Mysterious CPU usage...

[Captain O Hair]

I built my parents computer a few years back and it had XP on it. It has now been upgraded to windows 7 Ultimate 64-bit. It has been running into a strange issue that I have been unable to nail down. It will run ridiculously slow and be choppy, unresponsive, and overall not that great. It is bothersome because I am running the exact same core 2 duo e6750 proc in my own computer. They have an Intel DG33BU mobo with 6 GB of kingston RAM in it. There are 2x2GB and 2x1GB in it. It's an integrated graphics mobo. There are three hard drives, 2 SATA drives and one IDE drive (just disconnected it).

The processor will frequently run at 70-100 % usage but there are no processes to explain the cpu usage. here's an example of what I'm getting at.



That is just a capture of a minute moment of this behavior, but it is happening almost constantly. I had tried to find someone experiencing similar issues, and I was able to find a site that had a microsoft person helping out. they had them use some windows performance toolkit to diagnose what was being sent to the processor. I followed those instructions and I came up with this result.



It showed many calls to the ata and ide as well as the hal.dll. I don't know what all that means and what in particular was being called. However, I suspected that the old IDE hard drive was part of the problem and so I shut down the comp, unplugged that one, and it isn't doing this behavior constantly anymore. But if I fire up anything, the amount of CPU being used is always more than what the process list can tell me is being accounted for. My own computer does not have this problem and I run the same processor as they do. I have guessed the mobo as the problem, or some setting on the mobo, or some way that the OS is communicating with the hardware to be at fault here. The SATA drives are set up to run in IDE mode as opposed to AHCI, while mine are in AHCI. (dad installed windows 7 without consulting me first...) I wouldn't suspect this to be a great hindrance though, but just so it is noted.

So... I am baffled as to why this computer will have such unusually high CPU usage when there are not programs to account for that. Anyone have any ideas?

[Sansa]

Virus :P

[Captain O Hair]

...

have scanned... not really the answer I was looking for...

[JSLEnterprises]

Its actually a worm. pretty nasty one too.
Only way to clean would be to check each disk as a slave in another machine or use bootable antivirus media with latest definitions.
'Free' antivirus software will doubtfully be able to 'kill' it.


Also, I'd probably suspect the cause is because you downloaded a windows 7 install dvd via torrents

[madhatter256]

Yep. A virus/worm - all the same to me, simply the PC is infected.

Google BitDefender Rescue CD. Download it and boot off the CD. Make sure you are able to update it as it detects most network cards. Let it scan the whole PC. after it is done, google and download combofix and then run it.

[Captain O Hair]

Also, I'd probably suspect the cause is because you downloaded a windows 7 install dvd via torrents

First off, how would you know? Second, this is a legitimate copy of windows 7 ultimate that was purchased from the Microsoft Store. Don't paint me as some punk pirating kid too quickly.

I doubt it being a sort of worm or virus, because this has not been my experience, but this doesn't mean that it can't be such a thing. I will do scans with said programs and I will get back with results.

[Captain O Hair]

Yep. A virus/worm - all the same to me, simply the PC is infected.

Google BitDefender Rescue CD. Download it and boot off the CD. Make sure you are able to update it as it detects most network cards. Let it scan the whole PC. after it is done, google and download combofix and then run it.

I will do so and see if they are able to find anything. I'll get back with the results.

[Captain O Hair]

furhtermore... what evidence leads y'all to believe worm? just because it doesn't show up in task manager? the other image shows that it is sending in CPU interrupts a lot on the hal.dll, and ata ports. This tells me its a hardware issue. what makes you all believe it is a software virus? are there virus's out there that operate on this level?

Also, as I had mentioned I had unplugged the old IDE based hard drive. After having done so, it no longer seems to be having the problem. I thought it still was, but after it has been on for a while in a similar environment that the problem showed up under before, the symptoms don't appear to be there. Would this be the issue then? in which case, how can I prevent the computer from having this problem? Assuming of course that this is not a virus/worm....

[JackVancouverBC]

I can isolate one of the problems. Skype 5 is a huge problem since it's so bloated and it's already using CPU cycles in your screenshot.

If you can, probably find a brand-spanking new IDE cable if you're using an IDE hard drive for Windows 7. IDE cables that fault are the number one reason for hanging and CPU usage.

I'd switch to AHCI for your SATA drives. It's faster and it has nothing but benefits for SATA drives.

Also, the "dad installed without consulting" gives huge grounds that if you did not see the way he installed Windows, you may not have genuine windows. Run KB971033 to definitively see if you have legit windows. If after running it, and you restart to a black desktop, you were duped and somehow got pirated windows.

[3dfxrain]

I suspect part is making too many interrupt requests. Last time I had something like this, the hard drive controller made too many interrupt requests. Changed hard drive controller and CPU usage down.

[Captain O Hair]

I can isolate one of the problems. Skype 5 is a huge problem since it's so bloated and it's already using CPU cycles in your screenshot.

I think I took the screen shot whilst doing a webchat, can't remember... but yeah, that wouldn't help.

If you can, probably find a brand-spanking new IDE cable if you're using an IDE hard drive for Windows 7. IDE cables that fault are the number one reason for hanging and CPU usage.

That is a good idea, I hadn't thought of that. I think we'll probably just get a new SATA drive to prevent this issue entirely.

I'd switch to AHCI for your SATA drives. It's faster and it has nothing but benefits for SATA drives.

