# Puzzling malware problem **URL:** \ **Category:** Factual Questions\ **Created:** [September 9, 2008, 11:32pm UTC](https://boards.straightdope.com/t/puzzling-malware-problem/462864 "2008-09-09T23:32:47Z")\ **Posts on this page:** 7\ **Page:** 2
**Author:** ![ambushed](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@ambushed](https://boards.straightdope.com/u/ambushed)\ **Post date:** [September 11, 2008, 11:15pm UTC](https://boards.straightdope.com/t/puzzling-malware-problem/462864/21 "2008-09-11T23:15:07Z")
Well, there’s about 20 typical processes and about - what – 100? services running, but NONE of them take any measurable CPU time or I/O time. I run a very tight ship, and I’ve stripped down everything – everything – run at startup, including some that are normally not user-controllable (my startup utility, WinPatrol, provides very extensive capabilities for control of startups and services and just about everything else). I’ve seen the same thing pretty much whatever I do (but sometimes I stop too much and it doesn’t boot properly.) I’ve also tried for months now everything I can think of, including re-enabling nearly all services and startups, but nothing makes any difference. I’ve tried system restores and the like, all to no effect. > [@arseNal](#): > > I think you’d be surprised at what can cause this. I also wouldn’t be so sure it’s malware. > > The fact that it doesn’t happen in safe mode makes me suspect you have some other crap running (again, not necessarily malware) that is interfering somehow. So I would go and kill processes systematically and see if any of them are the culprit. > > Another thing I might try is to use a utility like [handle](http://technet.microsoft.com/en-us/sysinternals/bb896655.aspx) while the hang is occuring. Use it on the file that you tried to open that triggered the hang condition. It may just tell you about some unexpected process that is trying to access it. ---
**Author:** ![Really\_Not\_All\_That\_Bright](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@Really\_Not\_All\_That\_Bright](https://boards.straightdope.com/u/Really_Not_All_That_Bright)\ **Post date:** [September 11, 2008, 11:15pm UTC](https://boards.straightdope.com/t/puzzling-malware-problem/462864/22 "2008-09-11T23:15:12Z")
Have you tried playing with your Windows Services? Run\> services.msc The do like this: [http://www.blackviper.com/WinXP/servicecfg.htm](http://www.blackviper.com/WinXP/servicecfg.htm) (When you kill services, do it one at a time and reboot in between to make sure none of your software or network stuff is dependent on them) ---
**Author:** ![ambushed](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@ambushed](https://boards.straightdope.com/u/ambushed)\ **Post date:** [September 11, 2008, 11:16pm UTC](https://boards.straightdope.com/t/puzzling-malware-problem/462864/23 "2008-09-11T23:16:22Z")
> [@groman](#): > > Also make sure your PATA hard drives did not magically revert to PIO mode. Well, I’ve just got SATA drives, but thanks anyway. ---
**Author:** ![Harmonious\_Discord](https://avatars.discourse-cdn.com/v4/letter/h/74df32/32.png) [@Harmonious\_Discord](https://boards.straightdope.com/u/Harmonious_Discord)\ **Post date:** [September 12, 2008, 12:03am UTC](https://boards.straightdope.com/t/puzzling-malware-problem/462864/24 "2008-09-12T00:03:55Z")
I will recommend the following site and suggest you ask for help there. [http://www.nutnworks.com/forums/index.php](http://www.nutnworks.com/forums/index.php)? ---
**Author:** ![ambushed](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@ambushed](https://boards.straightdope.com/u/ambushed)\ **Post date:** [September 12, 2008, 12:44am UTC](https://boards.straightdope.com/t/puzzling-malware-problem/462864/25 "2008-09-12T00:44:29Z")
Thanks for the tip. F-Secure online scanner is running now. It’s probably take a day or so… > [@G1llyB4tes](#): > > Try running Blacklight or one of the other free root kit detectors. If something is intercepting processes you’ll never find them with standard anti-virus or spyware tools. > > [http://www.f-secure.com/blacklight/](http://www.f-secure.com/blacklight/) ---
**Author:** ![Peter\_Morris](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/peter_morris/32/359_2.png) [@Peter\_Morris](https://boards.straightdope.com/u/Peter_Morris)\ **Post date:** [September 12, 2008, 7:51pm UTC](https://boards.straightdope.com/t/puzzling-malware-problem/462864/26 "2008-09-12T19:51:39Z")
Have you checked your disk for fragmentation lately? ---
**Author:** ![ambushed](https://avatars.discourse-cdn.com/v4/letter/a/3bc359/32.png) [@ambushed](https://boards.straightdope.com/u/ambushed)\ **Post date:** [September 12, 2008, 8:33pm UTC](https://boards.straightdope.com/t/puzzling-malware-problem/462864/27 "2008-09-12T20:33:43Z")
Well, suddenly the system’s running with good speed, but something weird is going on. The last 3 times I started a malware scan, something forced it to exit before finishing (all my anti-malware programs are supposed to stay running to display the final report before closing). I started the scans and later, when I check back on the scan, the app has unexpectedly exited. The same thing happened with the F-Secure online scan. It was running fine, but when I checked back, it had exited unexpectedly. I guess I should just accept it as is and be cautious. I’ve finally got another of my desktops working, so I’ll use this questionable machine only if necessary. Thanks for everyone’s help! [Previous page](https://boards.straightdope.com/t/puzzling-malware-problem/462864.md?page=1)