Jump to content

process named System eating up CPU


thehofenator

Recommended Posts


The "SYSTEM" process represents the kernel executive, meaning any process loaded in kernel - basically, if you've got any file system filter drivers loaded (antivirus, antispyware, firewall, etc), it could be causing this. A few questions to be asked:

1. When did this start happening?

2. What changed on your system before this started happening?

3. If you pull the network cable from the machine, does the problem continue?

4. If you boot into safe mode, does the problem occur?

5. If you download autoruns and shellexview and disable all non-Microsoft items in these two utilities, does the problem persist?

Link to comment
Share on other sites

Sorry about the wait, here are some answers:

(answer #'s corraspond to question #'s)

1. About a week ago

2. Nothing changed before it slowed down, it just slowed down drastically, no firewall or anti spyware or anti virus software newly installed in the past month. I currently have AVG Free, Spybot-Search and Destroy, and Zone Alarm.

3. Yes the problem still continues

4. No the problem does not still occur

5. Yes the problem still continues

Edited by thehofenator
Link to comment
Share on other sites

Since the problem does not occur in safe mode, but disabling all user-mode non-Microsoft services and startup items, this actually only leaves actual hardware drivers, and file system filter drivers (whether they be antivirus, antispyware, or firewall filter drivers).

If you configure your machine for a complete dump via the keyboard, you can dump it to help determine what is running in kernel. Here's what you do:

1. Create or set the following registry value:

Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters

Value: CrashOnCtrlScroll

Type: REG_DWORD

Data: 1

2. Right-Click on the "My Computer" icon on the desktop and select "Properties"; this will open the "System Properties" window. Go to the "Advanced" tab and click "Performance Options". Click "Change" under "Virtual Memory". Set the pagefile to be located on the partition where the OS is installed, and set it to be equal to Physical RAM + 50 MB.

3. Also in the "System Properties" window, click on the "Advanced" tab, then click "Startup and Recovery". Make sure "Complete Memory Dump" is selected. You can change the location of the memory dump file to a different local partition if you do not have enough room on the partition where the OS is installed.

4. You will need to reboot for these changes to take effect.

5. Once the machine is up and SYSTEM is using 100% CPU, hold down the RIGHT CTRL key and press the SCROLL LOCK key twice - this will cause the box to bugcheck and create a memory.dmp file.

Once the box reboots and comes back up, you should be able to open the file in windbg or cdb for analysis (or let me know via PM if you want an upload location for me to look at it).

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...