1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

shralias causes svchost.exe to use 100% cpu

Discussion in 'Support' started by ibrs, Apr 12, 2010.

  1. ibrs

    Joined:
    Apr 9, 2010
    Messages:
    4
    Likes Received:
    0
    I have been using your product at home and work for many years now (4dos, 4os2, 4nt, tcc..).
    Please keep up the good work :-)

    I have, however, run into one of the stranger problems. I use:
    TCC 11.00.44 x64 Windows 7 [Version 6.1.7600]
    TCC Build 44 Windows 7 Build 7600

    and observed that svchost.exe frequently ran at 100% cpu loading (100% of one core, that is).
    To cut a long and tedious story short, I eventually found the, or a, cause.

    When
    shralias.exe
    is loaded (using "shralias"), svchost.exe will eventually ramp up to 100%. It does not happen immediately, maybe after a few minutes.

    Unloading shralias ("shralias /u") immediately drops svchost.exe to an acceptable cpu usage.

    Consistently reproducible, consistently puzzling ..
     
  2. rconn

    rconn Administrator
    Staff Member

    Joined:
    May 14, 2008
    Messages:
    9,726
    Likes Received:
    80
    Not reproducible here. Anybody else able to reproduce this?

    All SHRALIAS does is sit in a GetMessage loop; it's difficult to imagine how
    that could be causing an unrelated svchost process to max out the cpu
    (particularly since there is no service involved in SHRALIAS or TCC). Try
    starting Task Manager, and then right-click on the afflicted svchost.exe
    process, and select "Go to Service(s). That will highlight the services
    running under that svchost.exe process, which might throw some light on
    what's happening.

    Are you running any plugins?

    Rex Conn
    JP Software
     
  3. vefatica

    Joined:
    May 20, 2008
    Messages:
    7,784
    Likes Received:
    29
    On Mon, 12 Apr 2010 01:16:29 -0400, ibrs <> wrote:

    |When
    | shralias.exe
    |is loaded (using "shralias"), svchost.exe will eventually ramp up to 100%. It does not happen immediately, maybe after a few minutes.
    |
    |Unloading shralias ("shralias /u") immediately drops svchost.exe to an acceptable cpu usage.
    |
    |Consistently reproducible, consistently puzzling ..

    Odd! Does Win7 have TASKLIST.EXE? If so, run it (see below) to see what that
    instance of SVCHOST is doing. Don't confuse it with the built-in TASKLIST. On
    XP, SVCHOST doesn't seem to do anything of concern to SHRALIAS.

    v:\> s:\tasklist.exe /svc /fi "imagename eq svchost.exe"

    Image Name PID Services
    ========================= ====== ============================================svchost.exe 1160 DcomLaunch, TermService
    svchost.exe 1228 RpcSs
    svchost.exe 1484 AppMgmt, AudioSrv, BITS, CryptSvc, Dhcp,
    dmserver, EventSystem, HidServ,
    LanmanServer, lanmanworkstation, Netman,
    RasMan, Schedule, SENS, TapiSrv, w32time,
    winmgmt
    svchost.exe 1544 Dnscache
    --
    - Vince
     
  4. fromano

    Joined:
    May 20, 2008
    Messages:
    110
    Likes Received:
    0
    Here's the output on my Win7 x64, that doesn't have the problem in question


