Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Windows 8 Pro x64. I've noticed that Rundll32.exe process is taking a lot of CPU (25%, which is a 100% load of a single core) then I'm not not using computer, specifically then sceensaver is active. And that process is terminated immediately then screensaver goes away (then I move mouse, or press a key on keyboard).

I've found this because I'm using custom process monitoring program, that also allowed me to collect info about process (that is last info awailable from already stopped process):

Path              = C:\WINDOWS\system32\rundll32.exe
User Name         = NT AUTHORITY \ SYSTEM
PID/Parent PID    = 4576 / 800
Started by        = C:\WINDOWS\system32\services.exe
Virtual KB        Curr = 149 872 Peak = 299 416
Working Set KB    Curr = 54 732 Peak = 54 732
Page File KB      Curr = 46 720 Peak = 46 720
System Pool KB    Paged = 208 Nonpaged = 22
Private KB        = 46 720
Handles Count     = 385
Faults Count      = 293 958
Windows           = 0
Reads             = 4 255   Read KB = 56 263
Writes            = 1   Write KB = 0
Other IOs         = 677 511   Other KB = 8 614

From that info it's obvious that process is taking a lot of reads and no writes. Also it's started by Services Control Manager. I've never noticed such behaviour on my Windows 7 prior to upgrade, and wondering if it some sort of a bug which causing , or a some legitimate system scan task?

I'm using a Blank screen screensaver, which is not using any CPU. I've actually verified that scrnsave.scr is also terminated, but does not consume CPU. CPU is consumed specifically by Rundll32.exe which is, obviously, somehow tied with screensaver DOWN events.

Also I've noticed that it start not exactly then ssaver starts, but some time after it (or maybe it have some other time interval of inactivity before it starts), but stops always then ssaver is stopped. And as I discovered it actually terminates after some time, I estimate latest encounter as about 2 minutes of work (but I'm not sure if it always takes this much time).

And (as I discovered just now) it seems it does not start again after finishing it's work. Looks like it is actually some legitimate system stuff is just going on, then system is idle. It makes sense since it takes a lot of CPU, so it won't slow down any user process (somewhat similarly to how ngen.exe is working).

share|improve this question

Install the Windows Performance Toolkit, run a command prompt with admin rights and run this command and minimize the Window:

xperf -on latency -stackwalk profile -buffersize 1024 -MaxFile 256 -FileMode Circular && timeout -1 && xperf -d HighCPUUsage.etl

After you reproduced the issue, go back to the CMD, press any you you want to stop the logging. Now zip the HighCPUUsage.etl as 7z and upload it.

share|improve this answer
Thanks for advice, but problem seems to be solved (sort of). See my answer. – Petr Abdulin Feb 25 '13 at 8:24

Probably that rundll32.exe is loading the screensaver.

most screen saver are useless, they are pretty, but just burn CPU, GPU and you win more by just suspending and later turn off the screen. You can put the screensaver, but just for one minute before suspending the screen. After suspending, the screensaver should not be running (i dont know if windows 8 really shutdown the screensaver when suspending the screen, test it)

share|improve this answer
That is probably not the case, I've updated the question. However if there is a bug in Rundll32.exe which causes him to eat CPU after starting ssaver that can be the case, but that does not explain why it's constantly reading the disk (or does it?). – Petr Abdulin Feb 22 '13 at 12:54
If its some time after the screensaver start up, then its something that windows 8 do in the background... things like: optimizing files, indexing documents, backups/system recovery, etc. Use the sysinternals process explorer to see what that rundll32 is exactly running, if needed, check the strings tab and select "from memory" to see what references it have in the process – higuita Feb 22 '13 at 13:54
up vote 0 down vote accepted

I'n not completely sure, but as far as I could dig into this, it's was somehow related to Dr.Web antivirus software background rountines (maybe some sort of database update, or internal checks). However I can't be 100% sure.

Since it doesn't seem to be any time of malfunction, I don't want to spend more time on research.

Update: I've notices same behaviour on my Windows 7 HB x64 based notebook, which have also same Dr.Web antivirus installed, so this seems to be it, -- some sort of Dr. Web background rooutines.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .