# NT Kernel & System 100% CPU



## Crossy (May 12, 2008)

Hi,

Every so often my PC becomes unresponsive immediately after startup. Task Manager shows NT Kernel & System using up to 100% of the CPU. If I Restart the PC all is well, nothing untoward in Device Manager and no abnormal download usage.

Google is inconclusive about the cause, some instances I have read about happen every time the subject PC is started but mine doesn't.

Is NT Kernel and System a valid entity in Windows 7 64Bit?

Any suggestions would be appreciated.

Rob.


----------



## aciid (Jul 18, 2008)

Hi Crossy,

If you're referring to the ntoskrnl.exe process, that is indeed a system core process. This process is previously known for causing issues with bootup, if it's corrupt for instance your machine will not boot. Therefore I would suspect that there is something wrogn with the ntoskrnl process.

1st:
See if you can restore to a previously known working restore point.
Start > Search > type "rstrui" > hit ENTER.

2nd:
Go to Start > Search > type "cmd" > Run as administrator.
Run the "*sfc /scannow*" command.
If any faults appear, choose to repair them

3rd:
Try a system repair with the installation DVD.
Insert the DVD and proceed to installation, choose System Repair instead of Install Windows Now.


----------



## Crossy (May 12, 2008)

Hi aciid, thanks for replying.

What I'm referring to is as shown in the attachment, last line, as from Task Manager. This situation only occurs from time to time, not at every boot up.

I'm not too keen on doing a System Restore because as it's only happening sometimes it may take quite a while before I know if it has been effective.

I'll try the sfc/scannow command and see what happens.

I have an OEM disc so Repair Installation is not an option.

What puzzles me is that it is so infrequent. If it was a corrupt file, wouldn't the problem occur at each bootup?

Rob.


----------



## Crossy (May 12, 2008)

sfc /scannow complete (see attachment) and no faults found.

Rob.


----------



## aciid (Jul 18, 2008)

If it would be corrupt it would most likely be caused every time, correct. There might however be some other application calling the process, and when that specific part of the process is called it might cause it to freeze.

For instance, of you have automatic updates set to run every Wednesday, that will obviously cause your logon time to be longer, and since that calls for the system process aswell, that might be affected.

I would recommend you to see over any automatic updates / other applications set to run updates on specific days, and see if they're somehow connected. If there are any confusions you might want to check the eventlog (Start > Search > eventvwr.msc), and check those days that it has happened, if any errors are occuring.


----------



## Crossy (May 12, 2008)

Thanks, will check for Auto Updates etc.

Is there any chance that this could be related to Audio Drivers?

I ask because I have noted (see attachment) in DXDIAG that I have 8 audio drivers, and many of them (5 I think) are the same. Also shows up in Device Manager.

Rob.


----------



## aciid (Jul 18, 2008)

Well considering it's a core process it will probably in some way communicate with this process. You might want to try uninstalling all the non-needed drivers aswell. I'm not completely sure that it has something to do with it, but it's worth a shot.


----------



## Crossy (May 12, 2008)

Thanks, deleted 4 of the 5 instances from Device Manager, lets see if it helps.

Rob.


----------



## aciid (Jul 18, 2008)

Alright, get back to us with the results!


----------



## Crossy (May 12, 2008)

Shall do, thanks for your help.

Rob.


----------



## Crossy (May 12, 2008)

Hi,

While wandering around in Device Manager I clicked on 'Show Hidden Devices' and to my surprise I found over 30 instances of Generic Volume Shadow Copy (see attached).

Is this normal? Could it be related to the problem?

Rob.


----------



## aciid (Jul 18, 2008)

No that shouldn't be related to this issue, I aswell have alot of them.


----------



## Crossy (May 12, 2008)

Thanks


----------



## Crossy (May 12, 2008)

Hi,

Well, it wasn't caused by the multiple Audio driver instances because they are now gone but 'IT' happened again this morning about 10 minutes after I started the PC.

I have attached a snip of the Task Manager and Resource Monitor taken at the time, and I have also noticed that there is no HDD activity while it happens. I let it run for about 30 minutes and when it showed no signs of abating I simply restarted the PC which is now running normally.

Rob.


----------



## IT-Barry (Sep 6, 2010)

Disconnect each hardware piece you have one by one starting with usbs.

See if the process goes down.

If not, turn off the pc disconnect pci cards etc reboot and see if it still reads 100% highly doubt it will unless its virus related.

