System process at 100% CPU

[martinatthetown]

Your not alone!! - I too have the system process at 100% CPU...
I think its down to the latest MS Windows Updates.. anyone else having this problem??

[ravin]

looking at martinatthetown's process list I see that outlook is taking up quite a few resources. their is a known problem in outlook that after closing it outlook continues to run. so if you don't notice it didn't end and open outlook again you double up on resource usage. just a thought. allthough restarting the computer should end any instances of outlook. one last suggestion would be to get a copy of avast free - install it in safemode and select during install to scan at boot time.

[NICK ADSL UK]

-{ Quote: "Your not alone!! - I too have the system process at 100% CPU...
I think its down to the latest MS Windows Updates.. anyone else having this problem??" }-
Hi martin and welcome to Wilder's :)
In just observing your screen shot you do have far to many processes running and you really do need to check what is starting up when you turn your computer on and take the necessary steps in dealing with that issue first before attempting to do anything else.
If you could post another screen shot of when you have rebooted your computer i will then be able to get your start up in to some sort of order for you. Just having the right start up program's running fixes many things without the need for any further intervention

Regards

[martinatthetown]

Thanks all for advice.... this is issue is starting to turn into a nightmare!

I've restarted the computer, gone through and stopped all none essential services, the problem still continues...

I've had this problem for acouple of days, I can identify one possible reason:

I updated my computer with the Microsoft Update - it included 6 updates, which I have since uninstalled:
KB919007 Update for windows XP
KB920685 Security Update for windows
KB922582 Security Update for windows
KB920872 Update for windows XP
etc

it also contained one new hardward driver update, however, like most people, I just installed all recommendations, and paid little attention to what the hardware driver related too. the drivers are not listed on the microsoft update history

I have been through the system-device manager tonight and painstakeingly roled back all drivers where possible, restarted the computer etc...

the computer by the way, fails to shut down correctly, poss. because something is failing to close... I also deleted and recreated the paging-file

my only known solution is to do a full system restore, however, my computer is my job, I have lots on it! and really can't spend a full week reloading the content - after I've backed everything up.... I'm running out of ideas...
if I did this, whats to say, it will not happen again?
(the computers a compaq presario, if that helps?)

[Tommy]

-{ Quote: "Your not alone!! - I too have the system process at 100% CPU...
I think its down to the latest MS Windows Updates.. anyone else having this problem??" }-
I see also that svchoste.exe and system is using quiet a lot memory. Do you have a firewall running. Sometimes application insist in accessing some internet stuff which can result, if they don't reach their destiny, in a temporaly high mem and CPU usage. Check your FW settings and log, if you use one, regarding system, svchoste.exe, etc.

[NICK ADSL UK]

-{ Quote: "Thanks all for advice.... this is issue is starting to turn into a nightmare!

I've restarted the computer, gone through and stopped all none essential services, the problem still continues...

I've had this problem for acouple of days, I can identify one possible reason:

I updated my computer with the Microsoft Update - it included 6 updates, which I have since uninstalled:
KB919007 Update for windows XP
KB920685 Security Update for windows
KB922582 Security Update for windows
KB920872 Update for windows XP
etc

it also contained one new hardward driver update, however, like most people, I just installed all recommendations, and paid little attention to what the hardware driver related too. the drivers are not listed on the Microsoft update history

I have been through the system-device manager tonight and painstakingly roled back all drivers where possible, restarted the computer etc...

the computer by the way, fails to shut down correctly, poss. because something is failing to close... I also deleted and recreated the paging-file

my only known solution is to do a full system restore, however, my computer is my job, I have lots on it! and really can't spend a full week reloading the content - after I've backed everything up.... I'm running out of ideas...
if I did this, whats to say, it will not happen again?
(the computers a compaq presario, if that helps?)" }-

Hi martin :)
Can you please remove all of these from starting up as they are not needed. Should they continue to start up may i suggest that you use windows defender which will highlight what is running at start up so you can then disable those above. There is other software that you could use like reg run but i have found windows defender to do a good job
You can find it here
http://www.majorgeeks.com/download4466.html

http://www.microsoft.com/athome/security/spyware/software/default.mspx

The updates you have uninstalled should go back on when you have completed everything and i think in your case you could submit a HJ log for one of our expert's to take a look at just to make sure everything is in order

Regards

[martinatthetown]

Thanks again for all your advice people!

I have not stopped fiddling with this problem as it is making my PC impossible to use.

I agree, I need to manage my PCs configuration, and this could be effecting the performance of the machine, however, I have been using the PC, fulltime as a .NET developer, for the last 6 weeks continuously, in that time, I have not added a program, or changed the configuration.

