesn't mean that
no one's recognized this pattern. (See below.)

Newgroup thread history:
http://groups.google.com/group/micro...38dc37467859ef

Which was installed first, IE7 or WinXP SP3?

Had you fully disabled all McAfee processes and CounterSpy before you
installed IE7 and/or WinXP SP3?

Tip: Uninstall Yahoo Toolbar and Picasa via Add/Remove Programs, reboot, and
see if the behavior persists.

=> Does the behavior persist if you start IE7 in No Add-ons mode? To start
IE7 in No Add-ons mode:

1. Right-click on the blue IE desktop icon and select Start without Add-ons;
or

2. Start | (All) Programs | Accessories | System Tools | Internet Explorer
(No add-ons).

Troubleshooting and Internet Explorer’s (No Add-ons) Mode:
http://blogs.msdn.com/ie/archive/2006/07/25/678113.aspx

=> Does the behavior persist if you Reset IE7 Advanced settings (RIES)?
http://support.microsoft.com/kb/923737 <= Read before using!

=> Does the behavior persist if you boot into Safe Mode with Networking?
[Careful! Only remain in Safe Mode just long enough to test!]

===

About your CastleCops posting:

Your first post at CastleCops HJT Logs forum:
http://www.castlecops.com/modules.ph...topic&t=226619

=> Why did you post an MBAM log, not a HJT log? [If you'd posted this in
the HJT Logs forum at the site where I'm an Administrator, I would have
deleted your post of out of hand.]

=> Did you read
http://www.castlecops.com/t102301-Hi...e_Posting.html
?? I don't think so.

=> Did you read and follow the instructions in
http://www.castlecops.com/t213307-5_... _Topic.html?
I don't think so.

=> Why did you begin the new thread 7 days after your first one:
http://www.castlecops.com/postitle226761-0-0-.html? (I will point out that
your HJT log in the 3rd post here is all but illegible because you hadn't
unchecked Notepad: Format | Word wrap <=this option.)

All such forums are extremely busy. I'd suggest trying a few others which
may not be so swamped:
http://spywarehammer.com/simplemachi...php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30

NB: Read all of the "Before you post your log..." &c. sticky posts at the
top of the forum page and follow all instructions to the letter!
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

edpb wrote:
> To PA Bear et al: I'm surprised that no one has recognized the CPU usage
> pattern that I described. I think that the furious activity that occurs
> every five seconds but only when I'm connected indicates that my machine
> has
> been hijacked into one of those botnet things. It seems that the only way
> to solve this problem is to switch to a new computer. I know that copying
> even one file from my present computer to a new one can copy the problem
> into the new computer as well. So, I would transfer data one folder at a
> time until the spikes come back or until all my data is transferred. Wish
> me luck. edpb

I'm very sorry to have made so many mistakes in my postings.
I read all the instructions that I could find on the Castle
Cops site. To the best of my ability, I followed all
instructions. Mistakes were due to ignorance and confusion,
even though the instructions seemed clear. Thank you for all
the tips and suggestions. I will try everything and report
back. edpb

"PA Bear [MS MVP]" wrote:

> > To PA Bear et al: I'm surprised that no one has recognized the CPU usage
> > pattern that I described.
>
> Just because no one's replied to your CastleCops threads doesn't mean that
> no one's recognized this pattern. (See below.)
>
> Newgroup thread history:
> http://groups.google.com/group/micro...38dc37467859ef
>
> Which was installed first, IE7 or WinXP SP3?
>
> Had you fully disabled all McAfee processes and CounterSpy before you
> installed IE7 and/or WinXP SP3?
>
> Tip: Uninstall Yahoo Toolbar and Picasa via Add/Remove Programs, reboot, and
> see if the behavior persists.
>
> => Does the behavior persist if you start IE7 in No Add-ons mode? To start
> IE7 in No Add-ons mode:
>
> 1. Right-click on the blue IE desktop icon and select Start without Add-ons;
> or
>
> 2. Start | (All) Programs | Accessories | System Tools | Internet Explorer
> (No add-ons).
>
> Troubleshooting and Internet Explorer’s (No Add-ons) Mode:
> http://blogs.msdn.com/ie/archive/2006/07/25/678113.aspx
>
> => Does the behavior persist if you Reset IE7 Advanced settings (RIES)?
> http://support.microsoft.com/kb/923737 <= Read before using!
>
> => Does the behavior persist if you boot into Safe Mode with Networking?
> [Careful! Only remain in Safe Mode just long enough to test!]
>
> ===
>
> About your CastleCops posting:
>
> Your first post at CastleCops HJT Logs forum:
> http://www.castlecops.com/modules.ph...topic&t=226619
>
> => Why did you post an MBAM log, not a HJT log? [If you'd posted this in
> the HJT Logs forum at the site where I'm an Administrator, I would have
> deleted your post of out of hand.]
>
> => Did you read
> http://www.castlecops.com/t102301-Hi...e_Posting.html
> ?? I don't think so.
>
> => Did you read and follow the instructions in
> http://www.castlecops.com/t213307-5_... _Topic.html?
> I don't think so.
>
> => Why did you begin the new thread 7 days after your first one:
> http://www.castlecops.com/postitle226761-0-0-.html? (I will point out that
> your HJT log in the 3rd post here is all but illegible because you hadn't
> unchecked Notepad: Format | Word wrap <=this option.)
>
> All such forums are extremely busy. I'd suggest trying a few others which
> may not be so swamped:
> http://spywarehammer.com/simplemachi...php?board=10.0,
> http://forums.spybot.info/forumdisplay.php?f=22,
> http://aumha.net/viewforum.php?f=30
>
> NB: Read all of the "Before you post your log..." &c. sticky posts at the
> top of the forum page and follow all instructions to the letter!
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
> edpb wrote:
> > To PA Bear et al: I'm surprised that no one has recognized the CPU usage
> > pattern that I described. I think that the furious activity that occurs
> > every five seconds but only when I'm connected indicates that my machine
> > has
> > been hijacked into one of those botnet things. It seems that the only way
> > to solve this problem is to switch to a new computer. I know that copying
> > even one file from my present computer to a new one can copy the problem
> > into the new computer as well. So, I would transfer data one folder at a
> > time until the spikes come back or until all my data is transferred. Wish
> > me luck. edpb
>
>