WinXP P95 slowdown - Page 2

flava · 2003-12-25, 19:59

Try to stop the internet connection, PPP programs (like Emule) and the antivirus. Is that phantom process still present? Hope it helps.

lpmurray · 2003-12-25, 22:22

I was wondering whats the image name using windows task manager under the Processes tab.
I sometimes have explorer.exe doing the samething (if I try to delete a file that won't delete) explorer.exe goes crazy and steals all the cpu cycles. if its that you can kill that process then start a new explorer.exe under File... New Task. Also if click on start then run then type msconfig. It will open up.
Hope it helps
Larry

dsouza123 · 2003-12-26, 02:22

Try running Win XP in safe mode and check it again.
There will be less processes running.

You can get into safe mode using the F8 key during boot up.

sgrupp · 2003-12-26, 13:39

Sure enough, in Safe Mode the rogue task, whatever it is, disappears and P95 gets>90% of the CPU cycles. McAfee and Noadware have not removed whatever it is. When I reboot out of Safe Mode, I'm back to P95 getting 20% of the CPU time.

smh · 2003-12-27, 12:45

try msconfig (start/run/msconfig) or any other such tool to see what programs are loaded during startup.

lycorn · 2003-12-27, 12:51

It looks like a bit of brute force is required.
You could try to run msconfig and identify the several programs that are load and run at a normal start up.
Then compare with the info you get from Task Info about the rogue thread, on the lower right hand side of the screen. Try to identify there the name of the executable.
On msconfig Startup tab, uncheck the program or programs you have identified as guilty.
You will also have to edit the registry to definitely get rid of the thing. Use the search function to locate the references to the undesired program and delete them.
I have used this method to get rid of some malicious code that was affecting my machine a couple of months ago, producing the same effects you are describing. It took me a while, but I eventually cured the problem without having to reinstall Windows or formatting the HD.

sgrupp · 2003-12-28, 15:39

Still no luck.

To recap, there is a process called System that is using 80% of my CPU time. It is not there when I boot Safe Mode. If I stop it, P95 gets all of the CPU time (and there are no obvious ill effects).

It loads as a service, since it is still there even if I uncheck evey box under startup in msconfig. Mcafee, Noadware and SpyKiller have not found it.

Task Info shows this System process as having many threads (34-35, with the last one being the one that uses all the CPU time). I dont see any info in the information pane that points to what program or executable it is. There is a reference to LCASS.EXE.

sgrupp · 2003-12-28, 15:45

Oops I mean LSASS.exe, not LCASS.EXE

nfortino · 2003-12-28, 16:31

First, do a search for LSASS.exe (remember to search hidden and system folders) and find out everything you can about the program. Also, if you are running XP, you can stop a service with msconfig under the service tab, but you will have the problem of choosing the correct one. With any luck, it will be obvious from the information you found from the search.

Joe O · 2003-12-28, 18:35

lsass - lsass.exe - Process Information
Process File: lsass or lsass.exe
Process Name: Local Security Authority Service
Description: The Windows Local Security Authority Server Process Handles Windows Security Mechanisms. It verifies the validity of user logons to your PC/Server .Technically it generates the process that is responsible for authenticating users for the Winlogon service.
Company: Microsoft Corp.
System Process: Yes
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
Common Errors: N/A

Joe O · 2003-12-28, 18:48

Windows\System32\lsass.exe
Created/Modified Aug28 2002 9:00PM
11,776 bytes
12,288 bytes on disk
Version 5.1.2600.1106

Right click on the file, then left click on properties and compare your info to this taken on a "clean" version of Windows/XP Home.

