Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

PC totally locks up 21 minutes after last touch of mouse


  • Please log in to reply
10 replies to this topic

#1 RayF10

RayF10

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:35 AM

Posted 08 May 2018 - 09:07 AM

My Dell Studio XPS 7100 (Win 7 SP1) consistently locks up after 21 minutes of inactivity.  If I am actively using the system it runs without any issues for hours and hours.  As soon as I need to step away, I log the time and bring Task Manager (sorted on CPU usage), and Resource Monitor to the front.  When I return, the system is locked, and the posted time is 21 minutes from the time that I logged.  I have taken photos of the frozen screens to see if there is anything consistent...find nothing!  Event Viewer doesn't list anything of note happening at or just before the freeze.

 

Hoping that someone knows of a product that will keep a detailed log of EVERYTHING that is going on in this system to help me find the culprit.  Thanks... 

 

PS: MS Security Essentials show all OK, and Malware Bytes finds nothing wrong either.



BC AdBot (Login to Remove)

 


#2 Allan

Allan

  • BC Advisor
  • 8,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:01:35 AM

Posted 08 May 2018 - 09:57 AM

1) Please check your Power Options in control panel. Is the hd or anything else set to power down after 20 minutes of inactivity or is SLEEP enabled after a defined time period?

 

2) You say the system freezes. Is there any way to "unfreeze" it or do you have to reboot?



#3 RayF10

RayF10
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:35 AM

Posted 09 May 2018 - 07:32 AM

Thanks for the quick reply.  A couple of weeks ago I had disabled sleep, and set the HD timer to 10 mins just to see if that had an effect...none.  Also disabled the screen saver.  It seems like it might be some other background process that is enabled after 20 minutes of inactivity (like the HD power).  Again, review of all logs and the snapshots of the Resource Monitor and Task Manager show no consistency at all.  Item that appears in just less than half of the snapshots is the "Search Indexer."  Guessing that I might have to resort to stopping all startup items and services, and reintroduce them in groups to narrow it down.  Will cost me several hours to get that done, but might be my only option.  Was hoping that someone on this forum knew of a program that would create a different log that might record the offending process.

PS: must turn power off and then restart.


Edited by RayF10, 09 May 2018 - 05:07 PM.


#4 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,663 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:35 AM

Posted 09 May 2018 - 09:09 AM

Have a look at the process tools at Sysinternals:  https://docs.microsoft.com/en-us/sysinternals/downloads/process-utilities

 

Process Explorer is a much more detailed Task Manager.  For example, you can expand service host process to see what is running underneath it.  Or Process Monitor or ProcDump--the latter has a Windows hang monitor that might be useful to you, altho it says it defines hang the same as Windows, so if it isn't showing up in Event Viewer, it might not show up there either.

 

Some of these are command line tools, which is a bit above my pay scale, but others on here can probably help you run them.  I think the monitor app makes a massive log that has to be filtered to the few seconds of actual occurrence.

 

If all else fails, there is also Sysmon. It will record everything your computer is doing, but as such produces a log that is even more massive.  Not sure these monitors are any more time efficient than going thru all your startup processes one by one (or in groups).


We always did feel the same

We just started from a different point of view

Tangled up in blue--Bob Dylan


#5 Allan

Allan

  • BC Advisor
  • 8,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:01:35 AM

Posted 09 May 2018 - 01:19 PM

Please boot to safe mode and see if the same thing happens.



#6 RayF10

RayF10
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:35 AM

Posted 09 May 2018 - 05:05 PM

No lockup in Safe mode.  Probably going to give Sysmon a try to see if it is precise enough to record a recurring event at the 21st minute.  If that doesn't find the problem, then I will have to resort to Clean Boot and then re-add startup and services in a tedious, but logical sequence.



#7 Allan

Allan

  • BC Advisor
  • 8,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:01:35 AM

Posted 10 May 2018 - 06:19 AM

Exactly. If safe mode works it's almost certainly something loading with the system. Also, you might want to check Task Scheduler.



#8 RayF10

RayF10
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:35 AM

Posted 14 May 2018 - 08:43 AM

It took a long time to narrow this down to the offending program/service, but my problem seems to be the "SuperFetch" service.  Tried deleting the 3 database files that were recommended in another search, but that did not fix it.  Stopping and disabling it has seems to have resolved the issue for the time being.  According to what I have read about it, it is a valuable service that I should not disable, but I did not find any warnings about it possibly being virus laden version either.  For now I will leave it disabled since I have not experienced any negative effects thus far.

Thanks for your help!



#9 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,663 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:35 AM

Posted 15 May 2018 - 10:41 AM

Thanks for posting back with your results.  Very strange to see Superfetch as the culprit.  I have to say a couple of things, tho.  One is I don't think we're dealing with a virus but a glitch.  There is nothing special about Superfetch in regards to malware.  Second is I think another process might be responsible but is having a problem with its caching in Superfetch.  However, if you have run the system for some time and the problem has not reoccurred, then that may not be the case.

 

One thing you can try in order to get Superfetch back is to reset it by deleting the files in the *:\Windows\Prefetch folder, then re-enable Superfetch service, reboot and see if the problem re-occurs.  Windows will rebuild Superfetch but you computer may slow down a bit until it does.  It may also be useful to analyze what files are in that folder, so before deleting you might want to create and run a batch file that will list all of the files in the folder--How to Create a File List using Simple Batch File.  Keep this info somewhere like My Docs so you can find it later--it might also be useful to save the *:\Windows\Prefetch\Layout.ini file for later analyses as well.

 

Also, is there an SSD drive in this machine?


We always did feel the same

We just started from a different point of view

Tangled up in blue--Bob Dylan


#10 RayF10

RayF10
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:35 AM

Posted 15 May 2018 - 05:24 PM

PC has been running quite well since I stopped the Superfetch service.  I did notice that the list of program files is outdated as there are a few deleted programs on there.  I will simply rename the entire folder and re-enable the process and will let you know how that turns out.  BTW - no SSD in this PC.

Thanks for your help!



#11 Papakid

Papakid

    Guru at being a Newbie


  • Malware Response Team
  • 6,663 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:35 AM

Posted 16 May 2018 - 10:43 AM

Yes, back in the XP days when Prefetch (precursor to Superfetch) was new and misunderstood, for a short time I bought in to the myth that the prefetch folder should be cleaned out from time to time--but never noticed any appreciable difference in performance.  Still, it is a memory management tool designed to reduce your hard drive's seek time (thus it's not needed for SSD drives, which is why I asked) and thus extend the drive's life, so using it, if possible, should be of some benefit. 

 

It would be safe to delete the Prefetch folder, but renaming will work just as well, you just won't recover that bit of disk space.  Just be sure to reboot after restaring the service.  I appreciate that you will let us know how getting Superfetch turns out.  Such feedback increases the knowledge base for everyone.


We always did feel the same

We just started from a different point of view

Tangled up in blue--Bob Dylan





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users