Wierd CPU Usage...

[john.wismar-LrXBDQgM52tWk0Htik3J/]

Are there other task managers that show more process granularity
than Process Explorer? It would be handy to see where that time is going

*

inside* explorer.

I couldn't see your screencaps, for some reason. Can you describe what
you see in the call stack when you're in Process Explorer, and you
double-click the process that's sucking up your memory?

--------------------------------
John Wismar
john.wismar-LrXBDQgM52tWk0Htik3J/***@public.gmane.org

[Shawn A. Van Ness]

I've been running Vista x64 for... a long time. Haven't seen (exactly)
this. I do recall the shell (explorer.exe) pegging the CPU from time to
time...

But I haven't seen this problem since I started running SP1 bits. Have you
tried the (publicly available) RC of SP1?
-S

[Rob Hill]

No i haven't installed SP1 yet, i thought i'd just wait for the 'official'
release via WindowsUpdate.



If i install the RC of SP1 will i need to uninstall before the official
update? How 'safe' is the RC compared to waiting a month or so for the
official version?

I haven't really had any other issues (apart from the dodgy drive space free
calculation!) with Vista x64, so i was just going to wait it out for the
proper update.





From: win_tech_off_topic-***@public.gmane.org
[mailto:win_tech_off_topic-***@public.gmane.org] On Behalf Of Shawn A. Van Ness
Sent: 18 December 2007 21:40
To: win_tech_off_topic-***@public.gmane.org
Subject: Re: [OT] Wierd CPU Usage...



I've been running Vista x64 for... a long time. Haven't seen (exactly)
this. I do recall the shell (explorer.exe) pegging the CPU from time to
time...



But I haven't seen this problem since I started running SP1 bits. Have you
tried the (publicly available) RC of SP1?
-S

[Rob Hill]

Lol, You're so helpful. ;)



Sorry about the delay posting the screenshots , Virgin Media has supposedly
had >24hrs of broadband outage. F*ckwits.





From: win_tech_off_topic-***@public.gmane.org
[mailto:win_tech_off_topic-***@public.gmane.org] On Behalf Of John Elliot
Sent: 18 December 2007 18:57
To: win_tech_off_topic-***@public.gmane.org
Subject: Re: [OT] Wierd CPU Usage...

Normally i'd have learned to ignore it by now, but damn that little

bugger's

stealing my CPU!
Help!

Loading Image...

[Hugh Brown]

Would seeing the call stack for a thread help? In SysInternals Process Explorer:

Select Explorer | Right-click | Properties | Threads

Then you can see the call stack for the thread that is taking the CPU.

Alternatively:

Select Explorer | Right-click | Debug

and you should be able to debug it to your heart's content.


Rob Hill <rob.hill-***@public.gmane.org> wrote: v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} [...]

Are there other task managers that show more process granularity than Process Explorer? It would be handy to see where that time is going *inside* explorer.

Any help much appreciated, or am i doomed to leave the folder view collapsed for all time ? L
Cheers,
Rob

[Rob Hill]

Hehee, i didn't know ProcExplorer could do that, I had to install the x64
debug + symbols first though.. also this is a freshly paved machine so i'm
having to add this stuff as i get to it!

Ok, a bit more info, its getting tied up in BROWSEUI.DLL!Ordinal126+0x98f0
~50% CPU disappears in there somewhere.







I notice the shutdown is also soaking up 5-10% cpu too, Also, i had my
machine running for about 8 hrs today with no reset (whilst waiting for
Virgin Media to fix their broadband L ) and when i checked, the icon had
disappeared.. i had to reboot to get it to come back again. So, it does go
away, it just takes *hours*!



Googling doesn't turn up much L





From: win_tech_off_topic-***@public.gmane.org
[mailto:win_tech_off_topic-***@public.gmane.org] On Behalf Of Hugh Brown
Sent: 18 December 2007 22:13
To: win_tech_off_topic-***@public.gmane.org
Subject: RE: [OT] Wierd CPU Usage...



