Strange 100% CPU usage

[Kumiss]

First off, I have looked at other threads with 100% problems.

Unfortunatly i cant seem to find a fix.

So...

Prob Desc:

Usually when i open up uTorrent (Version 1.7.7) the icon appears instantly and files get checked and downloads start. This was the case this morning. However, later on i had to force a restart on my comp, since then uTorrent will use 100% cpu when loading, which is OK becuase once it fully loads it drops back down to 1%. Becuase of the restart the files need to be checked, which happens at low CPU usage. however once the first file is checked it begins to download. then uTorrent will use 100% cpu and then become unresponsive. Rather annoying.

HJT Log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:41:36, on 30/05/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\WINDOWS\System32\smss.exe

C:\WINDOWS\WINDOWS\system32\winlogon.exe

C:\WINDOWS\WINDOWS\system32\services.exe

C:\WINDOWS\WINDOWS\system32\lsass.exe

C:\WINDOWS\WINDOWS\system32\svchost.exe

C:\WINDOWS\WINDOWS\System32\svchost.exe

C:\WINDOWS\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\WINDOWS\system32\IoctlSvc.exe

C:\WINDOWS\WINDOWS\system32\svchost.exe

C:\WINDOWS\WINDOWS\Explorer.EXE

C:\Program Files\Be Punctual\BePun.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\WINDOWS\system32\ctfmon.exe

C:\Program Files\Microsoft\RATTV3\RATT.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Be Punctual.lnk = C:\Program Files\Be Punctual\BePun.exe

O4 - Global Startup: RATT.lnk = C:\Program Files\Microsoft\RATTV3\RATT.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\windows\system32\securenet.dll

O10 - Unknown file in Winsock LSP: c:\windows\windows\system32\securenet.dll

O10 - Unknown file in Winsock LSP: c:\windows\windows\system32\securenet.dll

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1206827521968

O17 - HKLM\System\CCS\Services\Tcpip\..\{AB660195-80FA-459A-82D3-02929670C767}: NameServer = 192.168.4.254

O17 - HKLM\System\CCS\Services\Tcpip\..\{B95FE8E0-6E5C-4712-A125-B46BE6044103}: NameServer = 192.168.1.255

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe

O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe

O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\WINDOWS\system32\nvsvc32.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\WINDOWS\system32\IoctlSvc.exe

--

End of file - 6438 bytes

Using procexp I can see that the problem is at start address uTorrent.exe+0x1751b

the rest of the threads looks like:

|___TID___|________Start_Address__________|

|__2756___|_____uTorrent.exe+0x1751b______|

|__2312___|_____uTorrent.exe+0x84530______|

|___344___|_____uTorrent.exe+0xe6a8_______|

|__3764___|_____uTorrent.exe+0xfb90_______|

|__1344___|___kernal32.dll!CreateThread+0x22|

|__2736___|___kernal32.dll!CreateThread+0x22|

So, what's next?

Thanks for your time.

[DreadWingKnight]

post a process explorer process list with injected dlls for the utorrent.exe process please (even though I suspect CA's antivirus is running amok again).

[Kumiss]

Is that wat u wanted?

edit: this is with me killing all CA processes that i'm aware of (problem still occurs tho )

[DreadWingKnight]

http://forum.utorrent.com/viewtopic.php?pid=258238#p258238

Although I suspect whatever's hooking in securenet.dll into the process may be the cause.

Another thing that could be happening is that your hard drive lapsed into PIO mode.

[Kumiss]

Just ran a quick script that put my HDD into DMA mode, all appears to be good in the world of uTorrent.

...

For now at least!

[jewelisheaven]

Yeah ... for now... if Windows is telling the hard drive to continually into PIO mode you really should look up and buy a new hard drive to prepare for drive failure. They're not that expensive these days, and... you can NEVER have too much storage space, lol