shralias causes svchost.exe to use 100% cpu

  • This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.
Apr 9, 2010
4
0
#1
I have been using your product at home and work for many years now (4dos, 4os2, 4nt, tcc..).
Please keep up the good work :-)

I have, however, run into one of the stranger problems. I use:
TCC 11.00.44 x64 Windows 7 [Version 6.1.7600]
TCC Build 44 Windows 7 Build 7600

and observed that svchost.exe frequently ran at 100% cpu loading (100% of one core, that is).
To cut a long and tedious story short, I eventually found the, or a, cause.

When
shralias.exe
is loaded (using "shralias"), svchost.exe will eventually ramp up to 100%. It does not happen immediately, maybe after a few minutes.

Unloading shralias ("shralias /u") immediately drops svchost.exe to an acceptable cpu usage.

Consistently reproducible, consistently puzzling ..
 

rconn

Administrator
Staff member
May 14, 2008
10,100
85
#2
> I have, however, run into one of the stranger problems. I use:
> TCC 11.00.44 x64 Windows 7 [Version 6.1.7600]
> TCC Build 44 Windows 7 Build 7600
> and observed that svchost.exe frequently ran at 100% cpu loading (100%
> of one core, that is).
> To cut a long and tedious story short, I eventually found the, or a,
> cause.
>
> When
> shralias.exe
> is loaded (using "shralias"), svchost.exe will eventually ramp up to
> 100%. It does not happen immediately, maybe after a few minutes.
>
> Unloading shralias ("shralias /u") immediately drops svchost.exe to an
> acceptable cpu usage.
Not reproducible here. Anybody else able to reproduce this?

All SHRALIAS does is sit in a GetMessage loop; it's difficult to imagine how
that could be causing an unrelated svchost process to max out the cpu
(particularly since there is no service involved in SHRALIAS or TCC). Try
starting Task Manager, and then right-click on the afflicted svchost.exe
process, and select "Go to Service(s). That will highlight the services
running under that svchost.exe process, which might throw some light on
what's happening.

Are you running any plugins?

Rex Conn
JP Software
 
#3
On Mon, 12 Apr 2010 01:16:29 -0400, ibrs <> wrote:

|When
| shralias.exe
|is loaded (using "shralias"), svchost.exe will eventually ramp up to 100%. It does not happen immediately, maybe after a few minutes.
|
|Unloading shralias ("shralias /u") immediately drops svchost.exe to an acceptable cpu usage.
|
|Consistently reproducible, consistently puzzling ..

Odd! Does Win7 have TASKLIST.EXE? If so, run it (see below) to see what that
instance of SVCHOST is doing. Don't confuse it with the built-in TASKLIST. On
XP, SVCHOST doesn't seem to do anything of concern to SHRALIAS.

v:\> s:\tasklist.exe /svc /fi "imagename eq svchost.exe"

Image Name PID Services
========================= ====== ============================================svchost.exe 1160 DcomLaunch, TermService
svchost.exe 1228 RpcSs
svchost.exe 1484 AppMgmt, AudioSrv, BITS, CryptSvc, Dhcp,
dmserver, EventSystem, HidServ,
LanmanServer, lanmanworkstation, Netman,
RasMan, Schedule, SENS, TapiSrv, w32time,
winmgmt
svchost.exe 1544 Dnscache
--
- Vince
 
May 20, 2008
110
0
CA
#4
Here's the output on my Win7 x64, that doesn't have the problem in question


