Hi,
I am using Windows 8 64-bit and recently I found the system freeze for seconds every serveral minutes (the mouse and sound shutters). After struggle to debug for a long time, I use the process monitor from Microsoft to see what happen inside. Everytime the system freeze, i found that there are over thousands of lines of below appear in the process monitor. I found that that is related to the system write huge data to the registry repeatly at a very very short time such that make my system freeze.
3:27:43.8673634 AM System 4 RegCreateKey HKLM\System\CurrentControlSet\Control\Nsi\{eb004a01-9b1a-11d4-9123-0050047759bc}\28 REPARSE Desired Access: Read/Write
3:27:43.8674222 AM System 4 RegCreateKey HKLM\System\CurrentControlSet\Control\Nsi\{eb004a01-9b1a-11d4-9123-0050047759bc}\28 SUCCESS Desired Access: Read/Write
3:27:43.8675532 AM System 4 RegSetValue HKLM\System\CurrentControlSet\Control\Nsi\{eb004a01-9b1a-11d4-9123-0050047759bc}\28\e41de5b068e28d43a41bf78d2cb819ca SUCCESS Type: REG_BINARY, Length: 96,064, Data:
E8 03 00 00 00 00 00 00 FC 6B C8 AF FF 95 CE 01
3:27:43.8675996 AM System 4 RegCreateKey HKLM\System\CurrentControlSet\Control\Nsi\{eb004a01-9b1a-11d4-9123-0050047759bc}\28 REPARSE Desired Access: Read/Write
3:27:43.8676714 AM System 4 RegCreateKey HKLM\System\CurrentControlSet\Control\Nsi\{eb004a01-9b1a-11d4-9123-0050047759bc}\28 SUCCESS Desired Access: Read/Write
3:27:43.8679204 AM System 4 RegSetValue HKLM\System\CurrentControlSet\Control\Nsi\{eb004a01-9b1a-11d4-9123-0050047759bc}\28\e41de5b068e28d43a41bf78d2cb819ca SUCCESS Type: REG_BINARY, Length: 96,064, Data: E8 03 00 00 00 00 00 00
FC 6B C8 AF FF 95 CE 01
3:27:43.8680395 AM System 4 RegCreateKey HKLM\System\CurrentControlSet\Control\Nsi\{eb004a01-9b1a-11d4-9123-0050047759bc}\28 REPARSE Desired Access: Read/Write
The call stack for each of the event of registry written:
0 ntoskrnl.exe PsGetProcessExitProcessCalled + 0x20bc 0xfffff800bc16580cC:\Windows\system32\ntoskrnl.exe
12 ntoskrnl.exe RtlImageNtHeader + 0x39e 0xfffff800bbd6b7e6 C:\Windows\system32\ntoskrnl.exe
What some main points I had tried to resolve but failed: