BetaONE will rise again!


Reply
  #11  
Old 6th Jun 03, 04:35 AM
Bads's Avatar
Bads Bads is offline
BetaONE Supporter
 
Join Date: Jul 2001
Location: Quebec
Posts: 1,710
Bads is an unknown quantity at this point
I have a similar problem and the taskmanager is taking 48 % of the ressource

I will try to disable it and let you know after
__________________
Reply With Quote
  #12  
Old 6th Jun 03, 04:37 AM
SlaiN SlaiN is offline
Junior Member
 
Join Date: Jun 2003
Posts: 10
SlaiN
i disabled one, and what that taskmgr was using was transferred to the other taskmgr!!! As a test i ran 3ds max. When this was running, it was obviously using more of my CPU, but then when i shut 3ds max, it returns to the taskmgr using all the cpu. Its like its being forced to use 100% CPU usage. I dont understand it at all.
Reply With Quote
  #13  
Old 6th Jun 03, 06:01 AM
Sephiroth Sephiroth is offline
BetaONE Supporter
 
Join Date: Jul 2001
Posts: 1,979
Sephiroth is an unknown quantity at this point
Send a message via MSN to Sephiroth
something isn't quite right with that

how do you have two instances of task manager running at once? you can't possibly run two instances of task manager at the same time, no matter how you try to start it, unless they are running under different user accounts, and i really doubt that any decent company would name one of their exe's after something of microsoft's

search for update.exe and taskmgr.exe on your hdd, be sure to make hidden and system files viewable (under control panel \ folder options) first, and see what it finds, and look at where those two exe's are located and see what their properties say about them, and post back here

windows xp's auto update exe is named wuauclt.exe , so i know it's not windows that's auto updating, and i have a ton of fairly common software installed on this machine, and update.exe isn't anywhere on my machine, have you scanned for virus's and spyware?
Reply With Quote
  #14  
Old 6th Jun 03, 06:42 PM
just_do_IT's Avatar
just_do_IT just_do_IT is offline
Banned
 
Join Date: Jan 2003
Location: Canada
Posts: 871
just_do_IT is an unknown quantity at this point
h**p://www.sysinternals.com/ntw2k/freeware/procexp.shtml. Not sure if that is the link mentioned above?

Seems like a pretty decent tool

I agree with Seph in regards to checking for a virus/trojan, but more likely spyware. Adaware is good for that.

Only other thing I could suggest is running msconfig and clearing out what you dont need at startup.
Reply With Quote
  #15  
Old 6th Jun 03, 08:02 PM
User Needs User Needs is offline
Administrator
 
Join Date: Aug 2001
Posts: 950
User Needs has disabled reputation
When ever I had anything like MemTurbo installed. I'd start having problems.

My frist step would be to uninstall it and see what happens.

user needs
Reply With Quote
  #16  
Old 6th Jun 03, 09:20 PM
Zone-MR Zone-MR is offline
M.I.A.
 
Join Date: Sep 2001
Location: Near Newcastle, UK
Posts: 1,077
Zone-MR will become famous soon enoughZone-MR will become famous soon enough
Send a message via MSN to Zone-MR
Certainly suspicious. A common tactic for software makers which have something they want to hide on your PC is to name the files after something that looks like part of the OS. Two taskmgr.exe's looks suspicious. As a short term remedy, just kill the weird taskmgr proccess, and also kill update.exe.

Then type msconfig into the start, run box and see if anything suspicous is running at startup. If so remove it from the registry/win.ini/wherever.
__________________
[img]http://celltrack.spv-developers.com/render/Zone-MR.png[/img]
[url="http://future.betaone.net/forum/links.php?url=http://future.betaone.net/forum/links.php?url=http://zone-mr.net"]http://zone-mr.net[/url] - Transcribing Life
Reply With Quote
  #17  
Old 6th Jun 03, 10:13 PM
Cactus's Avatar
Cactus Cactus is offline
BetaONE Supporter
 
Join Date: Jul 2001
Posts: 819
Cactus is an unknown quantity at this point
Do a search for update.exe, it might tell you where the program belongs to. It might be just a program you installed that f*cks up your system. It doesn't have to be a trojan.