> tasklist.exe /svc /fi "imagename eq svchost.exe"
Image Name PID Services
========================= ======== ===========================================svchost.exe 1092 DcomLaunch, PlugPlay, Power
svchost.exe 1200 RpcEptMapper, RpcSs
svchost.exe 1344 AudioSrv, Dhcp, eventlog,
HomeGroupProvider, lmhosts, wscsvc
svchost.exe 1376 AudioEndpointBuilder, hidserv,
HomeGroupListener, IPBusEnum, Netman,
PcaSvc, SysMain, TrkWks, UmRdpService,
UxSms, Wlansvc, wudfsvc
svchost.exe 1408 AeLookupSvc, BITS, Browser, CertPropSvc,
EapHost, gpsvc, IKEEXT, iphlpsvc,
LanmanServer, MMCSS, ProfSvc, Schedule,
SENS, SessionEnv, ShellHWDetection, Themes,
UxTuneUp, Winmgmt, wuauserv
svchost.exe 1680 EventSystem, fdPHost, netprofm, nsi,
W32Time, WdiServiceHost, WinHttpAutoProxySv
svchost.exe 1940 CryptSvc, Dnscache, LanmanWorkstation,
NlaSvc, TermService, Wecsvc
svchost.exe 2068 BFE, DPS, MpsSvc
svchost.exe 4408 Net Driver HPZ12
svchost.exe 5204 Pml Driver HPZ12
svchost.exe 5784 FDResPub, FontCache, SSDPSRV, upnphost,
wcncsvc
svchost.exe 5812 stisvc
svchost.exe 1576 WerSvc
svchost.exe 7624 PolicyAgent
svchost.exe 8024 p2pimsvc, p2psvc, PNRPsvc
svchost.exe 10212 swprv

- Federico



----- Original Message ----
From: vefatica <>
To: fromano@pacbell.net
Sent: Mon, April 12, 2010 6:37:40 AM
Subject: RE: [Support-t-1864] shralias causes svchost.exe to use 100% cpu

On Mon, 12 Apr 2010 01:16:29 -0400, ibrs <> wrote:

|When
| shralias.exe
|is loaded (using "shralias"), svchost.exe will eventually ramp up to 100%. It does not happen immediately, maybe after a few minutes.
|
|Unloading shralias ("shralias /u") immediately drops svchost.exe to an acceptable cpu usage.
|
|Consistently reproducible, consistently puzzling ..

Odd! Does Win7 have TASKLIST.EXE? If so, run it (see below) to see what that
instance of SVCHOST is doing. Don't confuse it with the built-in TASKLIST. On
XP, SVCHOST doesn't seem to do anything of concern to SHRALIAS.

v:\> s:\tasklist.exe /svc /fi "imagename eq svchost.exe"

Image Name PID Services
========================= ====== ============================================svchost.exe 1160 DcomLaunch, TermService
svchost.exe 1228 RpcSs
svchost.exe 1484 AppMgmt, AudioSrv, BITS, CryptSvc, Dhcp,
dmserver, EventSystem, HidServ,
LanmanServer, lanmanworkstation, Netman,
RasMan, Schedule, SENS, TapiSrv, w32time,
winmgmt
svchost.exe 1544 Dnscache
--
- Vince
 
Apr 9, 2010
4
0
#5
I use procexp instead of the task manager and attach zipped screen shots of the runaway process (svchost.jpeg) and its services.

Not reproducible here. Anybody else able to reproduce this?

All SHRALIAS does is sit in a GetMessage loop; it's difficult to imagine how
that could be causing an unrelated svchost process to max out the cpu
(particularly since there is no service involved in SHRALIAS or TCC). Try
starting Task Manager, and then right-click on the afflicted svchost.exe
process, and select "Go to Service(s). That will highlight the services
running under that svchost.exe process, which might throw some light on
what's happening.

Are you running any plugins?

Rex Conn
JP Software
 

Attachments

Apr 9, 2010
4
0
#6
The same command here produces:
Image Name PID Services
========================= ======== ============================================
svchost.exe 780 DcomLaunch, PlugPlay, Power
svchost.exe 864 RpcEptMapper, RpcSs
svchost.exe 928 AudioSrv, Dhcp, eventlog, lmhosts, wscsvc
svchost.exe 112 AudioEndpointBuilder, CscService, hidserv,
Netman, PcaSvc, SysMain, TrkWks,
UmRdpService, UxSms, Wlansvc, wudfsvc
svchost.exe 376 AeLookupSvc, Appinfo, BITS, CertPropSvc,
EapHost, gpsvc, IKEEXT, iphlpsvc,
LanmanServer, ProfSvc, RasMan, Schedule,
SENS, SessionEnv, ShellHWDetection, Themes,
Winmgmt, wuauserv
svchost.exe 1132 EventSystem, netprofm, nsi, SstpSvc,
W32Time, WdiServiceHost, WinHttpAutoProxySv
svchost.exe 1300 CryptSvc, Dnscache, LanmanWorkstation,
NlaSvc, TapiSrv, TermService
svchost.exe 1568 SCardSvr, SSDPSRV
svchost.exe 1620 BFE, DPS, MpsSvc
svchost.exe 2972 stisvc
svchost.exe 3776 WinDefend
svchost.exe 4628 bthserv
svchost.exe 3916 PolicyAgent
svchost.exe 1204 SDRSVC

