Computer Intermitantly Slowing to a Crawl

I am running XP SP3. I do not have a Malware problem (I got a clean bill of health from that forum). My computer occasionally goes to 100% CPU usage. The main culprit process are:
agent.exe
services.exe
S24Evmon.exe
FirewallGUI.exe (I run PC Tools)
svchost.exe

Usually I just close all programs and let everything work itself out. Sometimes it takes several minutes, but sometimes it is still in that state for a couple hours.

Any help would be greatly appreciated!

 

Sounds like something on your Startup list is running these.
Can you tell us what is on your Startup? Most programs insert themselves there and they don't need to be. Will run just fine as on demand and when needed.
My own personal Startup( as shown by the WinPatrol program that I use) is ma AV, firewall, and a couple of antispyware along with WinPatrol.

 

100% CPU usage? it's likely to be affected by virus. Run your anti-virus and remove them.

the question of unnecessary programs running during boot time is less possible. You may try to deactivate some unnecessary programs that are auto-start when you boot up your PC since it is simple to do.

 

to ZoeEutton55
Reread first post.They have already been checked for that and the machine is clean.

 

Hi md,

I'd like to see your startup list too


After a quick search, my guess is that your S24Evmon.exe (Intel networking event monitor) is causing some grief for your firewall - run msconfig, disable S24Evmon.exe, reboot and test, first for connectivity, then use as normal for a while to see if the CPU usage improves.

There's a suggestion that some versions of this can be a security risk too http://seclists.org/bugtraq/2006/May/0115.html, perhaps there are remote probes trying to gain entry via this loophole ... ?

Good luck.

 

Thanks for the responses. Is there anyway to create a list of things on the startup without typing them each from the msconfig list? If not, I will type it up.

Thanks!

 

Look here HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\S24EventMonitor
and see what start value you have.

This is your intel wireless and it might not need to be running at startup.
I've also seen svchost consume lots of cpu's. Let me look around and see what might be done to reign this in.

 

Open up msconfig and tell us what program agent.exe is associated with. There are so many so before I tell you to shut it off, I want to be sure it is non-essential.

 

OK, so the start value for S24EvMon is 0x000000002 (2)

I cannot find agent.exe in the msconfig but interestingly enough it is not in my list of running processes right now... I guess I will attempt to find what it is associated with when I see it causing problems again

 

I must be doing something wrong. The last two times my computer slowed down, the agent.exe and services.exe processes were really going to town. But I cannot figure out what they are associated with when I open msconfig. I even did a search of my hard drive and came up with nothing. How can I find out what they are associated with? Thanks!

 

http://file.net/process/agent.exe.html

 

ok, so I did find agent.exe in the install shield update folder. I disabled it from running on startup. We'll see what happens,
Thanks!

 

I also searched my computer for services.exe and found it in the following three files:

C:\i386
C:\WINDOWS\System32
c:\WINDOWS\ServicePackFiles\i386

www.file.net doesn't really discuss problems if the programs is in any of these three locations...

 

Those are all Windows files.

 

Ok, I won't touch those then.

So, in answer to earlier questions, here is everything that runs on startup (as far as I can tell):

00PCTFW (PC Tools Firewall)
Ad-Watch
ATICCC
avast!
Dell AIO Printer A920
DellSupportCenter
dla (C:\WINDOWS\System32\dla\tfswctrl.exe)
dscactivate (Dell Support Center)
IntelWireless
IntelZeroConfig
PCMService (Dell Media Experience)
SunJavaUpdateSched
SynTPEnh
TkBellExe
TrojanScanner
UserFaultCheck
WD Button Manager

Creative Software Update
Creative Task Scheduler
ctfmon.exe
DellSupport
DellSupportCenter
SUPERAntiSpyware

 

On my machine, I omly have my Anti virus, firewall, 2-3 antispyware.
Everything else is on demand.
What does that tell you?

 

not even the intel wireless or zeroconfig?

 

Are the needed or absolutely necessary?
Your choice on them, but most you showed are NOT needed.

 

cool thanks - I turned off (almost) everything!

 

So.How is it running?

 

so far so good. taking all the stuff off of startup solved another problem I was having too, which is an added bonus. If I don't have any issues in the next couple days, I'll say I'm in the clear!