If you find the update process belongs to a certain program you installed, uninstall it, and see it the problem still occurs. If so, then it probably a trojan of some kind. If not, reinstall the problem and if the problem return contact the company that made that program.

Hope this helps too
__________________
Quote:
Several security vulnerabilities in Firefox and the Mozilla Suite of Internet software put users of the open-source products at risk of hacker attacks, the Mozilla Foundation is warning.
Reply With Quote
  #18  
Old 7th Jun 03, 06:28 AM
SlaiN SlaiN is offline
Junior Member
 
Join Date: Jun 2003
Posts: 10
SlaiN
Here is an update!

OK Sephiroth, i ran a search for taskmgr.exe, and there are 5 files! One is in the windows folder, another in windows/system32 and another in windows/system32/dllcache. I went into the properties and they are all microsoft applications. There are another two but arent .exe, they are called TASKMGR.EXE-25DA9018.pf and TASKMGR.EXE-06144C13.pf and they are in windows/prefetch. I have no idea what they do. I went into the windows task manager and there are 2 taskmgr.exe files running at the same time.

Here is the more complicated part, ran a search for update.exe and got quite a few results, there are three update.exe in the same folders as the taskmgr.exe. The thing that stands out is that there is an update.exe in the windows/system folder, and in the properties window, it doesnt say that it belongs to microsoft, it just says application??

User needs - i uninstalled MEMturbo and that didnt do anything. thanks for ur advice anyway.

ZONE-MR - I did what u said and i ended the 2 taskmgr.exe and the update.exe and that made a big difference! everything went back to normal. I have no idea what these files do, but they sucked all my CPU!! I went into msconfig, and there is nothing suspicious expect that the 2 taskmgr.exe and the update.exe are there, i have unticked them, but cant reboot yet, cos im rendering something, on the next reboot i will let u know the result!!!

A big THANK YOU to everyone that replyed to my post, much appreciated!
Reply With Quote
  #19  
Old 9th Jun 03, 10:21 AM
SlaiN SlaiN is offline
Junior Member
 
Join Date: Jun 2003
Posts: 10
SlaiN
OK ppl!

Everything is back to normal! Changing the 2 taskmgr and update.exe that loaded at start-up cleared everything up! If someone has any time, can u please explain what these files are supposed to do, as i have no idea.

Again thanks everyone that replyed, and to my mate, ~*McoreD*~ for referring me here! You are a legend!
Reply With Quote
  #20  
Old 9th Jun 03, 10:48 AM
Zone-MR Zone-MR is offline
M.I.A.
 
Join Date: Sep 2001
Location: Near Newcastle, UK
Posts: 1,077
Zone-MR will become famous soon enoughZone-MR will become famous soon enough
Send a message via MSN to Zone-MR
I am now certain the files were malicious. It could have been a trojan, it could have been spyware, it could have been adware.

No legitimate application would be named taskmgr, and have the company field set to "Microsoft". That is clearly an attempt at hididng it. The "real" taskmgr.exe (and there is only one), should sit in "c:\windows\system32". That means the one in "c:\windows" was probably the fake one. Try comparing the two filesizes.

Quote:
I went into the properties and they are all microsoft applications.
That just shows the contents of the 'company' tag, which the software developer can set as they like. If someone wants to hide something, "Microsoft" seems a very logical thing to set as the company rather than "TrojanWare Inc.".

Sometimes viewing an exe in a hex editor will reveal some tell-tale strings. If everything looks like garbage except ".....LOG.KEYBOARD.EVENTS....." and ".....CORRUPT.WINDOWS.INSTALLATION...." you know its most likely not too innocent. Then again its easy to compress EXEs in which case viewing the code would tell you nothing.
__________________
[img]http://celltrack.spv-developers.com/render/Zone-MR.png[/img]
[url="http://future.betaone.net/forum/links.php?url=http://future.betaone.net/forum/links.php?url=http://zone-mr.net"]http://zone-mr.net[/url] - Transcribing Life
Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
CPU fan not workin, cant boot up david42018 Hardware Support 10 17th Nov 01 02:04 AM


All times are GMT +1. The time now is 08:21 PM.


Design by Vjacheslav Trushkin for phpBBStyles.com.
Powered by vBulletin® Version 3.6.5
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.