If its sorted with most of the hardware removed, then proceed 1 at a time to re-add each piece until you find out whats causing it.

Note: may take a while


----------



## Crossy (May 12, 2008)

Thanks for the reply.

Only problem is that 'IT' disappears when I restart the PC.

Rob.


----------



## IT-Barry (Sep 6, 2010)

Something causes it to appear so try removing usbs and such while pcs turned on.

Turn off and you can only really have about 2 pci cards ethernet and graphics card are the norm.

Browse for a while and see if the process comes up at all, or do whatever you normally do that causes it to cause a problem.


----------



## Crossy (May 12, 2008)

I have a Graphics card as well as a Firewire card.

The problem only happens about 10 minutes after first start of the day, and once it is cleared by restarting the pc runs normally. Next time it happens I'll start progressively unplugging USB items.

Rob.


----------



## Crossy (May 12, 2008)

Had a look in Task Scheduler. There are many things scheduled to run at different times, one of which was 'Extractor Definitions Update Task' scheduled at startup and also ay 1842 each day. I deleted the 'At Startup' entry.

I also noticed that several tasks were configured for Vista (never had Vista on any machine) so I changed them to read Windows 7.

It's difficult to determine what some of the Scheduled Tasks actually do, and therefore do I need them to happen. I was thinking of moving all scheduled tasks away from Startup and placing them at different times just in case it is this which is causing the problem.

Which Tasks NEED to be scheduled for startup? Is there a reference I can read to determine if I actually want or need there tasks?

Rob.


----------



## Crossy (May 12, 2008)

Many tasks are scheduled to run in the wee small hours with the proviso that if they miss out they should be run at the next startup. Is it possible that on days where many things are scheduled to run (but can't at the set time because the PC is off) that they may then all start when I start the PC? (thus causing the observed issue)


----------



## aciid (Jul 18, 2008)

Exactly, all updates that are set to run a specific time, and the machine is off at that time will automatically cause your PC to run them next time it is started. So if there are alot of these scheduled tasks it would drain more resources at the startup.

You should always try to keep startup-processes to a minimum and make sure not too many things are set to run when you logon.


----------



## Crossy (May 12, 2008)

I've shifted all the scheduled tasks away from early morning triggers, hopefully they will execute at different times throughout the day now. There are still a few tasks scheduled at startup as I'm not sure what would happen if I reschedule them to execute at a specified time (as opposed to executing at startup).

Rob.


----------



## Crossy (May 12, 2008)

No problems at startup this morning (Saturday). Let's see how it goes over the following week because it didn't happen every day anyway.

Rob.


----------



## Crossy (May 12, 2008)

The bad news is that at 0752 this morning (Sunday) 'IT' happened again. After a restart the PC is now running perfectly again.

Is there a way of finding what was started at a specific time?

Rob,


----------



## aciid (Jul 18, 2008)

Yes, there is.
You could go into the machines System Log and see what you can find around this time.

To do so go to:
Start > Search > "eventvwr.msc" > ENTER.

Go through the System and Applications-log and see what you can find.


----------



## Crossy (May 12, 2008)

Thanks.

System Log shows Windows Media Centre Scheduler service and Windows Error Reporting Service both started at around that time. Apparently the Media Centre service is concerned with recording TV which is not what I was doing. There are actually a mass of services starting and stopping.

Rob.


----------



## aciid (Jul 18, 2008)

Alright so the big question is what actually triggers all those services to start/stop.
Do you mind extracting the eventlog for me to look at?

If so, attach it to your next post.


----------



## Crossy (May 12, 2008)

No, don't mind at all but you need to tell me how, please?


----------



## aciid (Jul 18, 2008)

Just mark the log and choose Action > Export. Do this with the systems log and the applications log.


----------



## Crossy (May 12, 2008)

Thanks.

There seems to be masses of tasks, some of which I can't decipher. I guess some of these are set in place by software (like Google) when it installs or by Windows. I have never set any of these up. Perhaps there are some we can delete? many of them were set up for Vista and I have changed these to W7.

Rob.


----------



## Crossy (May 12, 2008)

Hi,

There is no Action > Export but there is an Action > save All Events As

Rob.


----------



## aciid (Jul 18, 2008)

Do you mean tasks as in scheduled tasks? Any specific tasks on your mind?
If so you're free to delete all of these if you like.

No important application should use tasks to update/do stuff anyway.