    Image Name PID Services
    ========================= ======== ===========================================svchost.exe 1092 DcomLaunch, PlugPlay, Power
    svchost.exe 1200 RpcEptMapper, RpcSs
    svchost.exe 1344 AudioSrv, Dhcp, eventlog,
    HomeGroupProvider, lmhosts, wscsvc
    svchost.exe 1376 AudioEndpointBuilder, hidserv,
    HomeGroupListener, IPBusEnum, Netman,
    PcaSvc, SysMain, TrkWks, UmRdpService,
    UxSms, Wlansvc, wudfsvc
    svchost.exe 1408 AeLookupSvc, BITS, Browser, CertPropSvc,
    EapHost, gpsvc, IKEEXT, iphlpsvc,
    LanmanServer, MMCSS, ProfSvc, Schedule,
    SENS, SessionEnv, ShellHWDetection, Themes,
    UxTuneUp, Winmgmt, wuauserv
    svchost.exe 1680 EventSystem, fdPHost, netprofm, nsi,
    W32Time, WdiServiceHost, WinHttpAutoProxySv
    svchost.exe 1940 CryptSvc, Dnscache, LanmanWorkstation,
    NlaSvc, TermService, Wecsvc
    svchost.exe 2068 BFE, DPS, MpsSvc
    svchost.exe 4408 Net Driver HPZ12
    svchost.exe 5204 Pml Driver HPZ12
    svchost.exe 5784 FDResPub, FontCache, SSDPSRV, upnphost,
    wcncsvc
    svchost.exe 5812 stisvc
    svchost.exe 1576 WerSvc
    svchost.exe 7624 PolicyAgent
    svchost.exe 8024 p2pimsvc, p2psvc, PNRPsvc
    svchost.exe 10212 swprv

    - Federico



    ----- Original Message ----
    From: vefatica <>
    To: fromano@pacbell.net
    Sent: Mon, April 12, 2010 6:37:40 AM
    Subject: RE: [Support-t-1864] shralias causes svchost.exe to use 100% cpu

    On Mon, 12 Apr 2010 01:16:29 -0400, ibrs <> wrote:

    |When
    | shralias.exe
    |is loaded (using "shralias"), svchost.exe will eventually ramp up to 100%. It does not happen immediately, maybe after a few minutes.
    |
    |Unloading shralias ("shralias /u") immediately drops svchost.exe to an acceptable cpu usage.
    |
    |Consistently reproducible, consistently puzzling ..

    Odd! Does Win7 have TASKLIST.EXE? If so, run it (see below) to see what that
    instance of SVCHOST is doing. Don't confuse it with the built-in TASKLIST. On
    XP, SVCHOST doesn't seem to do anything of concern to SHRALIAS.

    v:\> s:\tasklist.exe /svc /fi "imagename eq svchost.exe"

    Image Name PID Services
    ========================= ====== ============================================svchost.exe 1160 DcomLaunch, TermService
    svchost.exe 1228 RpcSs
    svchost.exe 1484 AppMgmt, AudioSrv, BITS, CryptSvc, Dhcp,
    dmserver, EventSystem, HidServ,
    LanmanServer, lanmanworkstation, Netman,
    RasMan, Schedule, SENS, TapiSrv, w32time,
    winmgmt
    svchost.exe 1544 Dnscache
    --
    - Vince
     
  5. ibrs

    Joined:
    Apr 9, 2010
    Messages:
    4
    Likes Received:
    0
    I use procexp instead of the task manager and attach zipped screen shots of the runaway process (svchost.jpeg) and its services.

     

    Attached Files:

  6. ibrs

    Joined:
    Apr 9, 2010
    Messages:
    4
    Likes Received:
    0
    The same command here produces:
    Image Name PID Services
    ========================= ======== ============================================
    svchost.exe 780 DcomLaunch, PlugPlay, Power
    svchost.exe 864 RpcEptMapper, RpcSs
    svchost.exe 928 AudioSrv, Dhcp, eventlog, lmhosts, wscsvc
    svchost.exe 112 AudioEndpointBuilder, CscService, hidserv,
    Netman, PcaSvc, SysMain, TrkWks,
    UmRdpService, UxSms, Wlansvc, wudfsvc
    svchost.exe 376 AeLookupSvc, Appinfo, BITS, CertPropSvc,
    EapHost, gpsvc, IKEEXT, iphlpsvc,
    LanmanServer, ProfSvc, RasMan, Schedule,
    SENS, SessionEnv, ShellHWDetection, Themes,
    Winmgmt, wuauserv
    svchost.exe 1132 EventSystem, netprofm, nsi, SstpSvc,
    W32Time, WdiServiceHost, WinHttpAutoProxySv
    svchost.exe 1300 CryptSvc, Dnscache, LanmanWorkstation,
    NlaSvc, TapiSrv, TermService
    svchost.exe 1568 SCardSvr, SSDPSRV
    svchost.exe 1620 BFE, DPS, MpsSvc
    svchost.exe 2972 stisvc
    svchost.exe 3776 WinDefend
    svchost.exe 4628 bthserv
    svchost.exe 3916 PolicyAgent
    svchost.exe 1204 SDRSVC

     
  7. vefatica

    Joined:
    May 20, 2008
    Messages:
    7,784
    Likes Received:
    29
    Which instance (below) is the run-away one?

