Sorry for the delayed response, Heirloom; I hadn't forgotten but I wanted to
have a little more information for you before replying.

I'm familiar with Process Explorer and , frankly, it tells me zip. If a
heart monitor was as flat as this thin green line the patient would be cold
stone dead. Typically System Idle is between 96-97%; True Vector, Zone Labs
Client, and Spam Filter, all part of ZoneAlarm, comprise together about 2%;
Sysinternals itself uses about 2%. If there are any smaller trace usages
they don't show up. The only time a spike occurs is when I deliberately
query one of the running processes and then only momentarily.

Luke, if you're reading this, the programs typically running when I do a
Ctrl-Alt-Delete are, in order: Mozilla Firefox (if I've opened Firefox);
Explorer; Zlclient (part of ZoneAlarm); Mantispm (Matador, part of ZoneAlarm
spamblocker); Vsmon (part of ZoneAlarm); Em_exec (part of Logitech);
Systray; and Isafe (part of ZoneAlarm). For those time when I use Internet
Explorer in lieu of Firefox I will see Cpal and Cpbrwtch (from Cookie Pal, a
cookie screener app that I've used for years).

That's it. The hourglass and mouse pointer aren't always associated
together when I'm ready to shutdown, but perhaps 90% of the time.

Ken Bland
==============================================
"heirloom" wrote in message
...
Get Process Explorer, free, from www.sysinternals.com . Along with
showing
you every active process (to include background) and the amount of cpu
cycles in %, used by each, it will also keep a short recording of running
items and their usage. In the upper right of the PE GUI, you will see the
graph (green line), if you hover your pointer over any 'spike' it will
tell
you what process made it. Might help you narrow down what it happening.
Heirloom, old and due a process