I really do want to switch the computer over to AHCI for the SATA drives but it was my understanding that it is either a really involved driver redoing process involving a repair install kind of thing. If there is an easier way than what I know of on windows 7, I am all ears.

Also, the "dad installed without consulting" gives huge grounds that if you did not see the way he installed Windows, you may not have genuine windows. Run KB971033 to definitively see if you have legit windows. If after running it, and you restart to a black desktop, you were duped and somehow got pirated windows.

I would support the argument you are making, except that I had aqcuired two copies of windows 7 ultimate from a microsoft employee in a legitimate deal, came in the actual retail packaging, has a real microsoft certificate of authenticity, and a two legitimate license numbers. I am running the other copy that was acquired and it passes as genuine. Also, that KB971033 is already installed on their computer, I just checked.

I was making reference to how my father did not know specifically how to configure the SATA drives as ACHI vs IDE. He didn't check with me first on what to change from XP to windows 7 in the mobo BIOS. I thank you kindly for your thoughts and ideas. I guess I also understand the concern with pirated windows. I guess I just don't think about it since I live in the area with Microsoft campus and have no reason to run pirated windows, or have ever had a need to because of my connections.

[Captain O Hair]

I suspect part is making too many interrupt requests. Last time I had something like this, the hard drive controller made too many interrupt requests. Changed hard drive controller and CPU usage down.

I had kind of suspected something was wonky with the hard drives given what was sending in the interrupts to the CPU, which prompted me to remove the IDE drive from the system. Perhaps this intel IDE controller is just not that great on this particular motherboard. I should've gotten him the gigabyte board back when I built it I guess...

It will be all SATA drives from here on out.

[mike1038]

Also, I'd probably suspect the cause is because you downloaded a windows 7 install dvd via torrents

So what makes you suspect that ????
Please tell.

[JSLEnterprises]

So what makes you suspect that ????
Please tell.

Because i've come accross this sort of problem previously on a few occasions. and all were running non legitimate copies, thats what made me assume that.


To the OP: I apologise for that comment, but back to topic.

When the machine was running xp, im assuming it was running off that IDE drive? Was the install of windows 7 a fesh clean install or was it an "upgrade" from the existing XP installation?

And i've come accross a few worms/virii while my years of being a tech that attack low level dll's to exploit hardware. Just the other day I cleaned out an office computer (running xp) that had a virus that targeted the realtek ac97 codec controller. After cleaning out the virus and reinstalling drivers, and corrupted system files, I had to remove ~950 instances of the unkown device listing from when it was trying to 'install' itself continuously (devmgr_show_nonpresent_devices val=1). While it was infected it actually showed very similar results as yours did, Continually 'hitting' the drive that the os resided on (pata based as well). Though the amount of interrupts was much higher than yours, and made the machine almost completely unuseable.

[Captain O Hair]

Because i've come accross this sort of problem previously on a few occasions. and all were running non legitimate copies, thats what made me assume that.

No harm, no foul. As per reasons stated before, I don't personally consider this option as I live so close to microsoft and can acquire legitimate windows without much hassle. I should expand my mind a bit as this should not surprise me much consider I know many people who run illegal copies of windows...

When the machine was running xp, im assuming it was running off that IDE drive? Was the install of windows 7 a fesh clean install or was it an "upgrade" from the existing XP installation?

My mind is fuzzy since this has been 3 years ago that this computer was built but it stands in my mind that the old IDE drive was taken from the old computer before this one to be used as the data drive for the new win xp install on the new computers SATA drive. I don't believe the OS has ever been on the IDE drive in this new mobo/CPU/RAM combo before.

As for the install, I believe I recall telling my dad to use the clean install method as he isn't useless with computers, but he isn't familiar with things like AHCI etc. It sticks out in my mind as well that he is also in the clean install camp as opposed to the upgrade camp for the same reasons as myself. I should check with him to see what he did though.

And i've come accross a few worms/virii while my years of being a tech that attack low level dll's to exploit hardware. Just the other day I cleaned out an office computer (running xp) that had a virus that targeted the realtek ac97 codec controller. After cleaning out the virus and reinstalling drivers, and corrupted system files, I had to remove ~950 instances of the unkown device listing from when it was trying to 'install' itself continuously (devmgr_show_nonpresent_devices val=1). While it was infected it actually showed very similar results as yours did, Continually 'hitting' the drive that the os resided on (pata based as well). Though the amount of interrupts was much higher than yours, and made the machine almost completely unuseable.

In all my years of working with computers, I have not been aware of such things, and I thought I was pretty savy with computers. This is something I must learn more about. To be honest, the windows performance tool to check for interrupt requests is new to me, but a very cool powerful tool I wish I knew more about. If this is some sort of virus like that, it is my first encounter with this particular species of virii. If I had more time here, I would take a look at the drive and see what is on there, unfortunately my time is limited in the state and I head out of town again on jan 4th.

The problem doesn't appear to manifest itself anymore now that the IDE drive is out of the computer. so could this still be a virus that was residing on the old drive that can no longer send requests to the CPU since it is no longer in the computer? Or would such a thing have copied itself to the windows drive making this a hardware issue?

on a related note... i wish I could remember how to run that tool again to see what is going on now that the drive is removed. Also... it seemed that the problem before was linked to like solitaire of all things... When it was open and you were playing, the CPU usage was high like i had showed. but when I would close that program, it no longer showed up. I had thought that perhaps the computer was considered "idle" when playing solitaire because microsoft knew that people weren't being productive whilst playing solitaire, so it would do system tasks and something wonky was going on with that.... but who knows...