PC info:
XP home SP3
Dual core processor
Browser: Firefox 20
Wired internet, not wireless.
Hi,
Please can you help solve this mystery? Opinions are welcome about either of the issues here.
What happened:
- I was looking at a website for a well known large online shop, I have used the site many times before. I was using a non-admin account.
- Lost broadband and got a message bubble "network cable is unplugged" the cable was fine, and it had not been knocked.
- Opened Task Manager, CPU usage % at the bottom was around 40% but only 5% was being used in the processes list.
- Closed brower, CPU still at 30-50% but processes list only had "system idle process" 99%.
- Unplugged cable from router to PC. Task Manager looked the same.
- Logged out of windows. Logged in as admin. Task manager still showing 30-50% usage with only "system idle process" 99% in the list. "Show processes from all users" is ticked.
- Ran: Avast memory scan (only showed the usual two false positive msmpeng.exe Defender entries), Avast full scan, Malwarebytes full scan, Defender full scan, HijackThis, all OK.
- Re-started PC. CPU% was back to normal.
- Checked event logs. For the time when I lost internet there was an entry that said:
Failure Audit
Event ID: 615
User: NT AUTHORITY\NETWORK SERVICE
IPsec services failed to get a complete list of network interfaces on the machine. This can be a potential security hazard to the machine since some of the network interfaces may not get the protection as desired by the IPsec filters. Please run IPsec monitor snap-in to further diagnose the problem.
- Ran Avast boot scan - nothing found.
- Checked router logs, they didn't go back far enough (only 2 hours)
- Undated and ran MBAM & Defender full scans again, updated Avast and did a boot scan again, nothing found.
- From here:
http://technet.microsoft.com/en-us/network/214ce7bf-7e9d-4c44-b55d-fb829a9af320I did this:
Q. How can I tell which IPsec filter lists are active based on the IPsec policy applied to my computer?
A. You can view the IPsec filter list with the IP Security Monitor snap-in provided with Windows XP and Windows Server 2003. To add the IP Security Monitor snap-in, do the following:
Click Start, click Run, type MMC, and then click OK.
Click File, click Add/Remove Snap-in, and then click Add.
Click IP Security Monitor, and then click Add.
Click Close, and then click OK.
To view the IPsec filter list, you need to open the Main Mode and Quick Mode folders in the console tree. In the Main Mode folder, click Specific Filters to view the filters in the IPsec filter list that require security., In the Quick Mode folder, click Specific Filters to view all of the filters in the IPsec filter list. For more information about the IPsec filter list, see IPsec Filter Ordering.
When I click the folders under Main Mode or Quick Mode it says:
"There are no items to show in this view"
PC seems to be behaving normally now. However I'm sure sure what happened or if it is secure.
Q 1. Any ideas what may have been causing the high CPU usage?
Q 2. Could the Event:615 "IPsec services failed..." be the cause, or a symptom of the broadband disconnect?
Q 3. What is IPsec? Why would I need it?
Is IPsec something for specific PC or network setups that might not be relevant to everyday use?
Q 4. Any suggestions what to do next?
Many thanks for any opinions.