PC Freezing - Hard to explain (see details) 1

[RABOD]

Hi All,

I have a new pc I built a few months back. Very occasionaly, the pc would start freezing, but its not just constantly froze........ it freezes for a split second then comes back to life for a second, then freezes for a split second and then comes back again and so on and so on until I reboot.
During this I have checked the processes and nothing is hammering that. I have run different spyware programs and antivirus but nothing is found.
If I reboot then everything is ok again..... until maybe a few weeks later when it may happen again.

Anyone got any ideas? Here's my spec, maybe its driver related with new gear......
What can cause this strange jittery freezing?

Asus Commando Motherboard
WD Raptor 10000rpm 74GB
XFX GeForce 8800GTS 640MB DDR3 PCIE Dual DVI TVO
Intel Core 2 Duo E6600 Socket 775 2.4GHz (little OC to 3.2)
CellShock 2GB (2 x 1GB) DDR2 PC2-6400C4 800MHz Dual Channel

Thanks

 

[stduc]

Intermittent faults like this are a complete pain in the butt. You have my deepest sympathy and I wish you the best of luck.

If you are sure you have eliminated any possibility of some process spiking the CPU at 100% then.....

1. Is the CPU over heating? Check the CPU temp.
2. Are you using a lot of RAM so the page file is being heavily used? Check the page file is not badly fragmented. The easiest way to do this is to repeatedly defrag the C drive, then delete the page file, ignore the warnings, re-boot, re-create a fixed size page file that this 1.5 x the size of your RAM.
3. Could the RAM have a fault? Check the RAM - use something like memtest86.
4. Could the hard drive(s) have a fault? Check the hard drive(s) for bad sectors - personally I would use Spinrite from grc.com

5. Try to nail down what is going on at the time. If the problem persists, set up perfmon to log CPU, RAM, Hard drive and network activity to a file. Next time it happens - see if the traces give you a clue.

Hopefully an overnight run of memtest86 or a thorough check of the hard drive will throw up something.

[navy]When I married "Miss Right" I didn't realise her first name was 'always'. LOL[/navy]

 

[linney]

Next time the problem occurs, don't reboot, do your diagnosing while the fault is happening.

xp freeze troubleshooting
thread779-935320

Check out

http://www.pcpitstop.com

for some tests you can run on your PC.

SiSoft Sandra

http://www.benchmarkhq.ru/english.html?/sandradl_e.html

 

[firewolfrl]

If you can kick the voltage to the ram up a notch, some ram just do not like running at the motherboard default voltages

look outside the box. is the computer on the same circuit as another high load item? (washing machine, Fridge)

is there enough cooling?
run a house fan to the open side of the computer to rule out heat as an issue

 

[RABOD]

Its just happened again after doing as 'stduc' suggested.
I ran process explorer and found that 'hardware interrupts' was spiking.

Checked event log, and at the time of logon there are errors/warnings about netlogon, Remote Access and DCOM. These all seem extremely suspicious.

I have now disabled netlogon and DCOM and unticked the options to connect remotely to my pc (I used that to connect from work previously but I can make do without).

I've never dealt with interrupts before so not too sure what was going on.

Anyone else got some more suggestions?

ps
firewolfrl - cooling is more than fine, and no other high load items on the same circuit.

 

[stduc]

Interesting.

You might want to take a look at the advanced settings for your NIC to see if it is loading the CPU with interrupts it could handle itself.

You might want want to look into connecting to the internet via a router with a built in firewall for added protection.

You may actually have a faulty NIC. As they are so cheap it might be worth getting another one just to check.

You could install a packet tracer, such as ethereal to log incoming packets. If you don't run any internet apps (email, browser, news reader for the duration of the test) and temporarily turn off windows updates and other automatic product updaters, such as adobe, there should be NO packets on the wire! You will see the originating IP address of the incoming packets which by using a web whois service you can discover where they came from.

[navy]When I married "Miss Right" I didn't realise her first name was 'always'. LOL[/navy]

 

[linney]

Any errors logged in the Event Viewer can be expanded by double clicking on the error line.