Would seeing the call stack for a thread help? In SysInternals Process
Explorer:

<file:///C:\DOCUME~1\HUGHBR~1\LOCALS~1\Temp\moz-screenshot-5.jpg>
<file:///C:\DOCUME~1\HUGHBR~1\LOCALS~1\Temp\moz-screenshot-7.jpg>
<file:///C:\DOCUME~1\HUGHBR~1\LOCALS~1\Temp\moz-screenshot-8.jpg> Select
Explorer | Right-click | Properties | Threads
<file:///C:\DOCUME~1\HUGHBR~1\LOCALS~1\Temp\moz-screenshot-6.jpg>
Then you can see the call stack for the thread that is taking the CPU.

Alternatively:

<file:///C:\DOCUME~1\HUGHBR~1\LOCALS~1\Temp\moz-screenshot-5.jpg>
<file:///C:\DOCUME~1\HUGHBR~1\LOCALS~1\Temp\moz-screenshot-7.jpg>
<file:///C:\DOCUME~1\HUGHBR~1\LOCALS~1\Temp\moz-screenshot-8.jpg> Select
Explorer | Right-click | Debug
<file:///C:\DOCUME~1\HUGHBR~1\LOCALS~1\Temp\moz-screenshot-6.jpg>
and you should be able to debug it to your heart's content.


Rob Hill <rob.hill-***@public.gmane.org> wrote:

[...]





Are there other task managers that show more process granularity than
Process Explorer? It would be handy to see where that time is going *inside*
explorer.



Any help much appreciated, or am i doomed to leave the folder view collapsed
for all time ? L

Cheers,

Rob

[Hugh Brown]

So if you select the CPU-eating thread in Process Explorer and press the Stack button, do you see anything useful? Does this point to the DLL/addin that is misbehaving?


Rob Hill <rob.hill-***@public.gmane.org> wrote: v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} Hehee, i didn’t know ProcExplorer could do that, I had to install the x64 debug + symbols first though.. also this is a freshly paved machine so i’m having to add this stuff as i get to it!
Ok, a bit more info, its getting tied up in BROWSEUI.DLL!Ordinal126+0x98f0 ~50% CPU disappears in there somewhere.

[Rob Hill]

No, the stack is all over the place. I could understand it if it was
deadlocked, or static, but i get a different call stack each time L - after
about 30 or so clicks there's was still no clear "that address's popped up
half a dozen times".

I'm stumped!



Thanks for the suggestions so far BTW!



Cheers!

Rob





From: win_tech_off_topic-***@public.gmane.org
[mailto:win_tech_off_topic-***@public.gmane.org] On Behalf Of Hugh Brown
Sent: 19 December 2007 01:05
To: win_tech_off_topic-***@public.gmane.org
Subject: RE: [OT] Wierd CPU Usage...



So if you select the CPU-eating thread in Process Explorer and press the
Stack button, do you see anything useful? Does this point to the DLL/addin
that is misbehaving?


Rob Hill <rob.hill-***@public.gmane.org> wrote:

Hehee, i didn't know ProcExplorer could do that, I had to install the x64
debug + symbols first though.. also this is a freshly paved machine so i'm
having to add this stuff as i get to it!

Ok, a bit more info, its getting tied up in BROWSEUI.DLL!Ordinal126+0x98f0
~50% CPU disappears in there somewhere.

[Curt Hagenlocher]

Post by Rob Hill
No, the stack is all over the place. I could understand it if it was
deadlocked, or static, but i get a different call stack each time L -
after about 30 or so clicks there's was still no clear "that address's
popped up half a dozen times".

Sorry if this came up already, but have you run chkdsk against the drive?

--
Curt Hagenlocher
curt-mb4O9IysIuT8BSalH0K3+***@public.gmane.org

[Rob Hill]

Yup the drive is freshly formatted, installed & I scanned it when it first
showed up.





