System Perfomance help

[danjohadley]

Hello recently after buying my new computer and builing it from scratch i have been experiencing problems. These are my system specs:-

AMD Athlon 64 3700+ (San diego core, Oc'ed to 2.4ghz)
ASUS A8N-SLI Premium
1gb OCZ pc400 (3700) ram
BFG Nvidia 7900gt oc
80gb hard disk.

The pc was running fine for about a month but now i have been experiencing low frame rate in games and lots of lag. When i close all the system tray items and all non-essential processes the cpu usage is still around 40% - 60% and the kernal usage is the same. I have run many virus and syware scans and nothing was found. I hope someone can sort this out as its horrible to have such a nice pc underperfoming.

Thankyou

[skull_00]

You properly have Adware(s) and virus... But most likely it's Adware. Try to find a good Adware remover. Try the microsoft beta one.

[MantisCSS]

deff updated the driver for the 7900GT? maybe why ur gettign low frame rate.

[danjohadley]

done what everyone said still using 40 - 60% of my cpu while not doing anything, when starting in safe mode i get 0 - 5% usage which is more like it should be, does this give a clue to waht it doing it since safe mode starts all no- essential processes

[Paul Adams]

Close all programs.

Get Process Explorer and run it.

Right-click on a column and click "Select Columns".

On the 'Process Image' tab, tick 'Command Line' and un-tick all of the other boxes that you can.

On the "Process Memory" tab, tick the boxes:
- Private Bytes
- Virtual Size
- Working Set Size
(un-tick the others)

Click OK, then click File / Save As, and save the text file to yourt desktop.

Open the text file and paste the contents here using CODE tags.

Edit, like this (sort of):

