System process consuming CPU in Vista; mostly in ntkrnlpa:KiDispatchInterrupt

Question

I've been having some trouble with high CPU usage from my system process intermittently for quite a while (months). More recently, it is present all the time that Windows is running. Running with procexp sampling twice per second, the System process seems to oscillate between 0% and ~40% (ie, most of one core) with a period of two seconds.

I'm running Vista Business 32bit and Norton Internet Security. After posting on sysinternals forum, I've now uninstalled Norton in case that could might help, but it made no difference. I can of course provide other details of my system that might be useful.

I think I've done about as much diagnosis as I can at this point without asking for more expert advice. With procexp, I could see that ntkrnlpa was implicated, and following instructions here http://rfvicente.spaces.live.com/blog/cns!5228FAA8B79B6EB1!590.entry I got kernrate to tell me that KiDispatchInterrupt constitutes 84% of hits within that module.

So now what? What can I discern from these facts? It seems like it might be driver related, but I don't know what driver it is likely to be, and I'd rather just reinstall Windows than spend ridiculously long diagnosing the problem.

If anyone has a suggestion of what kind of drivers or other things might cause this, it would be much appreciated.

Answer 1

Whenever I've seen a similar problem I have been able to track it down using RegMon or FileMon because the errant process was the only thing active when I was careful not to start any applications.

If it is using CPU resources it is likely to be using other resources too. This can help track things down.

In my case the culprits were badly written drivers - e.g. a monitor "driver" that checked several times a second to see if the monitor had been rotated into portrait orientation, a HTC synchronisation driver checking twice a second for the presence of a USB link to a phone.

The vendor's name showed up in file paths or registry keys, this helped identify the cause. Disabling associated items in the system notification area confirmed the culprit (e.g. right click & choose Exit - activity dies away.)

Answer 2

I've isolated the problem to the "Broadcom 440x 10/100 Integrated Controller" network adapter in my Vostro. My current driver is 4.60.0.0 dated 28/03/2007... can't remember if or when I changed that; I'm pretty sure the problem didn't start as a direct result. Hmm. Just putting some hopefully useful information here for future generations of Googlers (apologies to any of them who find exactly the same thing copied on sysinternals). I'll try to find another driver that doesn't have this problem soon.