carnau Posted September 6, 2003 Report Share Posted September 6, 2003 Lately my windows has been at 100% useage? :smart: When i click on task manager to see what is useing my CPU useage it is Sysinfo.exe and Syestem idle. both at 99%, not at the same time but 1 at a time. I have scanned for viruses and checked everything i can. When i try to close them in the task manager it says manditory system function can't close. :( I have no other programs up. any ideas?Thanks for your time. Quote Link to comment Share on other sites More sharing options...
mark2 Posted September 6, 2003 Report Share Posted September 6, 2003 Are these in the processes tab ? Unfortunately I'm using XP so not sure of Sysinfo.exe, but it doesn't show in my processes tab.I would expect to see system idle at 90% plus most of the time. heres a screenshot of my processes running currently Quote Link to comment Share on other sites More sharing options...
Guest spikeychris Posted September 6, 2003 Report Share Posted September 6, 2003 As Mark has pointed out you don't have to worry about the system idle process.It is what the computer does when there is noother work to do. Sysinfo.exe is I think used by Norton. Quote Link to comment Share on other sites More sharing options...
carnau Posted September 6, 2003 Author Report Share Posted September 6, 2003 as you can see the sysinfo.exe is like way up there.what do you think? Quote Link to comment Share on other sites More sharing options...
Redhat Posted September 7, 2003 Report Share Posted September 7, 2003 What's "Microsofts.exe" ? Can you account for it? Looks dodgy to me. Quote Link to comment Share on other sites More sharing options...
mark2 Posted September 7, 2003 Report Share Posted September 7, 2003 I'm also a little concerned about dwrcs.exe having read thisI've come across a system that appears to have been compromised. It is a Win2K advanced server, and during analysis I found that the DameWare remote control agent version 3.51.1.0 has been installed, which allows remote GUI access by an unauthorized party. The DameWare application is running as a service and listens on TCP port 6129 by default. The attacker has installed the Dameware server application in the default location C:\WINNT\SYSTEM32\DWRCS.EXE and DWRCK.DLL. The owner of the executable is the Administrators group. DWRCS.EXE can be used through command line to install, uninstall, or change the listening port, so any exploit that would have allowed the attacker to execute any command line could have been used.Has it been installed by you ? If not and you need to remove it see the help athttp://www.bionics.co.uk/_site/kb/0089170000.htmYou seem to have a lot of services running too, do you know if they are all needed? Perhaps downloading Startup list from http://www.spywareinfo.com/~merijn/ so we can see if there are any nasties in there. Just extract it, double click then copy/paste the results to your reply. Quote Link to comment Share on other sites More sharing options...
Agent Smith Posted September 7, 2003 Report Share Posted September 7, 2003 carnau, as has already been stated by mark2 and spikeychris, the System Idle Process is perfectly normal, and should not be worried about.The sysinfo.exe is again another genuine application, which amongst other things is used by a Norton product SWS (Symantec Web Security). So if you are using this, then I would guess that again it is to be expected. However, I am somewhat intrigued, as you claim to have scanned for viruses but make no mention of any found, but in another thread you have running Svchost Thread you claim that one of your files is infected.I would suggest that you sort out the other problem, and see what happens with this one. It may also be a good idea, if you could post back with the exact Norton products you are using, so we can verify that the sysinfo app is running genuinely.As for microsofts.exe, I can find NO reference to this anywhere, and like Redhat would be concerned about what it is. I think you should investigate this further to be on the safe side.I would also follow mark2's advice regarding DWRCS.Good Luck. Regards. Mr. Mouse. Quote Link to comment Share on other sites More sharing options...
Redhat Posted September 7, 2003 Report Share Posted September 7, 2003 Oh yeah silly me - if your infected by Welchia (which, YOU ARE ;)) it's going to slow the system down as it spreads. Quote Link to comment Share on other sites More sharing options...
carnau Posted September 7, 2003 Author Report Share Posted September 7, 2003 i was useing norton system works.. but i deleted it.. I don't have any sysinfo.exe viruses is what i was saying. I do have dameware on my CPU but that is so i can control this CPU from fork and vise versa. Quote Link to comment Share on other sites More sharing options...
Redhat Posted September 7, 2003 Report Share Posted September 7, 2003 Read your other thread. I have a strong feeling these two threads are down to the same thing : Your infected with Welchia. Quote Link to comment Share on other sites More sharing options...
Agent Smith Posted September 7, 2003 Report Share Posted September 7, 2003 i was useing norton system works.. but i deleted it..Norton can be a notorious pain to remove. If you have deleted all your Norton software, including the AV, then I would suggest using the removal tool from symantec Available Here to clean everything up. You can always reinstall your AV afterwards if need.Mr. M.PS I have been keeping an eye on your other thread, and I believe that your problems are related. I think you are going to be quite busy cleaning the nasties from your system. Sorry to hear that :( Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.