Here's the output on my Win7 x64, that doesn't have the problem in question




Image Name PID Services
========================= ======== ===========================================svchost.exe 1092 DcomLaunch, PlugPlay, Power
svchost.exe 1200 RpcEptMapper, RpcSs
svchost.exe 1344 AudioSrv, Dhcp, eventlog,
HomeGroupProvider, lmhosts, wscsvc
svchost.exe 1376 AudioEndpointBuilder, hidserv,
HomeGroupListener, IPBusEnum, Netman,
PcaSvc, SysMain, TrkWks, UmRdpService,
UxSms, Wlansvc, wudfsvc
svchost.exe 1408 AeLookupSvc, BITS, Browser, CertPropSvc,
EapHost, gpsvc, IKEEXT, iphlpsvc,
LanmanServer, MMCSS, ProfSvc, Schedule,
SENS, SessionEnv, ShellHWDetection, Themes,
UxTuneUp, Winmgmt, wuauserv
svchost.exe 1680 EventSystem, fdPHost, netprofm, nsi,
W32Time, WdiServiceHost, WinHttpAutoProxySv
svchost.exe 1940 CryptSvc, Dnscache, LanmanWorkstation,
NlaSvc, TermService, Wecsvc
svchost.exe 2068 BFE, DPS, MpsSvc
svchost.exe 4408 Net Driver HPZ12
svchost.exe 5204 Pml Driver HPZ12
svchost.exe 5784 FDResPub, FontCache, SSDPSRV, upnphost,
wcncsvc
svchost.exe 5812 stisvc
svchost.exe 1576 WerSvc
svchost.exe 7624 PolicyAgent
svchost.exe 8024 p2pimsvc, p2psvc, PNRPsvc
svchost.exe 10212 swprv

- Federico



----- Original Message ----
From: vefatica <>
To: fromano@pacbell.net
Sent: Mon, April 12, 2010 6:37:40 AM
Subject: RE: [Support-t-1864] shralias causes svchost.exe to use 100% cpu

On Mon, 12 Apr 2010 01:16:29 -0400, ibrs <> wrote:

|When
| shralias.exe
|is loaded (using "shralias"), svchost.exe will eventually ramp up to 100%. It does not happen immediately, maybe after a few minutes.
|
|Unloading shralias ("shralias /u") immediately drops svchost.exe to an acceptable cpu usage.
|
|Consistently reproducible, consistently puzzling ..

Odd! Does Win7 have TASKLIST.EXE? If so, run it (see below) to see what that
instance of SVCHOST is doing. Don't confuse it with the built-in TASKLIST. On
XP, SVCHOST doesn't seem to do anything of concern to SHRALIAS.

v:\> s:\tasklist.exe /svc /fi "imagename eq svchost.exe"

Image Name PID Services
========================= ====== ============================================svchost.exe 1160 DcomLaunch, TermService
svchost.exe 1228 RpcSs
svchost.exe 1484 AppMgmt, AudioSrv, BITS, CryptSvc, Dhcp,
dmserver, EventSystem, HidServ,
LanmanServer, lanmanworkstation, Netman,
RasMan, Schedule, SENS, TapiSrv, w32time,
winmgmt
svchost.exe 1544 Dnscache
--
- Vince
 
#7
Which instance (below) is the run-away one?

