"System" process using 100% of CPU

Hey guys. Somone please help me with this. This has been going on for months. I upgraded my PC a few months ago. From the jump I couldnt play DC. It displayed these problems. It appears to be allow kernel activity as well. See below picture.

I just formatted and installed ONLY what is listed below, and they were all the most current drivers.

New system was a platform change. Epox 4PDA2(Intel 865PE) - P4 2.8E(Hyperthreading enabled) - Kept my ram(dual 512 PC2700 Corsair XMS) Dual Channel - Gainward ti4600 - Audigy 2 - Neatgear GigE Card - 2 x Raptors in Raid 0 - 2 - Maxtor 80 gigs in Raid 0

So...
fresh install (xp sp1a)
chipset drivers
direct x (9b)
video drivers
sound drivers
windows update

Install Doom 3 and bam 15 minutes later the game gets horrible(laggy and choppy) I exit the game, check the task maanger "System" using anywhere from 69 to 100% of the CPU(varies wildly) I can reboot the system and its fine. Start the game(Doom 3, Desert Combat(Battlefield 1942) and viola choppy again. Check task manager System using all the CPU again. BTW ... if I just use the PC for anything but gaming it never happens. Oh yeah, and I can play Need For Speed Underground with out it messing up(these are really the only three games I play)

First thing I thought as well was video subsytem. New drivers. Made sure my directx install was clean.

Memtest and prime95 show no problems.

Attached is an image of the box FREAKING out.

Update.

The first person that gives me a fix for this problem. That actually works. Ill submit any information you need to know to solve the problem.

Ill paypal you cold hard cash. 30$ sound good? Its all yours all you have to do is figure out how the hell to fix this crap so I can play some video games again.

I had that exact thing happen when I had a hard drive on my Raid0 start to die... Do you have any SMART monitoring software installed?

you don't have NAV02 installed do you? (NAV = Norton anti-virus
EDIT: What version of NVidia drivers are you using?

what happens when you close that process that takes up so much cpu usage

you said this happened when you installed D3, so have you tried uninstalling it

try running adaware (from lavasoft) and window washer (from webroot) and get nortan system works (gotta pay but its worth it) and run its computer fixing problem stuff (ive had problems with my comptuer before and it fixed it really quick

alos im not shure if you said you did this but run windows update an get anyhting that looks like you would need

Its one of many possible things:
MS Messenger running (not even being used)
Switching HDD with wrong jumper settings, Master in center of cable
CPU overheating (fan off?) CPU not seated?
corrupted hardware driver(s)
virus (did you D/L Doom from internet?)
some device or controller in device manager that is installed but disabled in bios.
Like 1394EE or USB or IRDA adapter or card reader or unused PCI card or plugged in USB scanner or something (disable legacy usb in bios)
check disable in this hardware profile box for latter, or disconnect
this program will tell you what each system process is used for

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

Another thing anti-virus scanning in background. Disable Norton or anything else like that from startup and check usage then.
God, I hate NAV.

The INDEXING Service can be the problem!! Just go to administrative tools under the control panel and turn it off.

Also .....Start > Run.....(type) sfc /scannow

If you go to www.majorgeeks.com in the search box..
(all free or trial)
Stinger (McAfee)
Webroot spysweep
spybot
Adaware (latest reflist on home page of MG)
CWS Shredder (Coolwebsearch)

also you can download HiJackThis 1.9.8.1, for use later as a involved scan with us here.

go thru my Spyware removal guide . then post your hijackthis log and i will tell you what to remove.

Ok. Ill try to get everything. I apologize in advance for this being lengthy.

First and foremost let me just say im extremely technical(i do this for a living) I have been through a lot of this already, but I was too lazy to type it out. I wont be lazy now since I have some people actually trying to help So ill touch on all the posts that have been left.

I am running Raid0 ---- I don't have any monitoring utils installed currently, but then again I dont have anything installed(stuff I listed, email for work, and putty for work) I did check the hard drives previously and got no errors. I did consider breaking my raid but I wanted to avoid this if at all possible.

No Norton installed this go around. I was Norton Corp on the previous build, but like I said I have formatted.

