In Windows Task Manager and AVG Task Manager (included in TuneUp Utilities), I see that the sum of all the running processes is much lower than the total CPU usage shown in "performance" tab. Does this mean that my PC is running a hidden process or some malware that's not displaying in the Task Manager?

EDIT: inbuilt monitor showing this too, and show processes from all users showing too. laptop is two-cores, and I'm taking total load of both.

migrated from security.stackexchange.com Sep 23 '14 at 19:20

This question came from our site for information security professionals.

  • Interesting queston, did you take load per core and hyperthreading into account ? I'm not sure if a keylogger would be that obvious to notice. – Saint Crusty Sep 21 '14 at 18:26
  • 3
    How large is the difference? If it's not too big (relative to the total number of processes), it could easily be from the fractions of a % adding up. – Kitsune Sep 21 '14 at 20:33
  • 1
    Is there a "Show Processes from All Users" button? Sometimes the windows task manager will hide system processes if you don't click the button. – user54791 Sep 22 '14 at 1:34
  • 1
    In addition to the comment above about showing all users processes, it could well be hardware interrupts, which task manager doesn't show. You'd be better using the built in resource monitor, by opening task manager, going to "Performance" and clicking on resource monitor. – Chris Murray Sep 22 '14 at 7:59
  • You would need to run a facility that explicitly takes into account the CPU usage of the kernel and other users. I don't know Windows well enough to know whether the Task Manager does that for you out of the box but you ought to check. For the matter a keylogger is such a trivial piece of code that it should not consume any noticeable amount of CPU. – Steve DL Sep 22 '14 at 16:55

This is because the task manager round up or round down the CPU usage values per process. You can see a lot of process using "0" CPU time, this is false, they use "0,xxxxxxx" cpu time.

What you need is a process manager showing more precise value to you.

Some process can also be hidden (negative PID, running as another user) or some piece of hardware may have direct access to the CPU by passing your operating system (but probably not)

  • 1
    negative PID? how can I view processes with negative PID? – tensojka Sep 29 '14 at 16:57
  • 2
    This is another question and should have it's own question page. If my answer is correct about the specific question you asked you can mark it as answer with the checkmark icon. You could ask "How to list process with negative PID on Windows" on the new question page. – Zulgrib Sep 30 '14 at 18:54
  • There is no such thing as a "negative PID" in Windows. PIDs are not signed numbers, at all. – Jamie Hanrahan Aug 1 '15 at 20:40
  • Thanks for your input, this explains why security software actively track process with negative PID. support.kaspersky.com/6658 Have a nice day. – Zulgrib Aug 2 '15 at 9:19

Run Process Explorer and you'll see the cpu usage for everything including services like anti-virus checkers. (I just had the same issue and I found Symantec's ccSvcHst.exe was taking up 13% of my cpu.)


I had the same issue, where the built in task manager recorded a CPU usage much higher than the processes I was running.

Using Process Explorer, I found that the process using up my CPU was a image editor that was running on another Windows user.

Switching to that user, logging out and then logging back in to the first user confirmed that the CPU was now down to expected levels.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.