From: win_tech_off_topic-***@public.gmane.org
[mailto:win_tech_off_topic-***@public.gmane.org] On Behalf Of Curt Hagenlocher
Sent: 20 December 2007 00:03
To: win_tech_off_topic-***@public.gmane.org
Subject: Re: [OT] Wierd CPU Usage...



On 12/19/07, Rob Hill <rob.hill-***@public.gmane.org> wrote:

No, the stack is all over the place. I could understand it if it was
deadlocked, or static, but i get a different call stack each time L - after
about 30 or so clicks there's was still no clear "that address's popped up
half a dozen times".

Sorry if this came up already, but have you run chkdsk against the drive?



--

Curt Hagenlocher

curt-mb4O9IysIuT8BSalH0K3+***@public.gmane.org

[Shawn A. Van Ness]

Do you have a profiler? (One that works for unmanaged code, and can talk to
the public symbol server?)

If not... and if you're willing to get your hands dirty... download the
latest debugging tool suite for x64 here:
http://www.microsoft.com/whdc/devtools/debugging/install64bit.mspx

Then fire up WinDbg and have at it -- same technique, just break into
explorer.exe periodoically, and note the call stack of the thread(s) which
are chewing your CPU.

Presumably, with symbol information instead of just export-address-offsets,
you'll see more meaningful results...

Post by Rob Hill
No, the stack is all over the place. I could understand it if it was
deadlocked, or static, but i get a different call stack each time L -
after about 30 or so clicks there's was still no clear "that address's
popped up half a dozen times".
I'm stumped!
Thanks for the suggestions so far BTW!
Cheers!
Rob
*Sent:* 19 December 2007 01:05
*Subject:* RE: [OT] Wierd CPU Usage...
So if you select the CPU-eating thread in Process Explorer and press the
Stack button, do you see anything useful? Does this point to the DLL/addin
that is misbehaving?
Hehee, i didn't know ProcExplorer could do that, I had to install the x64
debug + symbols first though.. also this is a freshly paved machine so i'm
having to add this stuff as i get to it!
Ok, a bit more info, its getting tied up in BROWSEUI.DLL!Ordinal126+0x98f0~50% CPU disappears in there somewhere.

[Rob Hill]

Nope, I don't have a profiler, but i don't mind getting my hands dirty (I
wrote games in a past life the first ones were all in assembler J )

So i'm no stranger, its just i have a ton of work i need to get started with
so can do without major distractions like hacking thru code in explorer to
find who's stealing my cycles!

<sigh> i'll put up with it for now, i may try installing SP1 although i cant
see that changing what i have installed that obviously screwed.



I'd installed the debug tools, so if i get a sudden urge to dig a bit deeper
i'll crack out windbg.



Thanks for all the help anyway!



Cheers,

Rob





From: win_tech_off_topic-***@public.gmane.org
[mailto:win_tech_off_topic-***@public.gmane.org] On Behalf Of Shawn A. Van Ness
Sent: 20 December 2007 05:08
To: win_tech_off_topic-***@public.gmane.org
Subject: Re: [OT] Wierd CPU Usage...



Do you have a profiler? (One that works for unmanaged code, and can talk to
the public symbol server?)



If not... and if you're willing to get your hands dirty... download the
latest debugging tool suite for x64 here:

http://www.microsoft.com/whdc/devtools/debugging/install64bit.mspx



Then fire up WinDbg and have at it -- same technique, just break into
explorer.exe periodoically, and note the call stack of the thread(s) which
are chewing your CPU.



Presumably, with symbol information instead of just export-address-offsets,
you'll see more meaningful results...





On Dec 19, 2007 2:06 PM, Rob Hill <rob.hill-***@public.gmane.org> wrote:

No, the stack is all over the place. I could understand it if it was
deadlocked, or static, but i get a different call stack each time L - after
about 30 or so clicks there's was still no clear "that address's popped up
half a dozen times".

I'm stumped!



Thanks for the suggestions so far BTW!



Cheers!

Rob





From: win_tech_off_topic-***@public.gmane.org [mailto:
win_tech_off_topic-***@public.gmane.org] On Behalf Of Hugh Brown
Sent: 19 December 2007 01:05


To: win_tech_off_topic-***@public.gmane.org

Subject: RE: [OT] Wierd CPU Usage...