Process	PID	CPU	Working Set	Virtual Size	Private Bytes	Command Line
System Idle Process	0	87.61	24 K	0 K	0 K	
 Interrupts	n/a		0 K	0 K	0 K	
 DPCs	n/a		0 K	0 K	0 K	
 System	4		908 K	7*196 K	0 K	
  smss.exe	388		176 K	5*744 K	348 K	\SystemRoot\System32\smss.exe
csrss.exe	448		1*880 K	161*756 K	1*928 K	C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
wininit.exe	488		316 K	54*640 K	1*764 K	wininit.exe
 services.exe	544	1.54	3*116 K	37*792 K	2*560 K	C:\Windows\system32\services.exe
  svchost.exe	724		3*792 K	51*508 K	2*956 K	C:\Windows\system32\svchost.exe -k DcomLaunch
   ehmsas.exe	2512		268 K	51*840 K	1*332 K	C:\Windows\ehome\ehmsas.exe -Embedding
   unsecapp.exe	2936		2*192 K	57*140 K	2*636 K	C:\Windows\system32\wbem\unsecapp.exe -Embedding
   WmiPrvSE.exe	2068		3*328 K	40*484 K	3*624 K	C:\Windows\system32\wbem\wmiprvse.exe
   dllhost.exe	3632		6*308 K	67*744 K	1*836 K	C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  svchost.exe	784		4*700 K	56*924 K	4*584 K	C:\Windows\system32\svchost.exe -k rpcss
  svchost.exe	848		6*852 K	74*584 K	13*300 K	C:\Windows\System32\svchost.exe -k secsvcs
  svchost.exe	920		6*964 K	77*148 K	8*664 K	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
   audiodg.exe	1180		9*396 K	50*444 K	11*956 K	C:\Windows\system32\AUDIODG.EXE 0x460
  svchost.exe	948		19*072 K	429*176 K	26*092 K	C:\Windows\system32\svchost.exe -k netsvcs
  SLsvc.exe	984		7*892 K	46*444 K	6*308 K	C:\Windows\system32\SLsvc.exe
  svchost.exe	1004		7*136 K	98*524 K	7*732 K	C:\Windows\system32\svchost.exe -k LocalService
  svchost.exe	428		396 K	27*696 K	1*140 K	C:\Windows\System32\svchost.exe -k UxSvcGroup
   dwm.exe	2172	7.69	122*120 K	341*744 K	203*224 K	"C:\Windows\system32\Dwm.exe"
  svchost.exe	536		7*068 K	442*512 K	19*020 K	C:\Windows\system32\svchost.exe -k NetworkService
  spoolsv.exe	1080		4*832 K	115*696 K	7*260 K	C:\Windows\System32\spoolsv.exe
  svchost.exe	1104		115*192 K	204*996 K	117*012 K	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  svchost.exe	1200		3*072 K	57*560 K	6*276 K	C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  aswUpdSv.exe	1508		160 K	51*416 K	1*144 K	"C:\Program Files\Avast4\aswUpdSv.exe"
  ashServ.exe	1520		17*760 K	138*428 K	15*068 K	"C:\Program Files\Avast4\ashServ.exe"
  svchost.exe	1588		336 K	41*744 K	2*520 K	C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
  SearchIndexer.exe	1824		13*328 K	264*240 K	131*488 K	C:\Windows\system32\SearchIndexer.exe /Embedding
  ashMaiSv.exe	1140		2*824 K	85*304 K	5*232 K	"C:\Program Files\Avast4\ashMaiSv.exe" /service
  ashWebSv.exe	1356		16*712 K	120*196 K	13*056 K	"C:\Program Files\Avast4\ashWebSv.exe" /service
  ehsched.exe	2540		552 K	56*552 K	4*020 K	C:\Windows\ehome\ehsched.exe
  ehrecvr.exe	2632		376 K	67*164 K	3*832 K	C:\Windows\ehome\ehRecvr.exe
  wmpnetwk.exe	2876		2*024 K	95*500 K	6*784 K	"C:\Program Files\Windows Media Player\wmpnetwk.exe"
  TrustedInstaller.exe	3096		2*016 K	60*248 K	4*504 K	C:\Windows\servicing\TrustedInstaller.exe
  svchost.exe	3556		1*836 K	32*436 K	1*380 K	C:\Windows\SysWOW64\svchost.exe -k usnsvc
 lsass.exe	560		3*500 K	55*980 K	4*412 K	C:\Windows\system32\lsass.exe
 lsm.exe	568		1*944 K	35*136 K	2*672 K	C:\Windows\system32\lsm.exe
csrss.exe	528	1.54	4*508 K	164*784 K	2*348 K	C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
winlogon.exe	812		1*468 K	60*804 K	2*588 K	winlogon.exe
 LogonUI.exe	376		1*092 K	78*784 K	7*424 K	"LogonUI.exe"
explorer.exe	2216		71*144 K	337*184 K	77*824 K	C:\Windows\Explorer.EXE
 MSASCui.exe	2408		10*292 K	110*660 K	13*008 K	"C:\Program Files\Windows Defender\MSASCui.exe" -hide
 ehtray.exe	2440		3*280 K	90*692 K	4*596 K	"C:\Windows\ehome\ehtray.exe" 
 wmpnscfg.exe	2780		744 K	71*612 K	2*064 K	"C:\Program Files\Windows Media Player\wmpnscfg.exe"
 procexp.exe	3876		6*232 K	67*852 K	1*872 K	"X:\Program Files\Tools\procexp.exe" 
  procexp64.exe	3940	1.54	42*616 K	191*420 K	39*664 K	"X:\Program Files\Tools\procexp.exe" 
ashDisp.exe	2464		1*596 K	83*228 K	3*744 K	"C:\Program Files\Avast4\ashDisp.exe" 
ieuser.exe	2796		6*232 K	103*768 K	5*020 K	"C:\Program Files\Internet Explorer\ieuser.exe" -Embedding
iexplore.exe	2484		74*460 K	330*860 K	90*296 K	"C:\Program Files\Internet Explorer\iexplore.exe" 
ieuser.exe	4072		8*572 K	104*660 K	10*856 K	"C:\Program Files (x86)\Internet Explorer\ieuser.exe" -Embedding
 iexplore.exe	540		56*716 K	276*400 K	83*200 K	"C:\Program Files (x86)\Internet Explorer\iexplore.exe" 
msnmsgr.exe	3304		17*256 K	209*188 K	23*772 K	"C:\Program Files (x86)\MSN Messenger\msnmsgr.exe"

[danjohadley]

Process	PID	CPU	Description	Company Name	Private Bytes	Virtual Size	Working Set
System Idle Process	0	36.92			0 K	0 K	20 K
 Interrupts	n/a	60.00	Hardware Interrupts		0 K	0 K	0 K
 DPCs	n/a		Deferred Procedure Calls		0 K	0 K	0 K
 System	4				0 K	1,848 K	220 K
  smss.exe	836		Windows NT Session Manager	Microsoft Corporation	164 K	3,768 K	352 K
   csrss.exe	888		Client Server Runtime Process	Microsoft Corporation	1,392 K	23,008 K	3,392 K
   winlogon.exe	912		Windows NT Logon Application	Microsoft Corporation	5,316 K	46,896 K	3,836 K
    services.exe	956	1.54	Services and Controller app	Microsoft Corporation	1,456 K	19,952 K	2,692 K
     svchost.exe	1144		Generic Host Process for Win32 Services	Microsoft Corporation	1,312 K	31,028 K	3,384 K
     svchost.exe	1272		Generic Host Process for Win32 Services	Microsoft Corporation	9,168 K	101,204 K	13,016 K
     svchost.exe	1564		Generic Host Process for Win32 Services	Microsoft Corporation	1,056 K	28,868 K	2,716 K
     svchost.exe	1612		Generic Host Process for Win32 Services	Microsoft Corporation	1,204 K	30,676 K	3,256 K
     spoolsv.exe	1736		Spooler SubSystem App	Microsoft Corporation	2,864 K	40,696 K	4,008 K
     Apache.exe	1264		Apache HTTP Server	Apache Software Foundation	2,544 K	27,788 K	5,536 K
      Apache.exe	1692		Apache HTTP Server	Apache Software Foundation	13,548 K	97,620 K	13,864 K
     MDM.EXE	1344		Machine Debug Manager	Microsoft Corporation	776 K	29,512 K	2,504 K
     nSvcIp.exe	1364		nSvcIp	NVIDIA	2,116 K	38,176 K	4,564 K
     nSvcLog.exe	1436		nSvcLog	NVIDIA	804 K	26,464 K	2,276 K
     nvsvc32.exe	1500		NVIDIA Driver Helper Service, Version 84.21	NVIDIA Corporation	656 K	20,836 K	2,356 K
     wdfmgr.exe	2348		Windows User Mode Driver Manager	Microsoft Corporation	376 K	12,184 K	1,304 K
     xcommsvr.exe	2440		BitDefender Communicator Server	Softwin	236 K	13,188 K	3,052 K
     nSvcAppFlt.exe	2464		app_filter Module		3,036 K	24,064 K	3,172 K
     livesrv.exe	2480		BitDefender Security Service	SOFTWIN S.R.L.	1,092 K	25,884 K	3,244 K
     bdss.exe	2496				24,880 K	75,304 K	26,204 K
     vsserv.exe	2564		BitDefender Security Service	SOFTWIN S.R.L.	3,280 K	49,732 K	6,008 K
    lsass.exe	968		LSA Shell (Export Version)	Microsoft Corporation	3,148 K	41,024 K	1,028 K
    taskmgr.exe	3460		Windows TaskManager	Microsoft Corporation	1,276 K	31,560 K	1,544 K
explorer.exe	564		Windows Explorer	Microsoft Corporation	14,924 K	80,424 K	24,076 K
 bdnagent.exe	812		BitDefender News Agent	SOFTWIN S.R.L	220 K	7,052 K	760 K
 bdswitch.exe	400				336 K	14,396 K	1,436 K
 DeleteSatellite.exe	828		GhostSurf satellite deletion tool	Tenebril Incorporated	340 K	15,724 K	1,296 K
 Scheduler daemon.exe	872		Scheduler daemon	Tenebril Incorporated	2,556 K	42,376 K	4,820 K
 firefox.exe	3252	1.54	Firefox	Mozilla Corporation	20,112 K	87,112 K	28,856 K
 procexp.exe	3404		Sysinternals Process Explorer	Sysinternals	7,832 K	72,896 K	10,916 K
ctfmon.exe	2908		CTF Loader	Microsoft Corporation	616 K	17,172 K	2,356 K

[Paul Adams]

You picked "description" instead of "command line", but no matter - something is generating a hell of a lot of hardware interrupts, when you took that snapshot it was consuming 60% of your processor time!

What do you have in the way of peripherals on this system?
USB devices, all network interfaces, card readers, etc.

Run Process Explorer and watch the CPU column for Interrupts while you disconnect all the peripherals (including the network) except the monitor, watch to see if it is affected by any particular device.

Edit:
Are you using the nVidia firewall service by any chance?
My guess is that's your issue... nSvcIp

[danjohadley]

Process	PID	CPU	Private Bytes	Virtual Size	Working Set	Command Line
System Idle Process	0	27.03	0 K	0 K	20 K	
 Interrupts	n/a	64.86	0 K	0 K	0 K	
 DPCs	n/a		0 K	0 K	0 K	
 System	4		0 K	1,848 K	220 K	
  smss.exe	836		164 K	3,768 K	352 K	\SystemRoot\System32\smss.exe
   csrss.exe	888		1,392 K	22,740 K	3,272 K	C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
   winlogon.exe	912		5,316 K	46,896 K	3,836 K	winlogon.exe
    services.exe	956	1.35	1,436 K	19,696 K	2,704 K	C:\WINDOWS\system32\services.exe
     svchost.exe	1144		1,312 K	31,028 K	3,380 K	C:\WINDOWS\system32\svchost -k rpcss
     svchost.exe	1272		9,216 K	101,716 K	13,032 K	C:\WINDOWS\System32\svchost.exe -k netsvcs
     svchost.exe	1564		1,032 K	28,612 K	2,704 K	C:\WINDOWS\System32\svchost.exe -k NetworkService
     svchost.exe	1612		1,208 K	30,676 K	3,260 K	C:\WINDOWS\System32\svchost.exe -k LocalService
     spoolsv.exe	1736		2,832 K	40,440 K	4,000 K	C:\WINDOWS\system32\spoolsv.exe
     Apache.exe	1264		2,544 K	27,788 K	5,536 K	"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice
      Apache.exe	1692		13,548 K	97,620 K	13,864 K	"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -d "C:/Program Files/NVIDIA Corporation/NetworkAccessManager/Apache Group/Apache2" -D SSL
     MDM.EXE	1344		776 K	29,512 K	2,504 K	"C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"
     nSvcIp.exe	1364		2,116 K	38,176 K	4,564 K	"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe"
     nSvcLog.exe	1436		804 K	26,464 K	2,276 K	"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe"
     nvsvc32.exe	1500		656 K	20,836 K	2,364 K	C:\WINDOWS\System32\nvsvc32.exe
     wdfmgr.exe	2348		376 K	12,184 K	1,304 K	C:\WINDOWS\System32\wdfmgr.exe
     xcommsvr.exe	2440		236 K	13,188 K	3,056 K	"C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service
     nSvcAppFlt.exe	2464		3,036 K	24,064 K	3,172 K	"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe"
     livesrv.exe	3800		1,092 K	25,884 K	3,248 K	"C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service
     bdss.exe	3004	4.05	24,204 K	57,896 K	25,680 K	"C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service
     vsserv.exe	3868		3,100 K	49,008 K	5,292 K	"C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service
    lsass.exe	968		3,180 K	41,280 K	1,208 K	C:\WINDOWS\system32\lsass.exe
    taskmgr.exe	3460		1,276 K	31,560 K	1,444 K	taskmgr.exe
explorer.exe	564		16,220 K	82,848 K	24,848 K	C:\WINDOWS\Explorer.EXE
 bdnagent.exe	812		220 K	7,052 K	760 K	"C:\Program Files\Softwin\BitDefender9\bdnagent.exe" 
 bdswitch.exe	400		336 K	14,396 K	1,436 K	"C:\Program Files\Softwin\BitDefender9\bdswitch.exe" 
 DeleteSatellite.exe	828		340 K	15,724 K	1,296 K	"C:\Program Files\SpyCatcher\DeleteSatellite.exe" 
 Scheduler daemon.exe	872		2,588 K	42,376 K	4,852 K	"C:\Program Files\SpyCatcher\Scheduler daemon.exe" 
 firefox.exe	1356		15,632 K	90,044 K	23,888 K	C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
 procexp.exe	2800	2.70	7,760 K	72,452 K	10,512 K	"C:\Documents and Settings\Daniel\Desktop\pe\procexp.exe" 
ctfmon.exe	2908		616 K	17,192 K	2,392 K	ctfmon.exe

