28

In Windows Task Manager and AVG Task Manager (included in TuneUp Utilities), I see that the sum of all the running processes is much lower than the total CPU usage shown in "performance" tab. Does this mean that my PC is running a hidden process or some malware that's not displaying in the Task Manager?

EDIT: inbuilt monitor showing this too, and show processes from all users showing too. laptop is two-cores, and I'm taking total load of both.

Zulgrib
  • 340
  • 3
  • 17
tensojka
  • 405
  • 1
  • 4
  • 8
  • 3
    How large is the difference? If it's not too big (relative to the total number of processes), it could easily be from the fractions of a % adding up. – Kitsune Sep 21 '14 at 20:33
  • 2
    Is there a "Show Processes from All Users" button? Sometimes the windows task manager will hide system processes if you don't click the button. –  Sep 22 '14 at 01:34
  • 1
    In addition to the comment above about showing all users processes, it could well be hardware interrupts, which task manager doesn't show. You'd be better using the built in resource monitor, by opening task manager, going to "Performance" and clicking on resource monitor. – Chris Murray Sep 22 '14 at 07:59
  • Interesting queston, did you take load per core and hyperthreading into account ? I'm not sure if a keylogger would be that obvious to notice. –  Sep 21 '14 at 18:26
  • You would need to run a facility that explicitly takes into account the CPU usage of the kernel and other users. I don't know Windows well enough to know whether the Task Manager does that for you out of the box but you ought to check. For the matter a keylogger is such a trivial piece of code that it should not consume any noticeable amount of CPU. –  Sep 22 '14 at 16:55
  • keylogger - and what about screenshots taking? video? encrypting it... –  Sep 22 '14 at 17:02
  • @hoschiCZ it would be much easier to detect either the disk or network usage than to try and guess based on CPU usage.. – user2813274 Sep 22 '14 at 21:20

4 Answers4

6

Run Process Explorer and you'll see the cpu usage for everything including services like anti-virus checkers. (I just had the same issue and I found Symantec's ccSvcHst.exe was taking up 13% of my cpu.)

nevster
  • 226
  • 3
  • 9
3

I doubt that "much lower" is due to rounding errors.

I assume you see the same bug as I often see, where the process list does not update properly, so when I start some job taking a decent amount of cpu power, like a compile or similar. Then it happen from time to time that this new process is not added to the list by task manager.

I found that switching to another tab (ex. "performance") and then back to the "processes" tab, triggers a rinse and repeat of the list, making my new process show up in the list.

And now the sum matches the reported total way better.

Otzen
  • 171
  • 2
  • This really helps! After a switch to Performance and back to Processes, it updates and I can see some processes that eat the CPU! @tensojka, I guess, this is the correct answer, not "rounding up" answer – shal Mar 19 '21 at 00:12
  • This didn't work for me (2012R2), but F5 did. At that point I realised it was because the Update Speed was set to Paused. – mwfearnley Jun 15 '22 at 15:42
2

This is because the task manager round up or round down the CPU usage values per process. You can see a lot of process using "0" CPU time, this is false, they use "0,xxxxxxx" cpu time.

What you need is a process manager showing more precise value to you.

Some process can also be hidden (negative PID, running as another user) or some piece of hardware may have direct access to the CPU by passing your operating system (but probably not)

Zulgrib
  • 340
  • 3
  • 17
  • 1
    negative PID? how can I view processes with negative PID? – tensojka Sep 29 '14 at 16:57
  • 2
    This is another question and should have it's own question page. If my answer is correct about the specific question you asked you can mark it as answer with the checkmark icon. You could ask "How to list process with negative PID on Windows" on the new question page. – Zulgrib Sep 30 '14 at 18:54
  • 1
    There is no such thing as a "negative PID" in Windows. PIDs are not signed numbers, at all. – Jamie Hanrahan Aug 01 '15 at 20:40
  • Thanks for your input, this explains why security software actively track process with negative PID. http://support.kaspersky.com/6658 Have a nice day. – Zulgrib Aug 02 '15 at 09:19
  • 1
    I don't think this is caused by rounding error. On my system, there is one process showing 6% in Task Manager, while the same process shows 10% in Process Explorer. This accounts for the difference, although I don't know why. – Elliott B Sep 02 '20 at 19:13
0

I had the same issue, where the built in task manager recorded a CPU usage much higher than the processes I was running.

Using Process Explorer, I found that the process using up my CPU was a image editor that was running on another Windows user.

Switching to that user, logging out and then logging back in to the first user confirmed that the CPU was now down to expected levels.

Gustav
  • 1