 

Keep me informed.

 

sigh - problem reoccurred. This time is was services.exe as well as iFrmewrk.exe, explorer.exe (which I know is the valid one and not malware) and taskmgr.exe

Don't know if this helps, but it always happens when I am surfing the web. IE7 or Firefox - doesn't matter

 

Perhaps a bit offline here and far from my field of expertise, but have you done a dxdiag in the run menu and seen what the drivers are doing or checked for damaged partially installed acitveX components..try deleting temp files while your at it..thats all I got to say I anint no malware expert though. Oh the other thing if slow downs have you got some software that scans for bots I hear bad things about some of these. Check ressources irq's arent over stretched - two many devices using the one irq that is if youve rescently added new hardware or drives etc...hey take this advice with a grain of salt so to speak and I hope you get up and running back to normal asap.

Gluck Guy:wave

 

thanks necro

dxdiag came back with no problems detected (except a btaudio.sys with no signature file but I doubt that is the problem)

not sure how to check for partially installed activeX components and not sure of a good program that scans for bots

 

Alright ... if you cant find a softwhere issue it might pay to start checking HW ... run memtest 3.8 (its bootable so you've gotta burn the image to a disk and boot from it) if you have ANY errors it might be causing issues ... also run a chkdsk /r from your bootable XP or Vista CD/DVD ... again ANY bad sectors MAY be causing your issues ...

I'm guessing you've ran READ AND RUN ME FIRST and Basic Computer Maintanence Everyone Should Do

Let us know after they're done ... :major

 

hey Drizzles,

Yes, I have run the read and run first and the basic maintenance

as far as mem test - the free version runs while the computer is running - are you saying I should buy the $14 version and run off a boot CD? thanks!

 

Oh sorry ... that's my mistake I forgot I had the registered version ... the Pro version is better but the standard one will do ... run it while using your computer minimally and then run the chkdsk ...

 

if youre still not sorted yet.

Suggest you check out the agent part as you noted, it maybe an updater for antivrus software. If you've got more than one antivrus piece of software running concurently then this may certainly cause some "fun".

One thing I've heard a few people mention is turning off antivirus tea-timer or real tme protection..sounds a bit risky to me though. These run typically as part of antivirus products, not sure how this affects the system when your online, so if anyone here can enlighten us that would be appreciated.

I'd also check your services and make sure there is nothing strange sitting in there, when software is added (sometimes) depending on the type of software it will add an entry to the services. Could be causing an issue.

L8r Guy:wave

 

drizzles

I have run MemTest and gotten to 800% with no errors. I have not had a chance to run chkdsk cuz I can't seem to find my system CD...

necro,
thanks for the tips. I tracked down agent to Install Shield Updater and disabled it at startup.
All of the services look right, but I probably wouldn't be able to spot malware if it was disguised well enough

Thanks for all your help!

 

Well thats alright, open up CMD and type chkdsk C: /r ... it will ask to run next time you restart press y and hit enter and restart ... let us know the results.

 

OK, ran chkdsk without any errors found

 

mmmm this does sound like one of those fun ones ... one last thing ... does it do it in safe mode? Oh and also it wouldnt hurt to go to CMD and type;
sfc /scannow

 

I ran sfc /scannow and it finished without saying anything - I assume that means it was all good.

I will check on safe mode and let you know

 

Hi again,

Have a look at any recent drivers, there may have been an update from microsoft or any automatic update per-chance, could be an issue with an incorrect or failed auto installed driver or even bho or a busy irq that gets choked at certain points as the bandwidth shrinks say if you have cd running audio being processed and possible default irqs being used, Irq 5 takes a hit from quite a few devices, although you could also have an ethernet cable with a short in it which intermittently gets the packets through over the net, this takes longer to assemble a page as the data is resent because it has to make up for the dropped packets - this not a common fault but not unheard of.

Then again could be way of the money g.luck with this one, its about all I could suggest as generic options for a trouble shooting. Yes tho check activeX and bho's status for corrupt or missing. also check for things like reload webpage at each vist or run from cached version of the page check for newer versions of this webpage everytime options, if your used to a certain speed and selected these then it may appear that the internet has slowed. , depending on the content you may also require flash player of some variant, pages with moving images typically ask for this to update your p.c and play the content and this maybe required...?L8r:wave

 

Given it a go yet?

