system process at 20%...how to find what's causing this!??

[rsf]

Hello
I have a small render farm and 2 of the nodes are a lot slower then the
others....way slower
I found that the system process in these nodes is taking between 12 and 20%
and not 0% as the other nodes.
I've checked for virus and trojans and found nothing (as expected because
these nodes are not connected no the internet and don't have any more than
the necessary software)
How can I check what's causing this??
I searched the net and they point "performance" program to check this but I
can't figure out how.
I have a program called "process explores" from "sysinternals" that shows
processes in an hieralchical way but...the "system" branch shows arround 20%
but theres no process beneath it that justifies this percentage...only
winvnc4 uses about 0.77
Can someone help me figure this out?
Thanks

 

[rsf]

Hello!
Using the "process explores" from "sysinternals" I can see that the "system"
process is using to much cpu (10 to 20%)
I don't really understand the hierarchical scheme here but the cpu load is
on "system" not any of the processes below.
Viewing the thread properties for this process I see that the one with the
star address "ntoskrnl.exe+0x1d77cd" is the one using the cpu.
This really doesn't help me much...what should I do next??
This is very strange because I have 10 machines with no internet connection,
just the basic necessary software and this only happens in this two?!
All the nodes are xp home.
Any help please!?

 

[rsf]

Ok...
I found this article http://sandbox.zeroaffinity.com/2005/07/26/5
As I said I could identify that the 1st thread of he system process is ising
to much cpu.
The precess ID is 4, the thread ID is 8 and the start adress is 3772123083
Using the calculator I could translate the star adress to E0D607CB
Now I'm trying to find this thread in the pstat but I can't.
I don't know how to use Debugging Tools for Windows as mentioned in the
article so I copied the pstat results to notepad and searched the adress.
I found this:

pid: 4 pri: 8 Hnd: 449 Pf: 8597 Ws: 224K System
tid pri Ctx Swtch StrtAddr User Time Kernel Time State
8 0 21295393 E0D607CB 0:00:00.000 0:43:43.562 Ready
10 13 21740 E0B942F1 0:00:00.000 0:00:00.359 Wait:EventPairLow

Can someone give me some help here?? I can't see anything that could lead me
somewhere!
I have a render job going and these nodes are way slower then the others. A
17 mins frame is rendered in 50 mins
Off course I could spend some time reinstalling everything in this nodes but
I would really prefer to know what's happening.
By the way...I already unpluged the machines because I saw some post
refering this but no luck.
Can I get some help from microsoft please!!
Thanks