EDIT: Action > Save all Events is fine. I'm on an XP machine right now so was just on the top of my head, but that is indeed correct.


----------



## Crossy (May 12, 2008)

Yes, scheduled tasks. There are loads of them and not all have descriptions.

The files saved as .evtx files and I don't seem to be able to attach them.

Rob.


----------



## Crossy (May 12, 2008)

Managed to save the System files as a .TXT

The last event happened @ 0752 on the 21st.


----------



## Crossy (May 12, 2008)

And here is an abbreviated Application file. The entire file was over the limit for TSF.


----------



## aciid (Jul 18, 2008)

From the log the only thing that seems to be acting up is the "Windows Media Center Scheduler Service". Could you please enter the Services-screen (Start > Search > services.msc) and set this service to Stopped/Manual and see if it's the same.

And also, how long is the ntkrnl using this much CPU? If you leave it be for 20 minutes or so, will it go down?


----------



## Crossy (May 12, 2008)

Agree about the Media Centre Scheduler Service. It is currently set to Manual.

I have let the 100% issue run for up to 30 minutes and it was still ongoing, so I then restarted the PC.

Rob.


----------



## aciid (Jul 18, 2008)

Did we ever try to run without any additional services and see if the problem occured then? (Can't find that we did in this now incredibly long post  )

Go to Start > Search > type "msconfig" > hit ENTER.
Go to Services > Click "Hide all Microsoft services".
Deselect all services > Apply.
Reboot.


----------



## Crossy (May 12, 2008)

No, we didn't.

I'll try that if you want, but It's strange that it only ever happens first thing in the morning.


----------



## aciid (Jul 18, 2008)

Well yea atleast then we can eliminate any third part application causing these processes to start, or doing something we can't control. But I agree, it's really wierd that it happens only the first boot of the morning...


----------



## Crossy (May 12, 2008)

I've stopped all the non microsoft services from starting (except Trend Micro A/V which would not uncheck) and restarted the PC with no problems.

It occurs to me that if the Task Scheduler is causing the problem by starting services/tasks, won't it still do the same? Haven't we just stopped the services from starting when the PC starts?

Thanks for your help so far, much appreciated.

Rob.


----------



## aciid (Jul 18, 2008)

Well yes and no. It will start the regular tasks that was created by microsoft services/processes. It will however not startup any processes/services from any third party application.

If it's a manually created Scheduled task it will still run though.


----------



## Crossy (May 12, 2008)

Just as I thought. There were no manually created tasks in the task scheduler.

Just so you know, there were very few services set to start in msconfig because I had already unchecked most of them some time back. I guess the scheduled tasks from Task Scheduler will still happen.

Rob.


----------



## Crossy (May 12, 2008)

Started OK this morning (Tuesday) and has been running OK for 1 hour.

Rob.


----------



## Crossy (May 12, 2008)

Started OK again this morning (Wednesday) and has been running for over an hour. I think I'll continue to keep a log of start times for a week or so and monitor the situation that way.

Thanks for your help so far.

Rob.


----------



## aciid (Jul 18, 2008)

Sounds great Rob.
Get back to us with your findings after a few days.


----------



## Crossy (May 12, 2008)

Since stopping all the non Microsoft services from starting at startup in System Configuration on 22/8/2011 the problem has not happened again. There were only 8 of them (see attachment) and the system seems to be working smoothly without them starting every time. Sort of makes you wonder why they were starting at startup, doesn't it?

Rob.


----------



## IT-Barry (Sep 6, 2010)

Some programs just manually fire themselves into startup upon install.

Audio and Video drivers are bad for this, as are freeware apps.

From the list I'd think it would be Smart TimeLock Service causing you the issue. Onlinestorage is also a lot of tripe. As are most of the startup things mind you.

Bets are open :smile:


----------



## Crossy (May 12, 2008)

Indeed they are. As I said, the system seems to be running none the worse for having none of these things start with Windows. Mind you, the Task Scheduler still starts a lot of other stuff.

I might give it a few more days then re tick the boxes for these things one at a time (starting with the ones you mentioned) and see if it happens again.

Rob.


----------



## aciid (Jul 18, 2008)

Alot of developers put their items in the startup list, either startup or services. Mostly these are not needed at all, considering they will be called for when they're needed. I barely have anything in my startup servicesi, except for the Microsoft services. But even some of those aren't really needed.


----------

