Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

There is a Windows XP machine whose CPU usage is continuously at 100%.

When watching processes in the Task Manager (sorted by CPU usage), the percentage does not add up to a 100%.

This points to a virus or some other kind of rogue process.

There is an antivirus (Kaspersky) running on that machine and has been run but doesn't detect anything.

So, even if it might be saner and shorter to just reinstall, what does your toolkit contain to find the culprit and handle this type of scenario?

share|improve this question

3 Answers 3

up vote 7 down vote accepted

Usually, for process management, I use Process Explorer. It's like a super-powered Task manager.

share|improve this answer

In theory, I would imagine that the percentages aren't perfect, and are rounded either up or down to the nearest percent. Is the usage off greatly?

share|improve this answer

Checkout RootkitRevealer -- you never know. :)

RootkitRevealer is an advanced rootkit detection utility. It runs on Windows XP (32-bit) and Windows Server 2003 (32-bit), and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. RootkitRevealer successfully detects many persistent rootkits including AFX, Vanquish and HackerDefender (note: RootkitRevealer is not intended to detect rootkits like Fu that don't attempt to hide their files or registry keys). If you use it to identify the presence of a rootkit please let us know!

The reason that there is no longer a command-line version is that malware authors have started targetting RootkitRevealer's scan by using its executable name. We've therefore updated RootkitRevealer to execute its scan from a randomly named copy of itself that runs as a Windows service. This type of execution is not conducive to a command-line interface. Note that you can use command-line options to execute an automatic scan with results logged to a file, which is the equivalent of the command-line version's behavior.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.