I can't close the process. Its the "system" process owned by the machine. Nothing happens when I try to kill it. I havent tried unstalling D3, however it did this before I ever installed D3 and I was just playing Desert Combat. I can play Need For Speed Underground all day and night and this never happens. I ran adaware on the previous build, and found nothing. Im rather anal about my system and I clean it reguarly. Got all the windows updates when I reinstalled.

MS messenger i just havent gotten around to removing(it wasnt present on the previous build) HDD are set correctly and running on independent channels anyway. CPU is warmish but still way cool(HSF is fine as well) Previous build had semi current drivers and I had the issue .... I have all the current drivers on this build and issue still present. Im fairly certain I dont have a virus, but then again I have no antivirus installed right now(Doom is legit) Nothing installed and disabled in the bios. The next thing is an interesting point...Ill check legacy USB as soon as I post this. Otherwise nothing else like that(no irda, no scanner plugged in(or any other device otheer than my mouse) Im familiar with all the processses that are running(no wierd services either) No AV installed as I said) Indexing is set to manual and not running. I have disabled this service just in case. sfc scan was fine. I havent run any anti-spyware gear, but like i said fresh install, no crap installed at all, and a firewalled PC.

Ill be more than happy to post my hijack this if you guys want to see it.

Update:

No legacy USB option in the bios, everything else is sane.

BTW. I am doing NO overclocking. No aggressive voltages on anything. Pure flat cold stock settings.

Thanks again guys. Let me know if you want me to post a hijack this log.

Run it in SAFE MODE, go ahead post it, but check stuff in advanced -

You didnt D/L and use process explore??? Need that info man

What firewall - did you try turning it off???

Offhand, I recall that one of the last MS updates slows machines way down

well what i would recommend at this point then is backing up your imporant stuff and reformating

Ill post the hijack this log and just a second and the process explore stuff.

Just the MS firewall untill I was patched, which is turned off now. The entire time I was behind a linux firewall(iptables) and still am. I dont know anything about an update causing problems, but I am fully patched via windows update.

Not really looking to format and resintall again. Ive done that 3 times now total and it hasnt solved the problem.

hijackthis:

Logfile of HijackThis v1.97.7
Scan saved at 4:01:46 PM, on 8/7/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://windowsupdate.microsoft.com/
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38204.771412037
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab


Process Explorer:

Process PID CPU Description Company Name
System Idle Process 0 99
Interrupts n/a 1 Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4
smss.exe 668 Windows NT Session Manager Microsoft Corporation
csrss.exe 716 Client Server Runtime Process Microsoft Corporation
winlogon.exe 740 Windows NT Logon Application Microsoft Corporation
services.exe 784 Services and Controller app Microsoft Corporation
svchost.exe 980 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1024 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1120 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1144 Generic Host Process for Win32 Services Microsoft Corporation
spoolsv.exe 1300 Spooler SubSystem App Microsoft Corporation
nvsvc32.exe 1428 NVIDIA Driver Helper Service, Version 61.77 NVIDIA Corporation
lsass.exe 796 LSA Shell (Export Version) Microsoft Corporation
explorer.exe 152 Windows Explorer Microsoft Corporation
daemon.exe 376 Virtual DAEMON Manager DAEMON'S HOME
procexp.exe 1828 Sysinternals Process Explorer Sysinternals

Process: Procexp Pid: -2

Type Name

I don't immediately see anything out of the ordinary there, but I might be missing something. Try going to command prompt (Run>CMD.exe) and do a TASKLIST /SVC and see if anything comes up under the SYSTEM image name, mine reads n/a, see if anything comes up under yours. There might be something hidden in there. If there is, go and find out what it is then decide whether or not you want to remove it.

Just for the heck of it, have you tried a new video card? Or maybe roll back video drivers to an earlier version (say, any of the 50 series detonators?).