So if you select the CPU-eating thread in Process Explorer and press the
Stack button, do you see anything useful? Does this point to the DLL/addin
that is misbehaving?


Rob Hill < <mailto:rob.hill-***@public.gmane.org> rob.hill-***@public.gmane.org>
wrote:

Hehee, i didn't know ProcExplorer could do that, I had to install the x64
debug + symbols first though.. also this is a freshly paved machine so i'm
having to add this stuff as i get to it!

Ok, a bit more info, its getting tied up in BROWSEUI.DLL!Ordinal126+0x98f0
~50% CPU disappears in there somewhere.

[Mike Woodring]

Post by Rob Hill
So i'm no stranger, its just i have a ton of work i need to get
started with so can do without major distractions like hacking
thru code in explorer to find who's stealing my cycles!

If you were to use adplus (part of Debugging Tools for Windows[1] and
documented here [2]) in "hang mode" to create a memory dump/snapshot of your
explorer process, and then post the zip somewhere for download, you might
entice one or more people on this list to have a looksee out of sheer
curiosity. Especially if you include a text file or screenshot listing what
Process Explorer indicated were the thread ID(s) of the thread(s) pegging
the CPU for the same instance of the program you generated the dump for...

-Mike
Bear Canyon Consulting LLC
http://www.bearcanyon.com

[1] http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx
[2] http://support.microsoft.com/kb/286350

[Rob Hill]

Ok, I've had a few spare moments in between setting up some more stuff, i've
added the Vista64 symbol set so i can see who's involved ;)

Here's another shot of the call stack from process explorer





It seems that MonitorFromWindow is cropping up an awful lot of the time (>80
%) which is a change from the last time where nothing seemed to keep
repeating.

I've run Adplus -hang , too, but i'm a bit lost as to what im supposed to be
looking for, the log file is quite large, and i cant see any unknown DLL's
or anything that makes me suspicious, but then i don't really know what i'm
looking for.

I don't see any thread / call stack information in the adplus log file

Thanks for the tips Mike, I didn't know these tools were freely available!

If anyone's interested (or cares! ;) ) i'll mail the .log file if you'd care
to take a look, i'm still a bit stumped.



Cheers,

Rob







From: win_tech_off_topic-***@public.gmane.org
[mailto:win_tech_off_topic-***@public.gmane.org] On Behalf Of Mike Woodring
Sent: 20 December 2007 22:08
To: win_tech_off_topic-***@public.gmane.org
Subject: RE: [OT] Wierd CPU Usage...

Post by Rob Hill
So i'm no stranger, its just i have a ton of work i need to get
started with so can do without major distractions like hacking
thru code in explorer to find who's stealing my cycles!

If you were to use adplus (part of Debugging Tools for Windows[1] and
documented here [2]) in "hang mode" to create a memory dump/snapshot of your
explorer process, and then post the zip somewhere for download, you might
entice one or more people on this list to have a looksee out of sheer
curiosity. Especially if you include a text file or screenshot listing what
Process Explorer indicated were the thread ID(s) of the thread(s) pegging
the CPU for the same instance of the program you generated the dump for...

-Mike
Bear Canyon Consulting LLC
http://www.bearcanyon.com

[1] http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx
[2] http://support.microsoft.com/kb/286350

[Mike Woodring]

Post by Rob Hill
Thanks for the tips Mike, I didn't know these tools were freely available!
If anyone's interested (or cares! ;) ) i'll mail the .log file if
you'd care to take a look, i'm still a bit stumped.

It's not the .log file that would be interesting - it's the .dmp
(crash/memory dump) file. And you don't want to mail it - it should be
tens-to-hundreds of megabytes in size. The adplus output should have been
spit out to a directory. If you zip the entire directory (including the
.log & .dmp files & all the other cruft), and upload that to an ftp or http
site somewhere for people to download, it would allow anyone who's really
interesting to "debug" your system by loading the crash dump in windbg and
having a look around.