    On Mon, 12 Apr 2010 10:22:54 -0400, ibrs <> wrote:

    |The same command here produces:
    |Image Name PID Services
    |========================= ======== ===========================================|svchost.exe 780 DcomLaunch, PlugPlay, Power
    |svchost.exe 864 RpcEptMapper, RpcSs
    |svchost.exe 928 AudioSrv, Dhcp, eventlog, lmhosts, wscsvc
    |svchost.exe 112 AudioEndpointBuilder, CscService, hidserv,
    | Netman, PcaSvc, SysMain, TrkWks,
    | UmRdpService, UxSms, Wlansvc, wudfsvc
    |svchost.exe 376 AeLookupSvc, Appinfo, BITS, CertPropSvc,
    | EapHost, gpsvc, IKEEXT, iphlpsvc,
    | LanmanServer, ProfSvc, RasMan, Schedule,
    | SENS, SessionEnv, ShellHWDetection, Themes,
    | Winmgmt, wuauserv
    |svchost.exe 1132 EventSystem, netprofm, nsi, SstpSvc,
    | W32Time, WdiServiceHost, WinHttpAutoProxySv
    |svchost.exe 1300 CryptSvc, Dnscache, LanmanWorkstation,
    | NlaSvc, TapiSrv, TermService
    |svchost.exe 1568 SCardSvr, SSDPSRV
    |svchost.exe 1620 BFE, DPS, MpsSvc
    |svchost.exe 2972 stisvc
    |svchost.exe 3776 WinDefend
    |svchost.exe 4628 bthserv
    |svchost.exe 3916 PolicyAgent
    |svchost.exe 1204 SDRSVC
    |
    |
    |---Quote (Originally by fromano)---
    |Here's the output on my Win7 x64, that doesn't have the problem in question
    |
    |
    |
    |
    |Image Name PID Services
    |========================= ======== ===========================================svchost.exe 1092 DcomLaunch, PlugPlay, Power
    |svchost.exe 1200 RpcEptMapper, RpcSs
    |svchost.exe 1344 AudioSrv, Dhcp, eventlog,
    | HomeGroupProvider, lmhosts, wscsvc
    |svchost.exe 1376 AudioEndpointBuilder, hidserv,
    | HomeGroupListener, IPBusEnum, Netman,
    | PcaSvc, SysMain, TrkWks, UmRdpService,
    | UxSms, Wlansvc, wudfsvc
    |svchost.exe 1408 AeLookupSvc, BITS, Browser, CertPropSvc,
    | EapHost, gpsvc, IKEEXT, iphlpsvc,
    | LanmanServer, MMCSS, ProfSvc, Schedule,
    | SENS, SessionEnv, ShellHWDetection, Themes,
    | UxTuneUp, Winmgmt, wuauserv
    |svchost.exe 1680 EventSystem, fdPHost, netprofm, nsi,
    | W32Time, WdiServiceHost, WinHttpAutoProxySv
    |svchost.exe 1940 CryptSvc, Dnscache, LanmanWorkstation,
    | NlaSvc, TermService, Wecsvc
    |svchost.exe 2068 BFE, DPS, MpsSvc
    |svchost.exe 4408 Net Driver HPZ12
    |svchost.exe 5204 Pml Driver HPZ12
    |svchost.exe 5784 FDResPub, FontCache, SSDPSRV, upnphost,
    | wcncsvc
    |svchost.exe 5812 stisvc
    |svchost.exe 1576 WerSvc
    |svchost.exe 7624 PolicyAgent
    |svchost.exe 8024 p2pimsvc, p2psvc, PNRPsvc
    |svchost.exe 10212 swprv
    |
    | - Federico
    |
    |
    |
    |----- Original Message ----
    |From: vefatica <>
    |To: fromano@pacbell.net
    |Sent: Mon, April 12, 2010 6:37:40 AM
    |Subject: RE: [Support-t-1864] shralias causes svchost.exe to use 100% cpu
    |
    |On Mon, 12 Apr 2010 01:16:29 -0400, ibrs <> wrote:
    |
    ||When
    || shralias.exe
    ||is loaded (using "shralias"), svchost.exe will eventually ramp up to 100%. It does not happen immediately, maybe after a few minutes.
    ||
    ||Unloading shralias ("shralias /u") immediately drops svchost.exe to an acceptable cpu usage.
    ||
    ||Consistently reproducible, consistently puzzling ..
    |
    |Odd! Does Win7 have TASKLIST.EXE? If so, run it (see below) to see what that
    |instance of SVCHOST is doing. Don't confuse it with the built-in TASKLIST. On
    |XP, SVCHOST doesn't seem to do anything of concern to SHRALIAS.
    |
    |v:\> s:\tasklist.exe /svc /fi "imagename eq svchost.exe"
    |
    |Image Name PID Services
    |========================= ====== ============================================svchost.exe 1160 DcomLaunch, TermService
    |svchost.exe 1228 RpcSs
    |svchost.exe 1484 AppMgmt, AudioSrv, BITS, CryptSvc, Dhcp,
    | dmserver, EventSystem, HidServ,
    | LanmanServer, lanmanworkstation, Netman,
    | RasMan, Schedule, SENS, TapiSrv, w32time,
    | winmgmt
    |svchost.exe 1544 Dnscache
    --
    - Vince
     
