The thread that was pausing had fwdrv.sys loaded (the kerio firewall driver) - it is possible it was just a victim, but I'm fairly sure it was the culprit. If you boot into safe mode w/ networking, does the problem continue?

As to your second question, reading and analyzing dump files is something you'll get better at if you do two things:

1. Read (many times) the book "Windows Internals, 4th Edition", by Mark Russinovich and David Solomon. It describes in great detail the inner workings of the Windows NT kernel, including priority, memory managment, security model, network stack, etc. A must for anyone doing kernel debugging.

2. Get into a kernel debugging class led by someone who knows and understands it, either at your local training center or some other way.

I have found it!!!

It's the Windows Bluetooth driver and a new Sony Ericsson phone. If I turn off the phone, the problem disappears. If I turn it on, the problem will show up again. As usual I discovered this by pure chance, but I have installed the Widcomm drivers for my bluetooth device and the problem has gone away.

Does it make any sense in the memory dump?

--

PS: Thanks for the tips on learning!

Edited November 24, 200619 yr by comomolo

Yes - I see another thread where the fwdrv is pausing exactly while the bluetooth driver is being called. So it looks like the fwdrv driver is being paused while the bluetooth driver is being used, but in the dump it looks like the fwdrv is causing the pauses (and in fact, it may be making it worse - I wouldn't call it the victim completely, because it is causing a pause in csrss.exe for the user). Now that I know what that process was (with the bluetooth driver), I can say that it does have some threads that are exhibiting behavior of a pause (can't tell why from the dump, though). Fantastic find!!!

Thanks to you and to the rest. You have been amazingly kind and have kept my hope alive.

Regards,

CM

lol - you're very welcome. Good luck in the future, and I again suggest the Windows Internals book - you'll learn A LOT.

Hm, Sony causing problems again eh? Shows why you should make a backup/restore point before installing new stuff. (Protip: Windows automatically makes restore points before installing unsigned drivers and some programs.)