Bearing in mind I uninstalled the resent updates.. I just used MSCONFIG to restored the computer to a previous configuration; (to before the updates were added…) This did not solve the problem…
so I then entered safe-mode with the basevideo option selected… as you can see from attached image… nothings really loaded, is it??? what am i missing?

normally,
I am using Kaspersky Antivirus – which also accesses regular internet based updates, I do not use any third party firewall applications.
without listing all software installed, the main applications are as follows:
XP Pro - sp2,
ie7,
Visual Studio .NET
SQL Server
CorelDRW 11
and controversally MS Office 2007 beta 2 - which was ran as an upgrade from office XP sp3.
Napster
etc
the computer is:
Compaq Presario P4-3.x, 1gb RAM, 250+HDD, DVD/CD using a Netgear wireless LAN
it has other hardware added, eg Scanner, Laser printers, surround-sound etc
it should be able to handle few startup tasks, it currently struggles to run paint brush... any further advice may help me sleep better! thanks so far...

[martinatthetown]

one more thing...
what is a HJ log?? and how do i submit one?

[NICK ADSL UK]

As i say martin it would be best to post a log to rule out anything unto wards that may be going on. There is a tutorial here in which you can read up on and download the software.
http://www.tomcoyote.org/hjt/

Regards

[Tommy]

Just one idea.
Please check if you have a IRQ conflict. That could result into the high CPU usage of system.

[rno2]

I was having the same problem. Windows would not even be finished loading after 20 or so minutes.
It took me a few hours to figure it out. For me it was AOL's free anti-virus that I had decide to test out. I had to go into safe mode and then manually remove any startup registry keys for AOL's anti-virus. Then I restarted normally and completely removed the program. Problem solved.

I suggest temporarily disabling your security software one and a time and restarting your system, to see if one of them may be causing the problem. I suspect that the new update release is having some problems with resident programs such as anti-virus, anti-trojan and anti-spyware/malware.

[martinatthetown]

I have not idetified any conflicts, to be on the safe side, i have removed all of my non-essential external hardware
so, i am left with a basic compaq presario and a internal netgear wireless adapter

I use the windows std firewall... the virus software is not running in safemode.. nor is the firewall.. so, i am thinking its not a thirdparty software issue.

I have attached the hijack log- for reference - i do not want to cause further problems to the computer by my mis-intepreting its use, so have not changed any other options, (the log is run from safe mode)

[dvk01]

I really need to see a HJT log taken in normal mode and also


Download WinPFind (http://www.bleepingcomputer.com/files/winpfind.php)
Right Click the Zip Folder and Select "Extract All"
Extract it somewhere you will remember like the Desktop
Dont do anything with it yet!

Reboot into Safe Mode
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Doubleclick WinPFind.exe
Click " Configure Scan Options"
Select " Run Add ONs" and then select ALL the options in the box below it, Press Apply
Now Click "Start Scan"
It will scan the entire System, so please be patient!
Once the Scan is Complete
Reboot back to Normal Mode!
Go to the WinPFind folder
Locate WinPFind.txt
Place those results in the next post!. It will be too big to post so you will need to attach it to your reply

and

download gmer from http://www.gmer.net

save it somewhere safe & unzip it to desktop

double click the gmer.exe to run it and select the rootkit tab, Do NOT select the show all button, press scan & when it has finished press save & copy the log back here

[martinatthetown]

it looks like its attached it...
well... its technofobic!... what can i say??

I hope it means more to you then me!??!

[martinatthetown]

GMER output - not sure if this is the info u wantd?

GMER 1.0.11.11337 - http://www.gmer.net
Rootkit 2006-09-15 10:09:13
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.11 ----

SSDT kl1.sys ZwOpenFile

---- Devices - GMER 1.0.11 ----

Device \FileSystem\Cdfs \Cdfs IRP_MJ_CREATE F6FDD400
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLOSE F6FDD400
Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ F6FDD400
Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_INFORMATION F6FDD400
Device \FileSystem\Cdfs \Cdfs IRP_MJ_SET_INFORMATION F6FDD400
Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_VOLUME_INFORMATION F6FDD400
Device \FileSystem\Cdfs \Cdfs IRP_MJ_DIRECTORY_CONTROL F6FDD400
Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL F6FDD400
Device \FileSystem\Cdfs \Cdfs IRP_MJ_DEVICE_CONTROL F6FDD400
Device \FileSystem\Cdfs \Cdfs IRP_MJ_SHUTDOWN F6FE0C74
Device \FileSystem\Cdfs \Cdfs IRP_MJ_LOCK_CONTROL F6FDD400
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLEANUP F6FDD400
Device \FileSystem\Cdfs \Cdfs IRP_MJ_PNP F6FDD400
Device \FileSystem\Cdfs \Cdfs FastIoCheckIfPossible F6FE0BCE

---- Threads - GMER 1.0.11 ----

Thread 4:108 866DCF48
Thread 4:112 866C5A70
Thread 4:116

[dvk01]

both logs confirm no signs of any apparant malware or known rootkits so we can quite safely rule those out as a cause now

That leads us to suspect either a corrupt or damaged driver or something recently updated

lets see what this shows

open HJT/press config/misc tools/ tick both little boxes about minor & empty sections & press generate start up list

post that back here

[martinatthetown]

Thanks for your help.

through desperation... I called the MS support team, spoke to a nice guy in new deli who attempted a system parshal repair from the XP Pro disk...
however, this did not solve the issue

it elliminated corruption of files, as cause... and left me now using IE6 not 7.

