System process is taking over 50% of CPU time

Vic Russell

unread,

Aug 11, 2006, 3:34:27 PM8/11/06

to

Hi,
I have XP SP2 -completely up-to-date I think - and the System process is
taking over 50% of the CPU time - all the time! Any ideas how to track down
the cause of the problem. It's a bit tricky when it is the main Windows
process that seems to be causing the problem!

Regards,

Vic Russell

Unknown

unread,

Aug 11, 2006, 4:13:33 PM8/11/06

to

You need to find the specific process in that application that's taking all
the CPU resources.

To do this try Process Explorer:
http://www.sysinternals.com/Utilities/ProcessExplorer.html

Once you have Process Explorer installed and running:
Click on the CPU column to sort processes by %CPU usage.
Then click on the process that using most or all the CPU %, once it
highlighted, right click
and from the options listed select: google
This should display what out there on the web about that process.

Note: some entries like svchost may need to be expanded to show the detail,
in this case click on the + located to the left on the entry.

JS

"Vic Russell" <nos...@nospam.com> wrote in message
news:%23oAue0X...@TK2MSFTNGP02.phx.gbl...

Unknown

unread,

Aug 12, 2006, 11:23:21 AM8/12/06

to

If it's the System process and not a sub-process underneath it as your
attachment shows then it could well be a rootkit (stealth virus).
Googled: http://www.google.com/search?hl=en&lr=&q=rootkit%2Bremove

JS

"Vic Russell" <nos...@nospam.com> wrote in message

news:%23ip8Pge...@TK2MSFTNGP06.phx.gbl...
> Thanks for that JS
>
> It is the System process itself that is using 50% of the processing time.
> Expanding the Process Tree shows that there is nothing much underneith
> System which is using any time at all. It is something internal to
> Microsoft's System process. I wonder if anything has corrupted System!
>
> I have attached a view of the Process Explorer screen if this may help
> shed
> any light on the problem.
>
> Any further ideas?
>
> Kind regards,
>
> Vic
>
> "JS" <@> wrote in message news:eO3kmKY...@TK2MSFTNGP05.phx.gbl...

Vic Russell

unread,

Aug 13, 2006, 7:25:59 AM8/13/06

to

Thanks again JS.

Before I get into rootkit stuff (looks complicated), a few more clues and
details.
1) I have Norton Anti-Virus completely up-to-date (includes spyware)
2) I have ZoneAlarm Pro completely up-to-date (includes spyware)
3) I have PestPatrol completely up to date
4) The System process doe not exhibit the 50% CPU time when I boot in Safe
Mode with networking
5) When I use MSCONFIG and stop everything I can and reboot, the sytem comes
up again and pauses at the MSCONFIG screen. At this point the task manager
and ProcessExplorer show very few processes but the System process still
shows 50%

Any comments on this?

Kind regards,

Vic
"JS" <@> wrote in message news:%23C98FNi...@TK2MSFTNGP03.phx.gbl...

Unknown

unread,

Aug 13, 2006, 11:39:15 AM8/13/06

to

Boot to safe mode and do a Virus scan.
Next: Rootkit detection software is just another flavor of Stealth Virus
detection, so find a free version that you can download, install and run.

JS

"Vic Russell" <nos...@nospam.com> wrote in message

news:eqN8Ctsv...@TK2MSFTNGP02.phx.gbl...

Vic Russell

unread,

Aug 13, 2006, 1:45:03 PM8/13/06

to

Will do. I'll let you know how things go.

Thanks for your help.

Vic
"JS" <@> wrote in message news:uVkIp6uv...@TK2MSFTNGP06.phx.gbl...

Gordon

unread,

Oct 1, 2006, 2:14:19 PM10/1/06

to

"mark" <ma...@discussions.microsoft.com> wrote in message
news:239ABC87-1F87-4F16...@microsoft.com...
>
> Hi, I have exactly the same problem as stated here and have tried
> everything
> said in this thread but really don;t know how to fix it! It is EXACTLY the
> same! can anyone give anymore advice?!

What thread? You've started a new post with a new subject. This is NOT a
chat room, this is a newsgroup.

Baloo

unread,

Oct 1, 2006, 4:30:23 PM10/1/06

to

Gordon wrote:

Gordon, change your sort to "Sort by conversation" or "Sort by thread."
The Subject: header is not an indicator of what thread, the References:
header is. Sort by conversation/thread takes References: into account.

Mark should have quoted properly to help avoid confusion, however...
http://learn.to/quote

--
Baloo
email & xmpp: ba...@ursine.ca

Rock

unread,

Oct 1, 2006, 5:44:14 PM10/1/06

to

"mark" wrote

> Hi, I have exactly the same problem as stated here and have tried
> everything
> said in this thread but really don;t know how to fix it! It is EXACTLY the
> same! can anyone give anymore advice?!

Unfortunately you have started a new message thread so we have no idea what
the problem is. This is a newsgroup, not a board or forum, despite the web
interface. When asking a question it's important to include all the
relevant details. Also create a new thread for your issue, don't post your
problem as a response to another thread. I have included a link with info
on how to make a good newsgroup post.

Making Good Newsgroup Posts
http://dts-l.org/goodpost.htm

You might want to consider using a newsreader to access this newsgroup,
rather than the web interface which is awful. XP comes with one, Outlook
Express. Here is an article that explains how to setup OE for newsgroups.

http://www.michaelstevenstech.com/outlookexpressnewreader.htm

--

Rock [ MVP User/Shell]

Gordon

unread,

Oct 2, 2006, 3:01:38 AM10/2/06

to

"Baloo" <ba...@ursine.ca> wrote in message news:v3l5v3-...@ursine.ca...

> Gordon, change your sort to "Sort by conversation"

I do that by default. I also only view unread messages. thus a change of
subject without a "was: {put old subject here}" appears as a NEW thread.
particularly when the OP didn't quote anything either.
BTW, it's not correct Netiquette to change the subject line without any
reference to the old.