-M

[Rob Hill]

Hehe, i think i've found it!

I had a notebook from the Missus for xmas (a nice HP pavilion 1340ea highly
recommended!) well, anyway this too has developed the mysterious blank
folder that soaks up 50% of my cpu.

I'll Elaborate ... I have a 500gb NAS box where my music/media stuff
resides, and i've moved (Right click->properties->Location tab->Move) the
user/music folder to that drive. I haven't installed anything else (other
than VS2008) so its a completely fresh Vista32 install, and here is that
blank folder soaking up 50% of CPU.

So, i tried something else, I copied the favourites folder to the NAS box
too,and the changed its location, so i could share it between my desktop and
my laptop, to see if that would show up as a blank folder too. Unfortunately
the Favorites folder has completely disappeared, and nothing i do from the
UI can bring it back, so my user folder is pretty hosed.

IE7 still has the favourites button, but the window is empty, and if i try
to add to favourite, it locks up for about a minute, or exits completely.

I guess the moral of that story is don't move your user folders to shared
drives.

On a side note, where in the registry are the entries for these folders?
Where is the Favorites folder location stored (searching doesn't show it
up)? How do i bring it back into the user folder , and are there any tools
to do this? Also, what's the best way to keep these kind of folders synced?

If i could move the folders back to the C: users hierarchy maybe the
mysterious blank folder would go away..



Also, would it be worth notifying anyone in MS about this odd behaviour?
This is the second Clean install this has happened on, so theres definitely
something going on.



Cheers!

Rob





From: win_tech_off_topic-***@public.gmane.org
[mailto:win_tech_off_topic-***@public.gmane.org] On Behalf Of Mike Woodring
Sent: 22 December 2007 16:06
To: win_tech_off_topic-***@public.gmane.org
Subject: RE: [OT] Wierd CPU Usage...

Post by Rob Hill
Thanks for the tips Mike, I didn't know these tools were freely available!
If anyone's interested (or cares! ;) ) i'll mail the .log file if
you'd care to take a look, i'm still a bit stumped.

It's not the .log file that would be interesting - it's the .dmp
(crash/memory dump) file. And you don't want to mail it - it should be
tens-to-hundreds of megabytes in size. The adplus output should have been
spit out to a directory. If you zip the entire directory (including the
.log & .dmp files & all the other cruft), and upload that to an ftp or http
site somewhere for people to download, it would allow anyone who's really
interesting to "debug" your system by loading the crash dump in windbg and
having a look around.

-M

[Marc Brooks]

Post by Rob Hill
On a side note, where in the registry are the entries for these folders?
Where is the Favorites folder location stored (searching doesn't show it
up)? How do i bring it back into the user folder , and are there any tools
to do this? Also, what's the best way to keep these kind of folders synced?

TweakUI will let you change/reset those things...

http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx

(yes, it says XP, but it'll run on Vista too)

[Franci Penov]

Post by Rob Hill
On a side note, where in the registry are the entries for these folders?
Where is the Favorites folder location stored (searching doesn't show it
up)? How do i bring it back into the user folder , and are there any tools
to do this? Also, what's the best way to keep these kind of folders synced?
If i could move the folders back to the C: users hierarchy maybe the
mysterious blank folder would go away..

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User
Shell Folders

[Rob Hill]

Well, It seems that moving the folders back to a local HD makes the Phantom
CPU sapping folder go away!



Solved! Thanks for the help everyone!







From: win_tech_off_topic-***@public.gmane.org
[mailto:win_tech_off_topic-***@public.gmane.org] On Behalf Of Rob Hill
Sent: 09 January 2008 23:25
To: win_tech_off_topic-***@public.gmane.org
Subject: RE: [OT] Wierd CPU Usage...



Hehe, i think i've found it!

I had a notebook from the Missus for xmas (a nice HP pavilion 1340ea highly
recommended!) well, anyway this too has developed the mysterious blank
folder that soaks up 50% of my cpu.