  8. ibrs

    Joined:
    Apr 9, 2010
    Messages:
    4
    Likes Received:
    0
    Process id 112

     
  9. vefatica

    Joined:
    May 20, 2008
    Messages:
    7,784
    Likes Received:
    29
    On Mon, 12 Apr 2010 10:42:22 -0400, ibrs <> wrote:

    |Process id 112
    |
    ||svchost.exe 112 AudioEndpointBuilder, CscService, hidserv,
    || Netman, PcaSvc, SysMain, TrkWks,
    || UmRdpService, UxSms, Wlansvc, wudfsvc

    As Rex said, SHRALIAS doesn't do much. Afetr opening a few memory-mapped files
    containing TCC's shared lists, it just sits in a message loop waiting for
    important events (like logoff and shutdown). While none seem to be involved,
    here are brief descriptions of those services (except hidserv).

    wudfsvc - Windows Driver Foundation - User-mode Driver Framework
    Wlansvc - WLAN AutoConfig
    UxSms - Desktop Window Manager Session Manager
    UmRdpService - Remote Desktop Services UserMode Port Redirector
    TrkWks - Distributed Link Tracking Client
    SysMain - Superfetch
    PcaSvc - Program Compatibility Assistant Service
    Netman - Network Connections
    CscService - Offline Files
    AudioEndpointBuilder - Windows Audio Endpoint Builder
    --
    - Vince
     
  10. rconn

    rconn Administrator
    Staff Member

    Joined:
    May 14, 2008
    Messages:
    9,726
    Likes Received:
    80
    The only thing I can think of is that you have a third-party app that's
    injecting a dll into SHRALIAS, and that dll is using one of those services.
    It definitely isn't SHRALIAS!

    Rex Conn
    JP Software
     
  11. samintz

    samintz Scott Mintz

    Joined:
    May 20, 2008
    Messages:
    1,177
    Likes Received:
    11
    Using Process Explorer you should be able to see which of the many threads
    running are utilizing the CPU. You can even further delve into the stack
    to which API calls are being waited on.

    That should give you a huge idea of where it's waiting.

    -Scott

    vefatica <> wrote on 04/12/2010 12:35:31 PM:


    wudfsvc

    for

    involved,

     

Share This Page