theres the command line, also i dont have any peripherals plugged in, just all the usual stuff like keybord, mouse, monitor, speaker. nothing else, no usb devices.
EDIT: yes i do use nvidia firewall, but if i close nSvcIp the kernal cpu usage is still up in the 40 - 60s

[Paul Adams]

How do you connect to the Internet?
Directly via an ADSL modem or similar, or via a network?

If you connect via a netowkr, did you do the Process Explorer test?

I would suggest the quickest way to determine if it is the nVidia firewall is to uninstall it temporarily and see if the problem vanishes - you know it's not a hardware fault as Safe Mode works okay.

Edit:
Killing a user mode process is not the same as uninstalling a kernel mode filter driver - you have to completely remove it and reboot to rule it out.

[danjohadley]

Ok i uninstalled the NV firewall, and i still get cpu kernal usage jumping around a 40 - 60%. I connect to the internet through a cabel and wireless ASDL model and router and share it with another computer, When i did the P.E test nothing created anything noticable, when i unplugged the network i got 1.42 and 1.52 with the keybord and mouse.

[Paul Adams]

1. Click Start / Run, enter "perfmon"

2. In the left window pane, expand "Performance Logs and Alerts" and select
"Counter Logs"

3. Right-click in the right window pane and select "New Log Settings", give it a
name

4. Click "Add Objects", from the list highlight each of the following and click
"Add":
- LogicalDisk
- Memory
- Network Interface
- Process
- Processor
- System
- Thread

5. Click OK

(Verify that the Counters list now has an entry for each of the counters added from
above)

6. Set "Interval" to 5 and "Units" to seconds

7. Click OK (if you get prompted to create "C:\PerfLogs" click OK again)

(Verify that the new counter is present and green to indicate it is running)

Let this run for about 5 minutes, then right-click the entry you created and click stop.
Once you've got the .blg file, zip it up and drop me a PM and I'll take a look at it.

[Paul Adams]

Strange, PerfMon concurs with Process Explorer - your CPU is spending a huge portion of its time handling interrupts, but there is no process using a lot of CPU time, no disk access and no network traffic which are the typical causes of this.

The only processes with any kind of IO in the sample are System (naturally, this will process interrupts) and an instance of svchost.exe, but neither of these patterns match the interrupt rate graph very well.

One thing I noted is that you are using the Yukon onboard NIC instead of the nVidia one - it might be wiser to use the nVidia NIC if using the nVidia firewall too.

Suggestions to isolate the root of the interrupts:
- Uninstall BitDefender (reinstall if it does not help)
- Check if the disk channel is using DMA in Device Manager
- Download and run Rootkit Revealer to rule out process PerfMon and Process Explorer can't see
- With Process Explorer running, open the Services control panel applet and for each service running click Stop (don't change the startup type) and watch if it affects the interrupt rate

[danjohadley]

alright this is what rootkit revealer came up with, no idea what it means so ill post it here.