On Mon, 12 Apr 2010 10:22:54 -0400, ibrs <> wrote:

|The same command here produces:
|Image Name PID Services
|========================= ======== ===========================================|svchost.exe 780 DcomLaunch, PlugPlay, Power
|svchost.exe 864 RpcEptMapper, RpcSs
|svchost.exe 928 AudioSrv, Dhcp, eventlog, lmhosts, wscsvc
|svchost.exe 112 AudioEndpointBuilder, CscService, hidserv,
| Netman, PcaSvc, SysMain, TrkWks,
| UmRdpService, UxSms, Wlansvc, wudfsvc
|svchost.exe 376 AeLookupSvc, Appinfo, BITS, CertPropSvc,
| EapHost, gpsvc, IKEEXT, iphlpsvc,
| LanmanServer, ProfSvc, RasMan, Schedule,
| SENS, SessionEnv, ShellHWDetection, Themes,
| Winmgmt, wuauserv
|svchost.exe 1132 EventSystem, netprofm, nsi, SstpSvc,
| W32Time, WdiServiceHost, WinHttpAutoProxySv
|svchost.exe 1300 CryptSvc, Dnscache, LanmanWorkstation,
| NlaSvc, TapiSrv, TermService
|svchost.exe 1568 SCardSvr, SSDPSRV
|svchost.exe 1620 BFE, DPS, MpsSvc
|svchost.exe 2972 stisvc
|svchost.exe 3776 WinDefend
|svchost.exe 4628 bthserv
|svchost.exe 3916 PolicyAgent
|svchost.exe 1204 SDRSVC
|
|
|---Quote (Originally by fromano)---
|Here's the output on my Win7 x64, that doesn't have the problem in question
|
|
|
|
|Image Name PID Services
|========================= ======== ===========================================svchost.exe 1092 DcomLaunch, PlugPlay, Power
|svchost.exe 1200 RpcEptMapper, RpcSs
|svchost.exe 1344 AudioSrv, Dhcp, eventlog,
| HomeGroupProvider, lmhosts, wscsvc
|svchost.exe 1376 AudioEndpointBuilder, hidserv,
| HomeGroupListener, IPBusEnum, Netman,
| PcaSvc, SysMain, TrkWks, UmRdpService,
| UxSms, Wlansvc, wudfsvc
|svchost.exe 1408 AeLookupSvc, BITS, Browser, CertPropSvc,
| EapHost, gpsvc, IKEEXT, iphlpsvc,
| LanmanServer, MMCSS, ProfSvc, Schedule,
| SENS, SessionEnv, ShellHWDetection, Themes,
| UxTuneUp, Winmgmt, wuauserv
|svchost.exe 1680 EventSystem, fdPHost, netprofm, nsi,
| W32Time, WdiServiceHost, WinHttpAutoProxySv
|svchost.exe 1940 CryptSvc, Dnscache, LanmanWorkstation,
| NlaSvc, TermService, Wecsvc
|svchost.exe 2068 BFE, DPS, MpsSvc
|svchost.exe 4408 Net Driver HPZ12
|svchost.exe 5204 Pml Driver HPZ12
|svchost.exe 5784 FDResPub, FontCache, SSDPSRV, upnphost,
| wcncsvc
|svchost.exe 5812 stisvc
|svchost.exe 1576 WerSvc
|svchost.exe 7624 PolicyAgent
|svchost.exe 8024 p2pimsvc, p2psvc, PNRPsvc
|svchost.exe 10212 swprv
|
| - Federico
|
|
|
|----- Original Message ----
|From: vefatica <>
|To: fromano@pacbell.net
|Sent: Mon, April 12, 2010 6:37:40 AM
|Subject: RE: [Support-t-1864] shralias causes svchost.exe to use 100% cpu
|
|On Mon, 12 Apr 2010 01:16:29 -0400, ibrs <> wrote:
|
||When
|| shralias.exe
||is loaded (using "shralias"), svchost.exe will eventually ramp up to 100%. It does not happen immediately, maybe after a few minutes.
||
||Unloading shralias ("shralias /u") immediately drops svchost.exe to an acceptable cpu usage.
||
||Consistently reproducible, consistently puzzling ..
|
|Odd! Does Win7 have TASKLIST.EXE? If so, run it (see below) to see what that
|instance of SVCHOST is doing. Don't confuse it with the built-in TASKLIST. On
|XP, SVCHOST doesn't seem to do anything of concern to SHRALIAS.
|
|v:\> s:\tasklist.exe /svc /fi "imagename eq svchost.exe"
|
|Image Name PID Services
|========================= ====== ============================================svchost.exe 1160 DcomLaunch, TermService
|svchost.exe 1228 RpcSs
|svchost.exe 1484 AppMgmt, AudioSrv, BITS, CryptSvc, Dhcp,
| dmserver, EventSystem, HidServ,
| LanmanServer, lanmanworkstation, Netman,
| RasMan, Schedule, SENS, TapiSrv, w32time,
| winmgmt
|svchost.exe 1544 Dnscache
--
- Vince
 
Apr 9, 2010
4
0
#8
Process id 112

Which instance (below) is the run-away one?

