Hi Guys,

Apologies if I am in the wrong section- this is my first post on these boards. Anyhoo, hello (!) and thanks for looking at my predicament

For the last 2 weeks, my computer has been running really slow - especially (though not exclusively) when I run IE. I thought it might be IE7, so I removed it and - surprisingly - it didn't have any effect. I then decided to do some detective work.....

From reading other forums/friends advice, I checked my task manager and found that a file called SYSTEM is running on my CPU between 90 - 99 pretty much all the time. I am unsure what this means (or, I know the basics) but I know that it is not supposed to be that high. I believe I should reiterate that the file is called "SYSTEM" not "system idle process" - surely this is the wrong way round? Shouldn't my idle process be around 90?

I downloaded Process Explorer and run it but I've no idea what I'm looking for!!

The readings showed that DPCs are running at anything between 40 - 50 and Hardware Interrupts are between 26 and 50 of my CPU. I'm assuming - in my limited computing knowledge - that this is not great??!

Can anyone advise what I can do to change this? I is driving me insane - and I can't seem to find any specific solution!! Though admittedly, I'm pretty useless on a computer.

I really can't reinstall Windows, as I've too much information and nowhere to put it!!! I've heard that the DPC and HI could be due to a buggy connection - is this possible? Also - if it is - how do I go about checking the connections?? There are no yellow warning triangles in my device/hardware manager!

Here are the specs of my computer :

Compaq SR 1200
Pentium 4 3.0Gb
Ram 1 Gb
XP Home SP2
AVG 8.0

I'm not sure of any more of the specs but I have made no additions to the computer since i bought it (e.g. external drives, new mouse etc) except installing a wireless router - which was nearly 2 years ago!! I never use the computer for anything other than editing photos, music and occassional word processing.

Any help would be most appreciated!!

thanks,

Matt

There are two processes: System and System Idle. That'll be the Image Name in Task Manager. The User Name for each of these will be SYSTEM.

One of two things could be happening:

1/
The image "System" can host other services. If one of them is malware or you have something loaded at startup that's gone wrong, and if that is hosted by "System", then there's your problem.

2/
If the word isn't "System" but it's all caps or someother distortion, then you've probably got a trojan. Other clues are very high memory use.

You would need to list the services that are running and look for something unusual. This is done from Admiistrative Tools in Control Panel. You could post an attachment with the list here for us to take a look at.

Also if you can list the programs that are loaded by Windows at Startup, that'll possibly provide valuable clues.

I didn't get chance to actually look at my computer last night. I'll have a look tonight, do what you've suggested and post the results.

thanks for the advice though!

Hi,

I have attached the services information as a text document. It looks a little crazy but hopefully you'll get the idea (and understand it a little better than I do). I've also looked at my startup programmes and there's nothing in there that shouldn't be.

Any information you can give me would be amazing - I'm still massively stuck!

thanks!

So the services look fine (half expected that). Right, so, discounting a trojan, this is what it it is likely to be (doesn't make it easy to fix):
1/
"System" is called by a kernel level process that must run.

2/
This could be a hardware demand, like the power system (ACPI).
Or it could be a device that's calling for a service when it shouldn't be; the device is faulty.

You can google & download a process monitor and get deeper information but there are two potential immediate steps:

1 Update now to XP SP3 - may fix a bug (in ACPI?)

2 Turn ACPI off in BIOS and Windows

Let us know.

Thanks for this info,

I'm away this weekend so will do these steps as soon as i'm back - on Sunday night.

I'll let you know how i get on!

I've done all the steps you suggested but with no success. I've also used process monitor but have no idea what I'm looking at. It seems that the main 'programmes' running are:

19:33:40.2578755 svchost.exe 1148 RegCloseKey HKCU SUCCESS
19:33:45.7685429 wuauclt.exe 3052 RegCloseKey HKLM\SOFTWARE\Microsoft\COM3 SUCCESS
19:30:32.9491913 svchost.exe 1148 RegOpenKey HKCR\CLSID\{1108BE51-F58A-4CDA-BB99-7A0227D11D5E}\InprocHandler32 NAME NOT FOUND Desired Access: Maximum Allowed

svchost appears in many different forms so I'm guessing that this is standard??

Having read your otiginal post again, I should have spotted the DPCs. The Windows Kernel is required to service these DPCs and they occur usually because something's not right in the hardware somewhere. Have a read of this article:
http://www.microsoft.com/whdc/Driver/tips/DPC_ISR.mspx

Perhaps you could accumulate the Tracelog or post a text file with the Process Explorer results so we can see the DPCs and what might be deduced from them.