HKLM\S-1-5-21-1708537768-926492609-725345543-1003\Software\Valve\Steam\LastSteamExecutionTime	6/23/2006 3:26 PM	4 bytes	Data mismatch between Windows API and raw hive data.
HKLM\S-1-5-21-1708537768-926492609-725345543-1003\Software\Valve\Steam\Steam.exe\UpTimeMostRecent	6/23/2006 3:26 PM	4 bytes	Data mismatch between Windows API and raw hive data.
C:\Documents and Settings\Daniel\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\parent.lock	6/23/2006 3:24 PM	0 bytes	Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\223FC2C8d01	6/23/2006 3:40 PM	202.75 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\233FC2C8d01	6/23/2006 3:38 PM	136.66 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\235CC2C8d01	6/23/2006 3:39 PM	183.33 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\235FC2C8d01	6/23/2006 3:39 PM	193.30 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\31502F5Ed01	6/23/2006 3:37 PM	84.10 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\45FC50ADd01	6/23/2006 3:53 PM	30.09 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\47C3ED38d01	6/23/2006 3:52 PM	56.15 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\4DC0C3DEd01	6/23/2006 3:52 PM	25.27 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\657DD0BFd01	6/23/2006 3:41 PM	59.44 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\6DAFB1B6d01	6/23/2006 3:40 PM	83.08 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\6F004F23d01	6/23/2006 3:53 PM	11.65 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\AC02B08Ed01	6/23/2006 3:35 PM	65.98 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\BFA8937Ed01	6/23/2006 3:41 PM	191.78 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\BFAB937Ed01	6/23/2006 3:41 PM	232.61 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\C3D19843d01	6/23/2006 3:40 PM	117.32 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\C3D29843d01	6/23/2006 3:40 PM	126.82 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\CA81DD67d01	6/23/2006 3:37 PM	17.03 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F22053C3d01	6/23/2006 3:40 PM	177.51 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F2214823d01	6/23/2006 3:40 PM	33.38 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F2224823d01	6/23/2006 3:40 PM	78.01 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F22453C3d01	6/23/2006 3:39 PM	248.30 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F2254823d01	6/23/2006 3:40 PM	44.90 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F22653C3d01	6/23/2006 3:40 PM	192.84 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F22753C3d01	6/23/2006 3:40 PM	202.72 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F23053C3d01	6/23/2006 3:39 PM	184.48 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F23153C3d01	6/23/2006 3:39 PM	180.16 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F23253C3d01	6/23/2006 3:39 PM	173.00 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F23353C3d01	6/23/2006 3:39 PM	168.25 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F2354823d01	6/23/2006 3:38 PM	43.30 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F2364823d01	6/23/2006 3:38 PM	36.90 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F23753C3d01	6/23/2006 3:38 PM	184.82 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Application Data\Mozilla\Firefox\Profiles\voeoi1bl.default\Cache\F23D53C3d01	6/23/2006 3:39 PM	176.45 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temp\plugtmp-1	6/23/2006 3:24 PM	0 bytes	Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Daniel\Local Settings\Temp\plugtmp-1\frame2.swf	6/23/2006 3:24 PM	176 bytes	Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\978FY23A\26[1].gif	6/23/2006 3:42 PM	405 bytes	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\978FY23A\CA4Z36EE.bin	6/23/2006 3:54 PM	20.77 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\978FY23A\tab_icon_ic[1].png	6/23/2006 3:42 PM	1.51 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\H0DN0D29\CAA3CXUZ.bin	6/23/2006 3:52 PM	15.42 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\H0DN0D29\CARA2LV7.HTM	6/23/2006 3:57 PM	1.05 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\H0DN0D29\default[1].0324	