On Mon, 12 Apr 2010 10:22:54 -0400, ibrs <> wrote:

|The same command here produces:
|Image Name PID Services
|========================= ======== ===========================================|svchost.exe 780 DcomLaunch, PlugPlay, Power
|svchost.exe 864 RpcEptMapper, RpcSs
|svchost.exe 928 AudioSrv, Dhcp, eventlog, lmhosts, wscsvc
|svchost.exe 112 AudioEndpointBuilder, CscService, hidserv,
| Netman, PcaSvc, SysMain, TrkWks,
| UmRdpService, UxSms, Wlansvc, wudfsvc
|svchost.exe 376 AeLookupSvc, Appinfo, BITS, CertPropSvc,
| EapHost, gpsvc, IKEEXT, iphlpsvc,
| LanmanServer, ProfSvc, RasMan, Schedule,
| SENS, SessionEnv, ShellHWDetection, Themes,
| Winmgmt, wuauserv
|svchost.exe 1132 EventSystem, netprofm, nsi, SstpSvc,
| W32Time, WdiServiceHost, WinHttpAutoProxySv
|svchost.exe 1300 CryptSvc, Dnscache, LanmanWorkstation,
| NlaSvc, TapiSrv, TermService
|svchost.exe 1568 SCardSvr, SSDPSRV
|svchost.exe 1620 BFE, DPS, MpsSvc
|svchost.exe 2972 stisvc
|svchost.exe 3776 WinDefend
|svchost.exe 4628 bthserv
|svchost.exe 3916 PolicyAgent
|svchost.exe 1204 SDRSVC
|
|
|---Quote (Originally by fromano)---
|Here's the output on my Win7 x64, that doesn't have the problem in question
|
|
|
|
|Image Name PID Services
|========================= ======== ===========================================svchost.exe 1092 DcomLaunch, PlugPlay, Power
|svchost.exe 1200 RpcEptMapper, RpcSs
|svchost.exe 1344 AudioSrv, Dhcp, eventlog,
| HomeGroupProvider, lmhosts, wscsvc
|svchost.exe 1376 AudioEndpointBuilder, hidserv,
| HomeGroupListener, IPBusEnum, Netman,
| PcaSvc, SysMain, TrkWks, UmRdpService,
| UxSms, Wlansvc, wudfsvc
|svchost.exe 1408 AeLookupSvc, BITS, Browser, CertPropSvc,
| EapHost, gpsvc, IKEEXT, iphlpsvc,
| LanmanServer, MMCSS, ProfSvc, Schedule,
| SENS, SessionEnv, ShellHWDetection, Themes,
| UxTuneUp, Winmgmt, wuauserv
|svchost.exe 1680 EventSystem, fdPHost, netprofm, nsi,
| W32Time, WdiServiceHost, WinHttpAutoProxySv
|svchost.exe 1940 CryptSvc, Dnscache, LanmanWorkstation,
| NlaSvc, TermService, Wecsvc
|svchost.exe 2068 BFE, DPS, MpsSvc
|svchost.exe 4408 Net Driver HPZ12
|svchost.exe 5204 Pml Driver HPZ12
|svchost.exe 5784 FDResPub, FontCache, SSDPSRV, upnphost,
| wcncsvc
|svchost.exe 5812 stisvc
|svchost.exe 1576 WerSvc
|svchost.exe 7624 PolicyAgent
|svchost.exe 8024 p2pimsvc, p2psvc, PNRPsvc
|svchost.exe 10212 swprv
|
| - Federico
|
|
|
|----- Original Message ----
|From: vefatica <>
|To: fromano@pacbell.net
|Sent: Mon, April 12, 2010 6:37:40 AM
|Subject: RE: [Support-t-1864] shralias causes svchost.exe to use 100% cpu
|
|On Mon, 12 Apr 2010 01:16:29 -0400, ibrs <> wrote:
|
||When
|| shralias.exe
||is loaded (using "shralias"), svchost.exe will eventually ramp up to 100%. It does not happen immediately, maybe after a few minutes.
||
||Unloading shralias ("shralias /u") immediately drops svchost.exe to an acceptable cpu usage.
||
||Consistently reproducible, consistently puzzling ..
|
|Odd! Does Win7 have TASKLIST.EXE? If so, run it (see below) to see what that
|instance of SVCHOST is doing. Don't confuse it with the built-in TASKLIST. On
|XP, SVCHOST doesn't seem to do anything of concern to SHRALIAS.
|
|v:\> s:\tasklist.exe /svc /fi "imagename eq svchost.exe"
|
|Image Name PID Services
|========================= ====== ============================================svchost.exe 1160 DcomLaunch, TermService
|svchost.exe 1228 RpcSs
|svchost.exe 1484 AppMgmt, AudioSrv, BITS, CryptSvc, Dhcp,
| dmserver, EventSystem, HidServ,
| LanmanServer, lanmanworkstation, Netman,
| RasMan, Schedule, SENS, TapiSrv, w32time,
| winmgmt
|svchost.exe 1544 Dnscache
--
- Vince
 