My reasoning is this. You say that these are the only two games that will cause this problem, and that's only AFTER running the game, you have no problems before. Isn't DC based on the Quake III engine? I think that it is, but it may not be (edit: after a little websearching, I don't think it is). Also, Doom has a new engine to it, but both are based on OpenGL graphics systems. I don't know for sure but I am betting that NFS is fully DirectX. It is possible that you are having an issue there with how Windows / the video card is translating the instructions that it is being sent. If it can't load OpenGL drivers correctly, you may have a video card issue.

edit: It occurs to me that you might be able to run another OGL heavy program, maybe d/l a demo of Quake III and run it at max video settings and see if the same thing happens.

I am speaking in pure hypothetical's here but everything in the HijackThis log looks ok as does the process explorer. I am also going to assume that Intel's chipset drivers are ok, they build some pretty solid drivers in most cases.

But if you do have an old video card, it's at least something to take a look at.

Have you looked at any of the event logs?

Cheers.

You were sure right - you dont have squat on the system.

the nvidia driver helper service is for beta stuff, not wqhl drivers, but I would make it disabled, uncheck startup
http://www.beginnerspc.com/articles.cfm?articleid=1590&page=32
http://www.iamnotageek.com/a/128-p1.php

spoolsv is for printers, only causes 100% CPU when on network terminal srv and cant find it - spinning wheels.
you dont have your printer configured for server/network??

Some RAID chips require both drives to be jumpered master
one time I put HDD master in middle of cable and drive ran quietly all the time - made it hot as a pistol.

this guy says spike normal for games
http://forums.binarydreams.us/archive/index.php/t-1994.html

Im wondering about your Ti4600. Can you pull it and try a shitty PCI vid card - I use a $20 SIS sometimes. I know it wont run your game hardly, but would like to see cpu usage with it.

Ok guys .... heres the skinny.

More time and money invested.

I am now running an ATI Radeon 9800 pro. Latest catalyst drivers installed(and I formatted and reinstalled again to go along with the new video card)

I still get the exact same shit. I also tried disabling hyperthreading. Still no dice.

I tested the opengl ideas. Ran the HELL out of quake 3 time demos and had no problems what so ever. Never got chunky.

Still after 5 minutes of Doom3 and Desert Combat the "system" process in the task manager spikes like a bastard(see images on first post)

I appreciate the help sorry it took so long to get back. I was trying to get a new vid card.
Cash is still up for grabs for whoever can solve this.

Maybe TaskInfo 2003 can help .

Let me know if that gives you any insight. Do you have any devices hooked up to the PC? Printer/usb/something? Also check your hosts file, and see if theres a lot of 127.0.0.1 entries. Spybot tends to put a LOT of 127.0.0.1 entries in your hosts file - c:\windows\system32\drivers\etc - which can significantly slow your machine and cause these problems.

After those - Check into this possible solution -

I have also had this problem with XP, the cpu usage suddenly surged to 100% and the only thing that corrected this was a shutdown and power off, after which it would boot back as normal, i:e idling at 1 - 3 % CPU usage. After much investigation I found the cause to be a file, cisvc.exe, which is involved in recording file details for the search facility. It seemed that if this programme was running in conjuction with another operation that required a large amount of CPU usage, in my case a game, or perhaps a power surge caused this problem. The resolution was to turn the "indexing service" to manual rather than the default setting of automatic. This can be done through services, which is in accesories/system tools. If it is not here you can usestart/run/services.msc I hope this is helpful to some of you folks.

Click to expand...

Ill hammer on it tonight and look at taskinfo when the box is freaking out.

There is nothing special attached to the box. Mouse, keyboard, speakers, monitors, and ethernet plugged in.

No spyware and my hosts file is clean

Indexing service is already set to manual. I will however check and make sure it hasn't started for some reason while the proc is pegged and cracked out.

Good luck buddy

I really think it's time to evaluate hardware here, seeing as this testing is being done on a fresh OS:

After getting the error, restart, get into the bios and check the cpu temp and voltages.

If you have the option, reset your bios to "failsafe."

Pull the sound card, have had a creative labs do similar to me, but on DVD playback.

lmk

Bios is correct. Ive been over it with a fine tooth comb.

Not running hot(removed heat sink and reapplied as and reseated it just in case) Voltages are good as well.

I guess ill give the sound card a go tonight or tomorrow.

