[Heli]

Hello,

I run
- Windows XP
- ZoneAlarm Pro
- Avira Antivirus

For "ages" my system was running without a glitch.

Since a few days it stops for a few seconds (sometimes longer) and nothing goes, no inputs, no typing, nothing. Then it resumes all activities.

I try to track, what is happening, with "Windows Task Manager" by monitoring the CPU-usage.

First I thought, that the usage by Zonelab's "VSMON.exe" was excessive. But switching it off did not change anything.

Now I am aware, that a process named "System" under the username "SYSTEM", 224K large, is the block. It occupies intermittently the CPU with 50 to 80%.

How can I diagnose, what is behind this blockage?

sincerely yours

Heli

 

[first]

see whether it happens in safe mode.

also download process explorer (http://www.microsoft.com/technet/sysinternals/security/processexplorer.mspx).in process explorer double clk system to open properties>select "threads" tab>clk thread using highest cswitch delta>clk "module" button below> click "version" to see description of driver.
find all such applns

 

[Heli]

Hello First,

many thanks for your reply.

Forgive me for late answering - I was called away to Baby-sit function for my grandchildren, which kept mebusy.

As soon as I am back at my PC, I shall follow your advise.
I'll keep you informed about the result.

sincerely

Helli

 

[Heli]

Hello FIRST,

I have done as you advised and I found the following:

Under "System" the driver, which blocks all operation is

ntoskrnl.exe

The version is 5.1.2600.3093
(xpsp_sp2_gdr.070227-2254)

All I learned is that this process belongs to NT-Kernel, but I have no idea, what it does and why it is suddenly so active, that it slows down all operations.

Can you help??

Many thanks

Heli

 

[first]

open process explorer double clk system to open properties>select "threads" tab>clk thread using highest cswitch delta>"plz give also the start address (located on cswitch's right side)of ntsokernal "

 

[first]

example= ntsokernal+0x....

 

[Heli]

hello FIRST,

the full line is: ntoskrnl.exe!ExQueueWorkItem+0x2f

Heli


Addendum:

it might help. In System Properties, below the entries are a couple of data, among them:

- Thread ID 52
- State: Wait:WrQueue
- Base Priority 12
- Dynamic Priority 12
- Context Switches (is changing all the time)