#9
On Mon, 12 Apr 2010 10:42:22 -0400, ibrs <> wrote:

|Process id 112
|
||svchost.exe 112 AudioEndpointBuilder, CscService, hidserv,
|| Netman, PcaSvc, SysMain, TrkWks,
|| UmRdpService, UxSms, Wlansvc, wudfsvc

As Rex said, SHRALIAS doesn't do much. Afetr opening a few memory-mapped files
containing TCC's shared lists, it just sits in a message loop waiting for
important events (like logoff and shutdown). While none seem to be involved,
here are brief descriptions of those services (except hidserv).

wudfsvc - Windows Driver Foundation - User-mode Driver Framework
Wlansvc - WLAN AutoConfig
UxSms - Desktop Window Manager Session Manager
UmRdpService - Remote Desktop Services UserMode Port Redirector
TrkWks - Distributed Link Tracking Client
SysMain - Superfetch
PcaSvc - Program Compatibility Assistant Service
Netman - Network Connections
CscService - Offline Files
AudioEndpointBuilder - Windows Audio Endpoint Builder
--
- Vince
 

rconn

Administrator
Staff member
May 14, 2008
10,100
85
#10
> I use procexp instead of the task manager and attach zipped screen
> shots of the runaway process (svchost.jpeg) and its services.
The only thing I can think of is that you have a third-party app that's
injecting a dll into SHRALIAS, and that dll is using one of those services.
It definitely isn't SHRALIAS!

Rex Conn
JP Software
 

samintz

Scott Mintz
May 20, 2008
1,203
11
Solon, OH, USA
#11
Using Process Explorer you should be able to see which of the many threads
running are utilizing the CPU. You can even further delve into the stack
to which API calls are being waited on.

That should give you a huge idea of where it's waiting.

-Scott

vefatica <> wrote on 04/12/2010 12:35:31 PM:


> On Mon, 12 Apr 2010 10:42:22 -0400, ibrs <> wrote:
>
> |Process id 112
> |
> ||svchost.exe 112 AudioEndpointBuilder,
> CscService, hidserv,
> || Netman, PcaSvc, SysMain, TrkWks,
> || UmRdpService, UxSms, Wlansvc,
wudfsvc

>
> As Rex said, SHRALIAS doesn't do much. Afetr opening a few memory-
> mapped files
> containing TCC's shared lists, it just sits in a message loop waiting
for

> important events (like logoff and shutdown). While none seem to be
involved,

> here are brief descriptions of those services (except hidserv).
>
> wudfsvc - Windows Driver Foundation - User-mode Driver Framework
> Wlansvc - WLAN AutoConfig
> UxSms - Desktop Window Manager Session Manager
> UmRdpService - Remote Desktop Services UserMode Port Redirector
> TrkWks - Distributed Link Tracking Client
> SysMain - Superfetch
> PcaSvc - Program Compatibility Assistant Service
> Netman - Network Connections
> CscService - Offline Files
> AudioEndpointBuilder - Windows Audio Endpoint Builder
> --
> - Vince
>
>
>
>