BleepingComputer.com: Computer freezes for ~30 seconds every 2 minutes.

Last night my computer worked fine and nothing out of the ordinary happened - didn't download anything.

Today after I got home and switched on my computer, it started slowing down (or freezing I should say) randomly for ~30 seconds, about every 2-3 minutes. Other than that, things are running okay (I'm typing this post on it, and waiting when it freezes). Did a full scan under Avast and Malwarebyte's Antimalware, nothing out of the ordinary. Did a disk check, no errors, and restarting the computer doesn't improve the condition.

Here's the symptoms:

- In task manager and process explorer I don' see anything odd either, even when frozen/locked up the computer is under 10% usage.
- When my computer freezes in these intervals, the load/processing LED is solid blue (no blinking at all), so maybe something is trying to do something?
- Just before every freeze-up, teatimer reacts and the icon becomes active (the lock picture moves around), but no pop-ups or anything...so something is processing, or trying to.

Any help, or anyone know how I can see teatimer's active logs to maybe find these processes? . I don't see an option in teatimer to see anything, other than a log file of pop-ups such as registry changes.

Hello I am moving this to the XP forum ( Correct me if wrong) as I don't feel it a malware issue and you will get better help there.

Spybot-S&D creates logs of TeaTimer's activity and stores them in the C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\ folder. See here.

Actually, I'm using Vitsa HP (64 bit), sorry I forgot to state.

Also, I tracked down what I think is the right directory in Vista:

C:\Users\All Users\Spybot - Search & Destroy\Logs

and only found the registry change/notice logs, still nothing on the process/load logs (I wonder if teatimer even logs them?)

Tried

C:\Users\All Users\Application Data but says I can't access it (it was hidden)

This post has been edited by boopme: 28 February 2009 - 10:01 PM
Reason for edit: Moved to VISTA ~~boopme

I think you might be under some sort of attack. Do they happen on a timed purpose?

Registry Changes..? Hmm... Might be some sort of Attack as I am assuming.. I hope your Firewall is up..

I mean I can only find the logs of recorded registry changes (all from weeks ago), I can't find the option on teatimer to view process logs (teatimer also checks newly loaded processes).

And no, it's pretty random, appears to be most frequent after I turn on or restart my computer, on average it's about once ever 2-3 minutes, but right now it's more like once every 5-10 minutes. So yeah...pretty random.

Hmm.. It's not an attack. Attacks are very well organized and planned. I think you might have some sort of item stuck. Maybe your firewall is interfering. Check the programs you have before a freeze, and during, and after. See if you have any sort of difference. You might have guessed right when you said it was a program trying to access.

Yeah, well at the moment the frequency is back at ~2 minutes.

When the computer freezes, I can't open task manager either, I have to have it up before the freeze (it still works during freeze), pretty much the only thing that works is my mouse cursor, the symptoms are kind of like a buffer overflow.

Strange that though everything is frozen and my LED is on solid blue, but says my usage is around 3-8% in the task manager and in process explorer.

If I could identify any files or applications or if I could see a spike in usage, then that would be a great help, but right now I'm in the dark.

If you do, tell us. It could be a memory leak or a CPU Overflow. Sounds like a buffer overflow though. You checked that it wasn't a overflow?

I have not...I don't know of any methods to check, any help?

Am I correct in assuming tha the overload is indicated by your hard drive light showing a solid light rather than a flickering?
If so, then it's most likely to be a overzealous program accessing your hard drive.

To check this out, open up Task Manager and go to the Processes tab.
Then click on the View menu item and select "Select Columns"
Then select I/O Reads and I/O Other (I/O Writes usually doesn't turn up much, but it won't hurt) and click OK
Resize the window so you can see the I/O Reads and I/O Other columns.
Wait for the freeze and see what's doing the most I/O Reads or I/O Other - that'll be the most likely culprit.
Let us know the Image Name for that process and we can make some suggestions.

You are correct about the solid/flickering light part, on the ball!

I've done as you said (but I'm currently running Avast! again and Superantispyware, so those two have the highest atm, I'll check again when they're complete). So far multiple scans by Avast!, SAS, and Malwarebyte's AM have shown nothing, and hoping it stays that way, and yeah, the scans take 2x-3x as long due to the periodic freezeups.

Will report back in a bit, ty!

Finished all scans - nothing found.

Anyways, I see csrss.exe having 398,923 I/O Reads as of now, but I've had my computer on for about 10 hours, so is that normal/okay? The .exe does about 10 I/O reads a second...okay, it's at 399,359 as of now.

csrss.exe issues are difficult to troubleshoot. The processes causing the lockups may only appear momentarily before sending csrss.exe off to do it's damage. Are there any other processes running high when csrss.exe goes off? To make this easy, double click on the I/O Reads column header - this will sort the output by the number of I/O Reads.

Try this free utility to see what threads are running underneath the csrss.exe process: http://www.microsoft.com/technet/sysintern...ssExplorer.mspx
Right click on the csrss.exe process, select Properties, then select the Threads tab.
Let us know what threads are running underneath it - and, if possible, do this when the system has frozen.

Today I ran another chkdsk, it took a long time but fixed a few errors according to the logs. I've been running my computer for about 20 minutes so far and no problems, so I hope that will be the end of that...turns out the first chkdsk I ran failed but never noticed it.

If it does come back...under Process Explorer there are two instances of csrss.exe running, is that normal? I checked their running threads this morning and it appeared normal...even when frozen.

Anyways, if this is solved and doesn't occur again in the next 2 days, then thanks for the time invested in helping me, both of you!

2 csrss.exe processes are normal if you're viewing processes from all users.

The chkdsk issues may be due to several issues:
- there could be a program that's corrupting your file system through one of it's drivers
- there could be an issue with your hard drive physically
- there could be a corruption within Windows.

Repeated repairs by chkdsk "usually" point at a failing hard drive.