What are your system specs by the way?

And just clarifying ... it ONLY happens when surfing the net or at other times also?

 

I was not able to duplicate it in safe mode.

I have only ever had it happen while using a web browser. Basically, it has happened in two different circumstances.
First, I like to play a couple of browser-based games that cause Firefox to use about 50% of the CPU. Sometimes the usage will creep higher and higher and if I don't close Firefox before it gets too high, it will cause the problem I have been having.
Second, sometimes I will just have Firefox open and I leave the room for a few minutes and I come back and notice the problem.
Neither of these things happened in safe mode.

In addition, another problem that I thought had gone away when I disabled most of the startup stuff has now reoccurred. I don't know that the two things are related, but I can explain the other problem in detail if you would like.

 

Couldn't hurt and might help.

 

Do you use any Nortons products?

Don't give up just yet ... if we can't figure out any Software issues then we move onto Hardware

 

I do not use any Norton products.

OK, my other problem is a bit more complicated (and I apologize for not mentioning it before - I thought they were unrelated because this other problem has been happening for months and the one in the OP just started):
On startup - I get an svchost.exe error or two and Windows Generic Host encounters a problem and must close. If I click "OK" or "Cancel" or "Debug" any these error messages it slightly changes the appearance of my system tray and then intermittently causes a problem where my internet connection will go out and I cannot restore it without restarting the computer.

On restart or shutdown - many programs are unable to close and I have to click "End Now" or whatever it is. Then, eveything will be off my screen except for the background but the system will not turn off. I have to do a hard reboot.

These problems went away for a few days when I disabled a lot of things at startup, so I assumed they were connected to a process that was automatically running. But now they are back, and I didn't change anything, so I am not sure what the problem is.

Thanks!

 

Yes that definitely helps narrow it down ... it shifts the target area away from HW and back to SW (considering you said chkdsk showed no errors) ... honestly ... it might be beneficial in a lot of ways to you to simply back up all of your data and to a clean, fresh install.

I'm in the process of doing one right now ... although mines because of an entire system upgrade ... I make it easier on myself but ... I have an External Docking Station, which means I can swap between my Programs, Documents etc drive and my Backup Drive ... On the Internal drive, I DO NOT have ANY documents, photos, music, downloads etc etc etc ... ALL of those bits of data that you would KEEP are on my External Drive, so when I go to do a fresh install, there IS no backing up, it's simply a matter of putting the disk in, formatting and reinstalling ... just a tip ...

 

I have considered backing up and starting over, but I just hate doing that. I would like to solve the problem if possible using the clean install as a last resort - one of the main reasons being my computer is three years old so all my install disks are three years old and it will require a lot of updating to get everything up to current again

 

Ugh...I just got a BSOD

 

Alright well lets do the easy stuff first then ... remove every wire from your mobo except the essentials ... leave HDD, Power Pins. Remove everything else including optical drives, front audio jacks, front USB ports, internal speaker, reset button, LEDs, power button and any secondary HDD. Also remove all unnecessary cards, including add in Video Cards providing your mobo has an operational Video Card built in. Then boot. See if it makes a difference.

 

Sorry just realised I didn't tell you how to boot, just get a flat blad screwdriver and connect the two Power Button pins with it, as soon as your fans start spinning release it.

 

wow, sorry I have been so long in responding. I am studying for the bar and it is eating up so much of my time. Anyway...

Drizzles, I appreciate the advice but I really don't feel comfortable physically taking anything apart. I am really clueless about this stuff and I am afraid I will ruin something forever.