And here I hoped the DireWolf would be right.

First is the soundcard as was suggested ^^^. Pull it, remove the drivers (and associated creative crap) and see what happens. Maybe it is the drivers for the positional audio causing problems (again, though, you'd NFS would cause an issue). Didn't Carmack say something about having to use Creative software because of a licensing agreement? Don't remember for sure. I am assuming that you have disabled fully the onboard sound card. If you have, you might reenable it and see what you get. You also might try a different slot for the sound card, Creative is picky about its resource assignments.

Next, pull out the GigE card. It sounds weird but what the heck. I am assuming the you have fully disabled the onboard GigE port.

Next, if you don't have anything on those RAID arrays, you might want to break one of them apart and see if you have the same problem. Don't attach the other arrray while testing.

Next, you might think about motherboard problems, though the only real way to test that is to get anothe rmotherboard and see what happens. That costs money unless you have your old mobo hanging around. If you do, you might start swapping parts in and out of it to see if the same thing happens. Latest BIOS for your board looks to be 19Mar04. Double-check. If you already have done this, I apologize in advance. You also might want to fully disable the Firewire port.

As I understand the system process correctly (from what I have read) it seems to hang up if there is a driver that it can't load or talk to correctly. So it sits around and tries to talk to it until it achieves sucess or you reboot. This is very likely not the only purpose of the system process but the only thing that I can come with at the moment.

For the heck of it, have you gone through the services that are running on startup? You may go through the services.msc file and double-check the purpose of all those that are listed as manual or disabled. It's possible that one of those that the PC needs to run was inadvertantly turned off (though I consider this possibility low).

Cheers.

So I got so fucking fed up I decided to head off to Mexico Sorry it took me so long to get back to you guys. I was on vacation.

Ok .... heres the skinny now. Yanked the audigy 2, running off on board audio. Same f'in deal. Attached is a screenshot using task manager and taskinfo. You can see the thread thats using all the proc or the majority of it anyway(no idea what it is though, as there isnt a lot of info) Also pay close attention to the majority of the usage being kernel time.

Im about spent man ..... I dont know what else to try. I really dont want to spend anymore money diagnoising the problem(already bought a video card and feel like now I should buy a new motherboard)

Anyway ... check it out ... again if anyone can figure this out(with out me having to buy a new motherboard or some crazy shit like that) Ill give you all the money I have in my paypal account. Like 47 bucks or something close to that. If anyone is interested for whatever reason Ill attach screen shots of all my bios settings if you guys thing that might hel;p? Anything just name it.

Oh yeah... I have tried breaking the raid previously as well as not having my highpoint(raid0) up at all. Single drive, master ide with nothing else same problem

did the dance with the gige cards and drivers and onboard vs pci as well

A very high amount of CPU usage by the kernel has always been because of a shitty driver in my experience. I've had it happen in Win2k and Mac OS X, oddly enough.

Some driver getting loaded into windows is at fault. I can feel it, man..

Try this..

Go into your bios and disable every freaking onboard this or that.
Only hook up what you absolutely need to play those problematic games.
1 HD + Vid Card + Mobo + CPU + RAM + Key/Mouse + CD
Reinstall (sorry ) Winders. or maybe wipe winnt/system32/drivers and do a "repair" with the Install disk.

If you still end up having the problem after that, I'd be very surprised.

Don't know if you still have this problem with CPU but I asked on what I find to be the best Windows forum I have used - very knowledgable guys.

LINK

O.K. I'll bite again, I love punishment.

A. Shorting motherboard - take out of case and run on top of mobo box foam.
B. Do NOT install XP with SP1, JUST XP, there is a patch for XP SP1 running high CPU usage with certain mobo
http://www.nforcershq.com/modules.php?name=News&file=article&sid=388
C. If you can get ahold of a copy of Win 2K see if it halts when installing. If so, its for sure a hardware prob.
D. Bent/broken CPU pin. Carefully reseat CPU in socket after examining - while holding down processor with fingers.
E.L1 or L2 cache disabled in bios by mistake
F.Change PNP O/S in bios to enabled or disabled. Enable ESCD update.
G. RMA mobo for another........ bad cpacaitor, scratched mobo trace, cold solder joint.
H. Buy all new cables.
I. APIC or ACPI confllict with bios - flash to earlier or later BIOS. Or install O/S as standard PC HAL at setup (F5)
J. Scratched, corrupted XP install disc.
K. Bad CPU - Intel does RMA pretty nicely actually.

