Why is the System process spiking to 50-100% of the CPU?

May 3, 2010 12:16 PM

The "System" process on my work PC is intermittently causing the CPU utilization to spike to 50-100%, freezing the computer for a few seconds each time. Why, and is it fixable?

My work computer is currently running Win2K Pro SP4 (Yes, yes. I am supposed to get an update before July.) Until the last Windows patch, it was running fine. Since then, I've been driven to madness by slowdowns - about every 60 seconds, the System process spikes to 50-100%+ of the CPU, causing everything else to grind to a halt. It freezes everything for a little while, then gives me about 30-60 seconds of work time before freezing up again. It's mostly OK when using Office or Photoshop, etc. only, but an open browser will make the problem worse (no matter if it's Firefox, Opera, or Safari). Process Explorer shows utilization from ntoskrnl.exe+0x16b50.

Things I've done so far, in no particular order:
-Ran five spyware/malware scanners (Spy Sweeper, Malwarebytes, Bitdefender, Trend Micro, Spybot S&D) with nothing found
- Defragged, ran CCleaner, compressed registry
- Ran System File Checker (Sfc.exe)
- Cleaned out the case and fans
- Removed all peripherals, including printers
- Updated all drivers and software
- Replaced ntoskrnl.exe with same file from identical system (in all four file locations)

I'm working on a different computer now, but it doesn't have all the software I need. I have to have a browser open to get my work done, and I would prefer not having to reinstall Windows, as I'm supposed to get an upgrade to Win7 soon. I can't find any info at all about this exact issue, despite two weeks now of intermittent searching.

Anyone able to offer insight/help?

posted by gemmy to Computers & Internet (7 answers total)

Wikipedia indicates that ntoskrnl.exe is the Windows kernel. My blind guess (supported, since you replaced the kernel with a back up copy) would be that a separate process is making some outlandish requests on a semi-regular basis, causing the kernel to do a lot of work and thus lock up the system.

So the work is going to be figuring out which other process is mucking up the works.

Remove non-essential programs from the set of programs that run automatically on startup. Be aggressive in your definition of non-essential.

Try disconnecting from the internet and turning off any anti-virus software. Live-scan type programs can suck a lot of resources.

If neither of these work, start working through the list of active processes, identifying what they are using the interwebs. Kill with malice anything you didn't install and isn't a native part of windows.
posted by kaibutsu at 12:33 PM on May 3, 2010

I had a problem similar to this on Win XP. Looking into it I discovered that the system was spending a lot of time running what are called Deferred Procedure Calls (DPCs). You can't tell this from the default Windows Task Manager, you need SysInternals to get the level of detail necessary. DPCs are used by hardware drivers to do non-realtime things. From what I could learn, excessive time in DPCs are often the result of incompatible, out of date or buggy drivers. Although you mention you updated the drivers, are you sure they're all the most recent? If you have any USB devices, you might want to unplug them and see if the problem goes away. There are some driver updater programs around, though many don't support your older OS. I use Driver Magician, which does run on Win2K.
posted by tommasz at 12:36 PM on May 3, 2010

Two non-windows-reinstall things have caused this kind of issue for me before: borked antivirus apps, and defective wifi adapters. If you have any constant-on antivirus apps installed, I recommend you uninstall and reinstall them. (And make sure you don't have more than one antivirus on at a time.) If there's any external hardware plugged in, remove it and see if the problem continues.

It is also possible, albeit somewhat rarer, for a dying drive (or drive with corruption) to cause similar problems. Make sure your data's safe.
posted by Phyltre at 12:37 PM on May 3, 2010

Seconding Phyltre's assessment of a dying disk. From my experience this is the number one cause of random slow downs on older machines. Check your Event Viewer (Start->Control Panel->Administrative Tools->Event Viewer->System) to see if it's giving you any disk errors.
posted by talkingmuffin at 2:00 PM on May 3, 2010

Seconding a dying drive from past experience. See what smartmontools has to say.
posted by ob1quixote at 2:05 PM on May 3, 2010

Look at the event log to see if there are stop events. If you haven't used the event log, google's your friend. It doesn't track everything, but can be a big help.
posted by theora55 at 2:36 PM on May 3, 2010

Response by poster: Thanks, all. I've tried to use all the good advice, but nothing seemed to help.

- Process Explorer shows no issues with Deferred Procedure Calls (DPCs)
- Driver Magician shows all drivers as up to date
- smartmontools tested the Western Digital Caviar hard drive resulting in "SMART overall-health self-assessment test = passed"
- Switched from USB to PS2 mouse and keyboard - no change. Nothing else is plugged in.
- Running offline with no antivirus and no non-Windows programs didn't make any difference.
- Event Viewer (which I should have thought to check before) shows a keyboard error that went away with the PS2 keyboard switch.

Thanks for your support and help. At this point, though, I'll probably just wipe the whole thing and reinstall Windows. It will be faster than wasting time on more obscure troubleshooting or enabling/disabling processes/services one by one...
posted by gemmy at 12:11 PM on May 4, 2010