I'll Elaborate ... I have a 500gb NAS box where my music/media stuff
resides, and i've moved (Right click->properties->Location tab->Move) the
user/music folder to that drive. I haven't installed anything else (other
than VS2008) so its a completely fresh Vista32 install, and here is that
blank folder soaking up 50% of CPU.

So, i tried something else, I copied the favourites folder to the NAS box
too,and the changed its location, so i could share it between my desktop and
my laptop, to see if that would show up as a blank folder too. Unfortunately
the Favorites folder has completely disappeared, and nothing i do from the
UI can bring it back, so my user folder is pretty hosed.

IE7 still has the favourites button, but the window is empty, and if i try
to add to favourite, it locks up for about a minute, or exits completely.

I guess the moral of that story is don't move your user folders to shared
drives.

On a side note, where in the registry are the entries for these folders?
Where is the Favorites folder location stored (searching doesn't show it
up)? How do i bring it back into the user folder , and are there any tools
to do this? Also, what's the best way to keep these kind of folders synced?

If i could move the folders back to the C: users hierarchy maybe the
mysterious blank folder would go away..



Also, would it be worth notifying anyone in MS about this odd behaviour?
This is the second Clean install this has happened on, so theres definitely
something going on.



Cheers!

Rob





From: win_tech_off_topic-***@public.gmane.org
[mailto:win_tech_off_topic-***@public.gmane.org] On Behalf Of Mike Woodring
Sent: 22 December 2007 16:06
To: win_tech_off_topic-***@public.gmane.org
Subject: RE: [OT] Wierd CPU Usage...

Post by Rob Hill
Thanks for the tips Mike, I didn't know these tools were freely available!
If anyone's interested (or cares! ;) ) i'll mail the .log file if
you'd care to take a look, i'm still a bit stumped.

It's not the .log file that would be interesting - it's the .dmp
(crash/memory dump) file. And you don't want to mail it - it should be
tens-to-hundreds of megabytes in size. The adplus output should have been
spit out to a directory. If you zip the entire directory (including the
.log & .dmp files & all the other cruft), and upload that to an ftp or http
site somewhere for people to download, it would allow anyone who's really
interesting to "debug" your system by loading the crash dump in windbg and
having a look around.

-M

[John Elliot]

Post by Rob Hill
Lol, You're so helpful. ;)

Loading Image...

:)

[Rob Hill]

I'm cryin here. All i need is one of those where the monkey is showing me a
call stack that's usefull, then i'll be impressed ;)









From: win_tech_off_topic-***@public.gmane.org
[mailto:win_tech_off_topic-***@public.gmane.org] On Behalf Of John Elliot
Sent: 19 December 2007 01:36
To: win_tech_off_topic-***@public.gmane.org
Subject: Re: [OT] Wierd CPU Usage...

Post by Rob Hill
Lol, You're so helpful. ;)

http://www.jj5.net/file/2007-12-19-055617/2007-12-19-123312.JPG

:)

[Hugh Brown]

It looks like entry[x] == entry[x+5]. Is this true for more than the first three entries? That's a pattern worth investigating,

Rob Hill <rob.hill-***@public.gmane.org> wrote: v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} Ok, I’ve had a few spare moments in between setting up some more stuff, i’ve added the Vista64 symbol set so i can see who’s involved ;)
Here’s another shot of the call stack from process explorer


It seems that MonitorFromWindow is cropping up an awful lot of the time (>80 %) which is a change from the last time where nothing seemed to keep repeating.
I’ve run Adplus –hang , too, but i’m a bit lost as to what im supposed to be looking for, the log file is quite large, and i cant see any unknown DLL’s or anything that makes me suspicious, but then i don’t really know what i’m looking for.
I don’t see any thread / call stack information in the adplus log file
Thanks for the tips Mike, I didn’t know these tools were freely available!
If anyone’s interested (or cares! ;) ) i’ll mail the .log file if you’d care to take a look, i’m still a bit stumped.

Cheers,
Rob