Vista ultimate excessive cpu usage

[paudashlake]

I just bought Vista Ultimate this morning.  Installed just fine.  With one problem....  Even idle, it is always using at least 25% cpu.  The program using it is always different.  But most of the time is it svchost.  Any idears?

by the way, i have an amd phenom quad core 2.3ghx, so it should be using much less.

[computeruler]

 
http://www.technibble.com/how-to-fix-svchost-using-100-cpu-memory-leak/

[paudashlake]

Well, that says for xp only.  I have vista.

[computeruler]

All I could find was something about uninstalling your antivirus
doubt this will help but w/e
http://www.somelifeblog.com/2007/05/windows-xp-svchostexe-100-cpu-high.html

[Broni]

Clean install, or upgrade?

Please, post some computer info:
- processor type, amount of RAM (hold Windows logo key, hit Pause/Break key)
- hard drive size/free space (open "My Computer", right click on hard drive letter, click "Properties")
- security programs in use (antivirus, firewall)

[computeruler]

Did you put your mouse over the spec thing

[paudashlake]

Clean install. 

amd phenom 9600 quad core 2.3ghz

4.00gb ram

431 of 465gb hdd space is free

Comodo firewall, avast antivirus, mbam, sbs@d

[Broni]

Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
by clicking on Download HijackThis Installer
Install, and run it.
Post HijackTHis log.

[paudashlake]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:09:40 PM, on 2/28/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\GIGABYTE\I-Cool\icool.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\Windows\System32\dvmurl.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O13 - Gopher Prefix:
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 4287 bytes


There you go.

[Broni]

I see nothing out of order.
Regarding Comodo...are you running firewall only, or a whole suite?

[paudashlake]

nope, just the firewall

[Broni]

Download Process Explorer: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Unzip ProcessExplorer.zip, and double click on procexp.exe to run the program.
Go File>Save As, and save the report as Procexp.txt.
Attach the file to your next reply.

[paudashlake]

Process   PID   CPU   Description   Company Name
System Idle Process   0   64.18      
 Interrupts   n/a      Hardware Interrupts   
 DPCs   n/a   0.38   Deferred Procedure Calls   
 System   4   0.38      
  smss.exe   528         
csrss.exe   592         
wininit.exe   628         
 services.exe   676         
  svchost.exe   900   16.23      
  svchost.exe   968         
  cmdagent.exe   1072         
  svchost.exe   1116         
  svchost.exe   1132         
  Ati2evxx.exe   1184         
   Ati2evxx.exe   1796         
  svchost.exe   1220   0.76      
   audiodg.exe   1440         
  svchost.exe   1288   10.57      
   dwm.exe   2212   0.76   Desktop Window Manager   Microsoft Corporation
   WUDFHost.exe   3144         
  svchost.exe   1304   0.76      
   taskeng.exe   2168      Task Scheduler Engine   Microsoft Corporation
   taskeng.exe   2436         
   wuauclt.exe   5376      Windows Update Automatic Updates   Microsoft Corporation
  SLsvc.exe   1548         
  svchost.exe   1652         
  aswUpdSv.exe   1960         
  ashServ.exe   2004         
  spoolsv.exe   1364         
  svchost.exe   1352         
  McSACore.exe   2708         
   rundll32.exe   2764         
  svchost.exe   2792         
  RichVideo.exe   2884         
  ashMaiSv.exe   3132         
  ashWebSv.exe   3180         
  svchost.exe   1452         
  VSSVC.exe   4536         
  svchost.exe   5312         
  TrustedInstaller.exe   3556         
  SearchIndexer.exe   1396   0.38      
 lsass.exe   688         
 lsm.exe   696         
csrss.exe   640         
winlogon.exe   812         
explorer.exe   2332   2.27   Windows Explorer   Microsoft Corporation
 RtHDVCpl.exe   2728      HD Audio Control Panel   Realtek Semiconductor
 ashDisp.exe   520      avast! service GUI component   ALWIL Software
 aim6.exe   2088      AIM   AOL LLC
  aolsoftware.exe   1680      AOL   AOL LLC
 firefox.exe   4716   2.64   Firefox   Mozilla Corporation
 procexp.exe   5380   0.38   Sysinternals Process Explorer   Sysinternals - www.sysinternals.com
MOM.exe   1256      Catalyst Control Center: Monitoring program   Advanced Micro Devices Inc.
 CCC.exe   4072      Catalyst Control Centre: Host application   ATI Technologies Inc.
ICool.exe   2836         
HijackThis.exe   2404         
 notepad.exe   5584      

there you go.

[Broni]

Can you attach .txt file?
It's easier to read columns in Notepad, then in your post.

[paudashlake]

yeah, sure.

[attachment deleted by admin]