Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

I noticed that my system is slowing down and services.exe often uses quite some CPU (around 10-40%), especially after waking up the PC.

I find it hard to find out more about services.exe, and what is actually causing this issue.

However, I find it suspicious that the services.exe process has over 1,000 threads running. So this may be the first clue. Most of the threads are in RtlValidateHeap:

ntdll.dll!ZwWaitForWorkViaWorkerFactory+0xa
ntdll.dll!RtlValidateHeap+0x3bb
kernel32.dll!BaseThreadInitThunk+0xd
ntdll.dll!RtlUserThreadStart+0x21

So what's the recommended approach to identify issues like that?

Update: It might be that Eclipse or some of the plugins are related to this issue. After shutting down Eclipse, the thread count went down to 100-something, and is back at 1,000+ after restarting.

share|improve this question
Without analyzing more of the call stacks of these threads, it's impossible to tell what's going on. My own services.exe runs 16 threads right now. So hundreds still sounds a bit excessive. How are you even determining those values? What tool are you using? – Oliver Salzburg♦ Aug 2 '12 at 18:52
I just had a look at Process Explorer. Right now, I have 1,006 threads. Who offers more? ;) Anyway, how to investigate into issues like those? – greenrobot Aug 2 '12 at 18:55
I also have threads with the identical call stack. I always considered those normal, but have no real clue what they actually do. If you sort the threads by Cycles Delta (so it shows the heavy workers on top), what are the stacks that generate the most work? – Oliver Salzburg♦ Aug 2 '12 at 19:32
It's the call stack I posted. Just one thread tops the overs: ntdll.dll!RtlGetFullPathName_U+0x2f5 ntdll.dll!TpAllocWork+0xfc kernel32.dll!CreateThreadpoolWork+0x18 UBPM.dll+0x1216 UBPM.dll!UbpmApiBufferFree+0x1948 UBPM.dll!UbpmApiBufferFree+0x1aba UBPM.dll!UbpmApiBufferFree+0x13b6 ADVAPI32.dll!EnableTrace+0x62a ADVAPI32.dll!EnableTrace+0x329 ADVAPI32.dll!EnableTrace+0x22a ADVAPI32.dll!ProcessTrace+0x1c4 UBPM.dll!UbpmOpenTriggerConsumerHandle+0x4c38 kernel32.dll!BaseThreadInitThunk+0xd ntdll.dll!RtlUserThreadStart+0x21 – greenrobot Aug 2 '12 at 20:19
1  
I have only four RtlValidateHeap’s and a TplsTiumerSet, and a UBPM just popped in. Try checking to see if you have any non-default tasks scheduled. Also see what the highest memory-using and CPU-using processes are. Also try shutting down each service possible and check if it drops after each one. – Synetech Aug 2 '12 at 21:36
show 5 more comments

2 Answers

up vote 1 down vote

Normal sub-sub-processes are around 70-100 for the services.exe process. (This makes 7-10 subprocesses on average). What the OP posted was probably all of them combined.

Your running of eclipse attaches itself to services.exe because it utilizes multiple (hundreds) of built-in macros and algorithms that Eclipse doesn't need to run because it's built into Windows. These running items, as I previously mentioned, attach to services.exe as sub-processes (or threads, as you mentioned them).

This explains why it spikes when running the program. Perfectly normal. It's an intensive program, and shaves off processing time by pre-loading ALL possible algorithms and macros into Services.exe right at launch.

Hope that helps! Not much to worry about here. Scan with Malwarebytes if you're nervous it's a virus, but I've seen it before in my computer labs. Normal.

share|improve this answer
> Normal thread-count is around 70-100 for the services.exe process.   Huh? I had five. Oliver had 16.   Why would Eclipse load hundreds of threads into services.exe as opposed to eclipse.exe? o.O – Synetech Aug 6 '12 at 3:11
I think you're thinking of the actual threads that make up the services.exe process. Sub-processes are everything that runs under the "service" name in Windows. For example, in Windows 8 the names of some of the "processes" are "Service Host: Local Service" and "Service Host: Local Service (Network Restricted)". Each of these processes has around 10 "sub-processes" that make up that particular service. I can see where this could be confusing. But rest assured, it is in fact normal. The reason it doesn't load them into eclipse is mentioned above; Most commands are built in to Windows. – ThePCpenguin Aug 6 '12 at 3:16
Windows 8 does segregate it slightly differently. For example, in Windows 7 it would be viewed as 7-10 "sub processes" while Windows 8 explains all the sub-sub-processes as well. Your comments are spot on for both operating systems, I just tried to elaborate. :) – ThePCpenguin Aug 6 '12 at 3:20
There are most definitely not hundreds of services running under services.exe and I can’t imagine that Eclipse would create and run hundreds of services anywhere. Either way, the question is about Windows 7. – Synetech Aug 6 '12 at 3:21
Synetech: What the OP posted was probably a combination of sub and sub-sub processes. ProcessExplorer doesn't tell the whole story. There's no way he's seeing 100+ sub-processes. – ThePCpenguin Aug 6 '12 at 3:25
show 2 more comments
up vote 0 down vote

I think it's not normal, who needs 1000 threads? What you can do, you can install StraceNT for Windows and debug the process what exactly it's doing.

Use -f option if it's available on Windows, it'll trace the process children.

You could also try to renice the process.

share|improve this answer
Is there anything StraceNT can do that SysInternal's Process Monitor cannot? – greenrobot Aug 8 '12 at 16:05
Yes, it can trace the process in the real time, not just show the threads. It could show the information exactly what the process is doing, all the syscalls performed to the system, etc. – kenorb Aug 9 '12 at 8:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.