Dom, I ran the debug (had a second BSOD today) and here is a copy of what I found. I don't really know what it means or what to do next:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini060409-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Jun 4 14:02:46.109 2009 (GMT-7)
System Uptime: 1 days 16:14:49.355
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000C5, {4, 2, 1, 8054b1fa}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1f4 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8054b1fa, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExDeferredFreePool+1f4
8054b1fa 894704 mov dword ptr [edi+4],eax

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8054b75f to 8054b1fa

STACK_TEXT:
ba4e3c88 8054b75f 00000001 88ff206c 88ff2008 nt!ExDeferredFreePool+0x1f4
ba4e3cc8 804e559c 88ff2008 00000000 806e6a4c nt!ExFreePoolWithTag+0x47f
ba4e3cfc 804e4b03 00000001 80559690 88e861c0 nt!CcDeleteSharedCacheMap+0x160
ba4e3d34 804e70db 8ac36298 80564820 8ac3e998 nt!CcWriteBehind+0x357
ba4e3d7c 8053877d 8ac36298 00000000 8ac3e998 nt!CcWorkerThread+0x12f
ba4e3dac 805cff70 8ac36298 00000000 00000000 nt!ExpWorkerThread+0xef
ba4e3ddc 805460ee 8053868e 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+1f4
8054b1fa 894704 mov dword ptr [edi+4],eax

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExDeferredFreePool+1f4

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+1f4

BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+1f4

Followup: Pool_corruption
---------

 

Got another BSOD. I would really appreciate a followup. I know I abandoned the thread for a while, but I really hope I can get some more help on this issue.
Here is the debug report:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini062209-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Jun 22 13:26:15.046 2009 (GMT-7)
System Uptime: 3 days 15:23:38.585
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000C5, {4, 2, 1, 8054b1fa}

Unable to load image aswMon2.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswMon2.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswMon2.SYS
Unable to load image PCTAppEvent.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for PCTAppEvent.sys
*** ERROR: Module load completed but symbols could not be loaded for PCTAppEvent.sys
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1f4 )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8054b1fa, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExDeferredFreePool+1f4
8054b1fa 894704 mov dword ptr [edi+4],eax

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: firefox.exe

LAST_CONTROL_TRANSFER: from 8054b75f to 8054b1fa

STACK_TEXT:
b122e394 8054b75f 00000001 8053ba65 e40556b4 nt!ExDeferredFreePool+0x1f4
b122e3d4 b21143e0 88204008 00000000 876a3008 nt!ExFreePoolWithTag+0x47f
WARNING: Stack unwind information not available. Following frames may be wrong.
b122e424 b211446a e4055698 876a3008 876a3008 aswMon2+0x43e0
b122e874 b2114619 b2119268 876a3008 eeaa4008 aswMon2+0x446a
b122e8cc b211624e eeaa4008 00000000 b2119264 aswMon2+0x4619
b122e9e0 b21167e0 87df3fdc 87df3e28 b122ea17 aswMon2+0x624e
b122ea18 b211083c 8a7c4248 00df3e28 804ef19f aswMon2+0x67e0
b122eb14 805bf450 8abe2900 00000000 882000c8 aswMon2+0x83c
b122eb8c 805bb9dc 00000000 b122ebcc 00000040 nt!ObpLookupObjectName+0x53c
b122ebe0 80576033 00000000 00000000 22ec7801 nt!ObOpenObjectByName+0xea
b122ec5c 805769aa 0012f38c 80100080 0012f32c nt!IopCreateFile+0x407
b122ecb8 805790b4 0012f38c 80100080 0012f32c nt!IoCreateFile+0x8e
b122ecf8 b1c296ad 0012f38c 80100080 0012f32c nt!NtCreateFile+0x30
b122ed30 8054162c 0012f38c 80100080 0012f32c PCTAppEvent+0x96ad
b122ed30 7c90e514 0012f38c 80100080 0012f32c nt!KiFastCallEntry+0xfc
0012f384 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+1f4
8054b1fa 894704 mov dword ptr [edi+4],eax

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExDeferredFreePool+1f4

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+1f4

BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+1f4

Followup: Pool_corruption
---------

 

Well a couple of things you could do, uninstall and re-install Mozilla Firefox. After that, insert your Windows CD in the CD/DVD Drive, go to the Start Bar and go to the RUN command and type sfc /scannow. Then Uninstall and Re-install Avast. THIS LINK is a link to remove Avast completely, do not remove it the normal way. Lastly, has Windows or have you updated any Drivers recently? Also you use PC Tools. Uninstall and Re-install that.

If none of this works the easiest way would probably be to format and re-install. Remember it will not just put a fresh fully working OS on there but it will be much faster as well.

 

Thanks Drizzles - I'll follow all the steps and let you know how it goes. I appreciate the help

 

No prob :major