Take any event error I.D. number and search for it on these sites.

http://www.eventid.net/events.asp

Hardware Interrupts.

http://www.google.com/search?hl=en&...esult&cd=1&q="hardware+interrupts"+xp&spell=1

 

[firewolfrl]

ah!
Try this
Show All Hidden Devices in Device Manager

http://www.pctools.com/guides/registry/detail/1107/

read up on what not to delete

delete the grayed keys that are copy of the device that is solid
be careful in the sound area because there are some devices that are grayed that are needed such as codecs and such.

that should free up some conflicting IRQ events



what PCI cards do you have installed?

sometimes the PCI card will cause this issue if it is in conflict with an onboard device

 

[RABOD]

only pci card i have is a GeForce 8800GTS.
i am connected via a router.

i have restarted the DCOM service as it was need to uninstall software.

i cant see anything strange with IRQ conflicts.

I have now turned off Windows Updates (i had a problem with that in the past using up 100% cpu). If it turns out to be this again I shall hunt and kill a certain Mr Gates.

Packet Tracer sounds interesting, I'll also give that a go.

 

[RABOD]

as a test, I ran ethereal for 1 minute, no browser or updates started etc........... so can anyone take a look at the picture below and see if this is a normal reading... I dont really understand what I'm fully seeing.

http://img171.imageshack.us/img171/6119/tcpmy9.jpg

 

[stduc]

Looks pretty abnormal to me. Read on, for the reasons I believe this.

To get some idea of what is going on, you need to look up the addresses.

I've done this for you - just this once.

69.121.117.18 is Optimum Online (Cablevision Systems)
82.27.230.134 is NTL Infrastructure for Virgin - Brentford
80.216.76.114 is SE-COMHEM-20020306 - Sweden
74.140.205.138 is INSIGHT COMMUNICATIONS COMPANY, L.P.
83.131.78.31 is Croatian Telecom Inc., Zagreb, Croatia
125.238.116.34 is FIPD-XTRA-NZ (New Zealand)

I'm not going to lookup any more!

The SSDP packets are your router having a chat, looking for another router. That is normal. You can stop the SSDP packets - IMHO they are pointless on a home network with only one router. If you wish to do so, on your router, turn off RIP and UPnP.

There is some checking you need to do. Is your router firewall functional? Are the ports in stealth mode? You can check stealth mode by going to grc.com and taking the 'shields up' test.

Your router firewall needs to be blocking all unsolicited packets (that is packets that are not replies) and also blocking certain outgoing ports. I block ports 88-95 (kerSup), 135 (DCE), 137-139 (NetBIOS), 445 (SMB) and 1025 (blackjack)

The idea of blocking these ports is to stop advertising yourself on the net.

Back to your trace.

To explain all those packets, I can only assume that you are are either running an instant messenger and chatting to people all over the world. (The IP address only gives you the owner, normally a company such as an ISP, NOT the individual). OR, your PC is infected. To be chatting like that I have to assume you have a 'bot' on board. So, if you weren't running something like MSN messenger at the time of the trace I suggest you get back to virus hunting. A quick search of tek-tips will give you plenty of advise.

To give you an idea of a "normal" trace. This is a trace I did, for one minute, whilst writing this reply.

Click on the thumbnail for the bigger picture.
Note that there is NO traffic exiting my LAN, even though I have this web page open. The only traffic is my PC's having a "chat". Put simplistically they are saying "Hi I'm here".

Bear in mind that this is not necessarily addressing your freezing issues. You will need to be tracing when that event occurs!

I hope this helps you and I haven't been too over the top!


[navy]When I married "Miss Right" I didn't realise her first name was 'always'. LOL[/navy]

 

[RABOD]

Interesting stuff mate....... Thats the good thing about having problems, you learn so much from trying to resolve the issues

I have blocked annoymous internet requests on router and a few other things and now my ethereal capture is clean as a whistle I feel a lot happier.

I also spoke to some chaps in my IT dept and they think the BIOS update I did could indeed resolve the freezing issue. (my bios version was quite old)

Thanks for everyones time and effort, only time will tell now.
Special thanks to stduc, you went to alot of effort and its very much appreciated.