I have attached the Log file you requested.

and confirm... I am still using 100% CPU usage... I guess its all pointing to a incompatible driver issue...

I also tried disabling, std stuff, grapihics, sound, network etc... but nothing i do seems to change anything!...

[NICK ADSL UK]

Hang in there martin as there many avenues to go down and they may take some time. Once we can rule out malware ETC then we can look at your drivers and services :)

[dvk01]

nothing there either

your screenshot shows 99% cpu with only minimal memory useage by system process so it must be a driver that loads in safe mode so that brings it down to the basics like Ide drivers or keyboard & mouse driver


for soem reason I remember a similar case with mouse drivers being the cause
is your mouse a Ps2 mouse or a USB one

you could try opening device m,anager & see if any yellow warnings if nothing shows, then uninstall the mouse driver, reboot & windows will install a generic standard mouse driver

[Notok]

I would really just go through and reinstall all drivers using the latest versions from the manufacturer's website. If you use an nVidia graphics card, try uninstalling the nVidia driver and just use the default Microsoft driver (just uninstall the nVidia driver and let Windows install the one it wants to).

DPCs using that much CPU almost definitely points to a driver issue. If it started with a driver update, that would be a pretty high suspect. Unfortunately the driver updates through Windows Update tend to be a crapshoot.

[gerardwil]

Is using RATTV3 an option?

http://www.microsoft.com/whdc/DevTools/tools/RATT.mspx

Gerard

[martinatthetown]

thanks for all your advice, I am struggling currently to use the machine at all at present, and can no longer access ie from it...

I'll try all the options suggested... bare wiv me

[martinatthetown]

hi again!
Ok, I've tried removing the mouse driver and the mouse!
thats not the cause, I've also tried to change the keyboard driver, however, it auto detects and installs the current one regardless.

RATTV3 program produces a report, that I don't understand, it prob. points straight to the problem.... but... I dont know... I don't understand it!...

I've attached it to this post.... can anyone explain anything?>

I think that we're getting somewhere wiv this!

[gerardwil]

Hi,

The ACPI.sys item looks not good to me.
Info here: http://www.acpi.info/

Gerard

[gerardwil]

Did you read these already?

http://www.softwaretipsandtricks.com/forum/windows-xp/25386-high-cpu-usage-system-process.html

http://forum.sysinternals.com/forum_posts.asp?TID=837

Gerard

[rogannn]

I hope you can find a solution to this, if you did tell me how it worked. One question does you computer fail to shutdown, hibernate, ect?

[tparkinson]

-{ Quote: "I hope you can find a solution to this, if you did tell me how it worked. One question does you computer fail to shutdown, hibernate, ect?" }-

i seem to being having the exact same issue here, however it dosn't seem to be affecting my pc much apart from my raid hard drvies which are almost unsable due to the speed of them and shutting down / loging off etc do not work.

As i run my main windows build of an un raided drive then i havea stack of raided drives for programs and files and they are runing incredibly slow, yet i still get fantasic preformance in games and the like which dont use the affected hd's.

gunna try and reinstall my raid drivers etc now...

spec:

-{ Quote: "
msi k8n neo 2
atherlon xp 3800
2gb ddr400 ram (corsair)
nvida geforce 6800 gt 256mb
2 x 160gb drives (unraided)
4 x 200gb (raided)
xp pro edition
" }-

NO EFFECT... :(

[tparkinson]

i might have corrrected this problem, i think it was caused by a malicious user creating a zombie of the pc because the system process was always at 256k mem usage and considering the actuial system process varries quite a bit in its actual mem usage this made me wonder a bit.

so i wacked out the good old msconfig and had a detailed list a my boot ini and so on and found a few things that shouldn't be there on boot... a few unamed process contpletly with no actual directory listed, so i removed them and all listings in registry listing and all seems back to normal.

so id surgest a quick look in there and if you see anything that you don't know google it to find out what it is, if you dont need it get rid of it and that shoudl prob sort it out.

[rogannn]

I took it to Future Shop and they fixed the 100 CPU for 60$ which was a rip off because he just deleted some stuff but he didn't say what he did, but it works anyways. He said like basically don't use your computer so good luck fixing your computers. :)