6/22/2006 9:16 PM	9.45 KB	Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\H0DN0D29\firstdirect_234x60[1].gif	6/23/2006 3:42 PM	7.78 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\H0DN0D29\md5auth[1].htm	6/23/2006 3:42 PM	502 bytes	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\H0DN0D29\MsgrConfig[1].asmx	6/22/2006 9:16 PM	23.71 KB	Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\H0DN0D29\sbtnbk[1].gif	6/23/2006 3:42 PM	146 bytes	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\H0DN0D29\schematizedstore[1].asmx	6/23/2006 3:43 PM	555 bytes	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\H0DN0D29\tab_icon_ic[1].png	6/22/2006 8:56 PM	1.51 KB	Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\IYW67BIP\BJ7F7GSL7W3ODU@Z~GUW,I[1].jpg	6/23/2006 3:42 PM	3.99 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\IYW67BIP\envelope_open[1].gif	6/23/2006 3:42 PM	166 bytes	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\IYW67BIP\KXO5`QD+7X5,OZ@,NTW@OZ[1].jpg	6/23/2006 3:42 PM	12.10 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\IYW67BIP\mymsn[2]	6/22/2006 9:16 PM	6.31 KB	Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\IYW67BIP\VO[CD]UM723+4KT8DL!IY[1].gif	6/23/2006 3:42 PM	5.15 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\PK3SK6YQ\1493846516[1].htm	6/23/2006 3:42 PM	195 bytes	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\PK3SK6YQ\CALK9TN5.bin	6/23/2006 3:53 PM	19.25 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\PK3SK6YQ\default[1].0324	6/23/2006 3:42 PM	9.67 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\PK3SK6YQ\envelope_open[1].gif	6/22/2006 8:56 PM	166 bytes	Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\PK3SK6YQ\md5auth[1].htm	6/22/2006 9:17 PM	615 bytes	Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\PK3SK6YQ\mo_logo[1].png	6/22/2006 9:16 PM	2.75 KB	Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\PK3SK6YQ\mo_logo[2].png	6/23/2006 3:42 PM	1.80 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\PK3SK6YQ\MsgrConfig[1].asmx	6/23/2006 3:42 PM	23.71 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\PK3SK6YQ\mymsn[1]	6/23/2006 3:42 PM	6.31 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\PK3SK6YQ\P}95@ZNFL63MGI8_ZHRJ-N[1].jpg	6/23/2006 3:42 PM	1.64 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\PK3SK6YQ\sbtnbk[1].gif	6/22/2006 8:56 PM	146 bytes	Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Daniel\Local Settings\Temporary Internet Files\Content.IE5\PK3SK6YQ\}8]UDMXP41L7QMLMH2{CD[1].jpg	6/23/2006 3:42 PM	2.12 KB	Hidden from Windows API.
C:\Documents and Settings\Daniel\Recent\Local Disk (C).lnk	6/23/2006 3:45 PM	293 bytes	Hidden from Windows API.
C:\Documents and Settings\Daniel\Recent\Simon.lnk	6/23/2006 3:45 PM	396 bytes	Hidden from Windows API.
C:\System Volume Information\_restore{B2B635F1-6AAF-43E0-B7EA-8BE1D96C34E5}\RP89\A0038661.ini	6/22/2006 9:42 PM	8.13 KB	Hidden from Windows API.
C:\System Volume Information\_restore{B2B635F1-6AAF-43E0-B7EA-8BE1D96C34E5}\RP89\A0038662.lnk	6/22/2006 9:16 PM	2.27 KB	Hidden from Windows API.
C:\System Volume Information\_restore{B2B635F1-6AAF-43E0-B7EA-8BE1D96C34E5}\RP89\A0038663.ini	6/18/2006 4:27 PM	46.00 KB	Hidden from Windows API.
C:\WINDOWS\Temp\tmp00000c51	6/23/2006 3:22 PM	0 bytes	Visible in Windows API, but not in MFT or directory index.

[Paul Adams]

alright this is what rootkit revealer came up with, no idea what it means so ill post it here.

Nothing suspicious-looking in there.

[danjohadley]

damn it i did all what you said and still im getting iratic cpu behaviour i just cant think wth is going on here, i was thinking of getting a copy of 64bit xp pro oem for 98 quid, but i dunno if it owuld be worth waiting for vista if i have the same kinda budget and i get an oem version.

[Paul Adams]

damn it i did all what you said and still im getting iratic cpu behaviour i just cant think wth is going on here

If the problem doesn't occur in Safe Mode then it's a 3rd party driver.
Check for updates for chipset, audio and video drivers, possibly even BIOS.

When you went through the services list stopping them, you got every one stopped (that could be) and it didn't affect the interrupt CPU time at all?