2003-12-25, 22:22	#13
lpmurray Sep 2002 89 Posts	I was wondering whats the image name using windows task manager under the Processes tab. I sometimes have explorer.exe doing the samething (if I try to delete a file that won't delete) explorer.exe goes crazy and steals all the cpu cycles. if its that you can kill that process then start a new explorer.exe under File... New Task. Also if click on start then run then type msconfig. It will open up. Hope it helps Larry Last fiddled with by lpmurray on 2003-12-25 at 22:23

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
WTF ??? P-1 slowdown	PageFault	Software	2	2012-03-01 21:53
mfaktc slows on WinXP after about an hour	Christenson	GPU Computing	5	2011-05-27 21:47
Weird TF Behavior Prime95 64 bit v24.13, WinXP 64	RMAC9.5	Software	11	2009-03-17 13:01
Prime95 create Local Disk (Z:) on WinXP?	Unregistered	Software	3	2005-02-05 16:51
crazy WinXP scheduling	stippix	Software	0	2004-04-22 08:55

2003-12-25, 19:59	#12
flava Feb 2003 2×59 Posts	Try to stop the internet connection, PPP programs (like Emule) and the antivirus. Is that phantom process still present? Hope it helps.

2003-12-26, 02:22	#14
dsouza123 Sep 2002 2×331 Posts	Try running Win XP in safe mode and check it again. There will be less processes running. You can get into safe mode using the F8 key during boot up.

2003-12-26, 13:39	#15
sgrupp Dec 2003 19 Posts	Sure enough, in Safe Mode the rogue task, whatever it is, disappears and P95 gets>90% of the CPU cycles. McAfee and Noadware have not removed whatever it is. When I reboot out of Safe Mode, I'm back to P95 getting 20% of the CPU time.

2003-12-27, 12:45	#16
smh "Sander" Oct 2002 52.345322,5.52471 29×41 Posts	try msconfig (start/run/msconfig) or any other such tool to see what programs are loaded during startup.

2003-12-27, 12:51	#17
lycorn "GIMFS" Sep 2002 Oeiras, Portugal 10111000001₂ Posts	It looks like a bit of brute force is required. You could try to run msconfig and identify the several programs that are load and run at a normal start up. Then compare with the info you get from Task Info about the rogue thread, on the lower right hand side of the screen. Try to identify there the name of the executable. On msconfig Startup tab, uncheck the program or programs you have identified as guilty. You will also have to edit the registry to definitely get rid of the thing. Use the search function to locate the references to the undesired program and delete them. I have used this method to get rid of some malicious code that was affecting my machine a couple of months ago, producing the same effects you are describing. It took me a while, but I eventually cured the problem without having to reinstall Windows or formatting the HD.

2003-12-28, 15:39	#18
sgrupp Dec 2003 13₁₆ Posts	Still no luck. To recap, there is a process called System that is using 80% of my CPU time. It is not there when I boot Safe Mode. If I stop it, P95 gets all of the CPU time (and there are no obvious ill effects). It loads as a service, since it is still there even if I uncheck evey box under startup in msconfig. Mcafee, Noadware and SpyKiller have not found it. Task Info shows this System process as having many threads (34-35, with the last one being the one that uses all the CPU time). I dont see any info in the information pane that points to what program or executable it is. There is a reference to LCASS.EXE.

2003-12-28, 15:45	#19
sgrupp Dec 2003 19 Posts	Oops I mean LSASS.exe, not LCASS.EXE

2003-12-28, 16:31	#20
nfortino Nov 2003 3×5×11 Posts	First, do a search for LSASS.exe (remember to search hidden and system folders) and find out everything you can about the program. Also, if you are running XP, you can stop a service with msconfig under the service tab, but you will have the problem of choosing the correct one. With any luck, it will be obvious from the information you found from the search.

2003-12-28, 18:35	#21
Joe O Aug 2002 3·5²·7 Posts	lsass - lsass.exe - Process Information Process File: lsass or lsass.exe Process Name: Local Security Authority Service Description: The Windows Local Security Authority Server Process Handles Windows Security Mechanisms. It verifies the validity of user logons to your PC/Server .Technically it generates the process that is responsible for authenticating users for the Winlogon service. Company: Microsoft Corp. System Process: Yes Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No Common Errors: N/A

2003-12-28, 18:48	#22
Joe O Aug 2002 3×5²×7 Posts	Windows\System32\lsass.exe Created/Modified Aug28 2002 9:00PM 11,776 bytes 12,288 bytes on disk Version 5.1.2600.1106 Right click on the file, then left click on properties and compare your info to this taken on a "clean" version of Windows/XP Home.