Still a bit confused here.
Its running high CPU kernal with fresh format/install, no games apps installed, all the time??
You know, I dont want your reward, and you should take that $47 and go on ebay and buy another mobo for that or less (or the For Sale/trade here)

I really think that XP Pro without SP1, Standard PC HAL is your starter here.

OK. Let's see if we can go at this another direction.

You've got something interesting in the pic above. Your TCP graph is spiking regularly, five times at about the same interval. If you can, you might want to run TaskInfo before you play games and then after the problem happens. Look to see if the same problem happens. As a comparison, I downloaded and ran TaskInfo and my network graph doesn't do this. Were you running TaskInfo right after startup? If so, the NIC may be trying to gain access and that might explain it. But something to look at.

On your XP CD you should be able to find a copy of a program called pstat.exe in a directory. Extract it to the desktop and after the problem starts, go to a command line and navigate to the desktop. Run the pstat program like this: "pstat >stat.txt" (no quotes) at the command prompt. This is going to create a file that is going to have a ton of info in it. What you are going to want to do is read down through the file until you get to the System process, it should be the first entry under the running process (it is on mine).

If you read under the system heading, you will notice that times are listed there. What you want to do is look at the thread that is taking the most time (ideally, it will be the one that you are having the problem with). Look left and note the TID handle (far left column).

What you are going to do then is to go back to TaskInfo, select the System process in the left pane, then look at the bottom right pane. There are a few tabs there that are of interest, but we want the Handles tab. Click that and scroll down until you find the TID number of the thread identified from pstat. Looking right, you should see the type of handle that it is and the name of it.

I am going to guess that it is going to be TCP related. I seem to have a 11 sec delay on a TCP6 thread, not sure why.

Now, where does all of this take us? All this is really doing is pointing to the offending thread and give a direction to look to see what's causing it. Could it be drivers? Maybe. Hardware? Maybe. Rogue virus? Don't know. I am almost at the limit of what I know and some pretty serious research would be coming if you want to pursue this.

I know that there are people around here who might be able to help more (Ice Czar, GrenME, M11, and Phoneix86 come to mind) as this is deeper into windows that I normally go.

Keep us posted.

Cheers.

edit: whoops, how could I forget Ranma_Sao?

cisco guy said:

O.K. I'll bite again, I love punishment.

Click to expand...

QFT. Apparently, we both do.

I would love to see what a new mobo does but I don't know if that's a feasible option.

Cheers.

QFT???

You have a bad driver. There are several ways to debug this, goto devmgmt.msc, and disable the extra devices, and see if it makes a difference, hook up a kernel debugger and see which driver is spiking (Most direct way of finding out, but hardest to setup), etc...

cisco guy said:

QFT???

Click to expand...

Quoted for truth... there was a lot more to that post and this had been edited out but the forum wasn't capable of posting at that point (for whatever reason) and the edit didn't make it. At this point, I don't even have any idea what I was saying in that post... it's too early.

Ranma, can you elaborate a little on the kernel debugger? Is there one included in windows?

Cheers.

http://www.microsoft.com/whdc/devtools/debugging/default.mspx

All you need is there. If you are experiancing problems and can send me a mini dump I can help you take a look at it.

Ok I started through the newest suggestions last night. I got about 75% through and nothing was helping. After I formatted AGAIN and played the first 15 minutes of Doom3 again(for like the 100th time) i cursed really loudl and went to newegg and bought a new motherboard. Its either the MB(or a driver associated to it) or the processor. If this doesn't fix it, then Ill RMA the proc. If that doesn't fix it then I guess Ill throw my desktop in the rover and stick to my laptop.

Im actually gonna try the debugger when I get home. I just now saw that post. Just kinda for piece of mind.

Ill update again shortly.