Quark Fusion

On my system SharedAccess_NAT produces a lot of errors, like 31003, 31004, 30013, 34005, 34001 errors in Event Log. And sometimes configuration of ICS isn't working (while already turned on ICS work), i.e. when I try to turn off and turn on again ICS on network adapter turn on operation fails with null error or similar. At same time svchost.exe can crash also killing other services. DNS proxy (where that service is?) sometimes stop working and my second PC can't resolve DNS names. CPU is stable, tested with Prime95 and Folding@home running 24/7 without errors. I must admit that I apply hack to tcpip.sys since without it ICS totally kills new connections when 2 PC attempt to communicate with p2p networks. I'm running Vista Ultimate x64 Service Pack 1, Kaspersky Internet Security 8.0. System also have 3 physical (1 disconnected) and 2 virtual (vmware) network adapters. DEP is enabled for all programs and services. What is proper way to enable ICS with unlimited connections or Vista Ultimate isn't capable of that?

I read somewhere that -i switch means "work only if system is idle for few minutes", it's not documented because was added after freeze of language packs (still I don't understand why not update language packs, even if they can't do that before release they can do it with windows update) BTW, my system is Vista x64 SP1.

Did anyone know what it means? (It used in ScheduledDefrag task)

process explorer like tool shown that process have thread synchronization call last in his stack during high cpu consumption, so i want to count how much cpu time actually process spent calling that function, i suspect that most of that cpu time process check another's thread work instead of waiting for synchronization object. I didn't figure out how to use xperf for this particular task. (Seems that i can do kernel profiling with it) … After some research: is this what i looking for? Do i need LOADER flag? (I need to profile already running process)

Im actually don't want to digging into code, quick analysis of process behavior is what I looking for. (I suspect there is a bug in thread synchronisation.)

I recently got a need to trace how actively a process calls to system functions like thread synchrotisation. I has tried AQtime and Intel VTune Perfomance Analyzer, but AQtime simply crash all the time and VTune can't attach to already running processes (or I just don't found that option). Did you know about tools that can attach to a running process and count calls to various routines (taken from debug symbols, not source code)? And it must be Vista-x64 compatible.

It's run that again, also when it's working it calls some thread in System process that uses additionally 3% of cpu (3% of 4 cores). At task's start time cpu load was 100% by my background tasks. Memory usage: SuperFetch stopped — 35Mb, started — 166Mb (was 270Mb). Update: task started around 10 mins after service start.

Ok, I catched it, after hitting restart button for all affected services one didn't restart at short and it was SuperFetch service. Also after some time at witch that thread finish it's task svchost's consumed memory go down to around 20-40Mb, thread terminated and SuperFetch reach stopped state. For now system have 1Gb memory free and task manager shows 1-2Mb as "free" (I think correct term should be "not used"). (SuperFetch is restarted) Now the question, what SuperFetch service was doing? There was some times when system access prefetch files, but I think it was ReadyBoot feature that consolidates it's trace files (the process take 10-20 secs). Also when SuperFetch loads files in the background it's not show any cpu load (and load files to free memory, not self). P.S. SuperFetch service has SysMain as it's internal name.

Hmm, how I don't think about that?

That thing just finish it's task (as encode ended and system become idle), again don't know if it was first time or second, but thread's consumed cpu time is 21:56 and uptime is 3:01:07:xx

Also I want to add, that if EMDMgmt is ReadyBoost, that I just plug usb-drive about two weeks ago and also don't remember if that loads was before that (but think it was) It's likely that ReadyBoost feature don't gain any notable benefit to my system with 8GB ram, so if you think it can be reason for that i can disable service Another thought is that it can be SuperFetch process, but most likely that is different story (as I can see when system actively access files). As more information there is start addresses of other threads: svchost ! _BuildServiceArray@8() + 0xb5 ntdll ! _RtlAddAtomToAtomTable@12() + 0x152 audiosrv + 0xBA00 MMDevAPI ! public: virtual long CRegistryPropertyStore::GetValue(struct _tagpropertykey const &,struct tagPROPVARIANT *) + 0x241 uxsms ! private: static unsigned long CPortBase::PortThread(void *) + 0x0 emdmgmt ! unsigned long EcSvcWorkThread(void *) + 0x0 ole32 ! private: static unsigned long CRpcThreadCache::RpcWorkerThreadEntry(void *) + 0x0 ntdll ! __woutput_l() + 0x244 pcasvc ! unsigned long PcapProcessChainThread(void *) + 0x0 ntdll ! __woutput_l() + 0x244 hidserv ! HidThreadInputProc() + 0x0 hidserv ! HidThreadProc() + 0x0 hidserv ! HidThreadProc() + 0x0 ntdll ! __woutput_l() + 0x244 sysmain + 0x462D0 SSDPAPI ! unsigned long GetNotificationLoop(void *) + 0x0

cluberti, I don't know what "adplus" thing is, so I will look at your guide and think afternight about it.

AudioEndpointBuilder, EMDMgmt, hidserv, Netman, PcaSvc, SysMain, TrkWks, UxSms (that all) Thread view most time traps process in (SysMain + 18xxx) thing, althrough i don't sure if that means dll name or symbol name. Is it something like every N minutes, but N isn't fixed. I was spoting this load at evening and at night mainly, maybe because I don't care at day. Sometimes that process runs again several mins after it finish previous task. The task (continous cpu usage) is like 10-30 mins, I don't remember exactly. But one pass time seems like constant. I have idea that it's scheduled task, that should run at evening only when computer is idle and delay start if not, but not sure about that. 15% may seems low across system, but system has 4 cpu cores, so if recount that to one core it will be high. What if my system were dual-core? single-core? (I actually have one single-core system, but it's now off and don't have vista installed, but I want to power it on some day and under control of Vista for some reason) I don't care if it's run only once a week, but when I spot it at random time, consuming non-idle resources — I think that something is wrong. Especially when it's rerun like 2 mins after it's done. And last that bothering me is memory used by services, just this one process allocated 270MB and has 240 in use, but it was like that from very begining, maybe it's Vista way and x64 contributed to it. P.S. run background task at thread priority -1 from process sucks, as user's background processes have thread priority -2. (Norm=8, BNorm=6)

At my quad-core 3GHz Vista X64 system the "svchost.exe -k LocalSystemNetworkRestricted" process using 15% CPU (which results to 60% of single core or 2 gigacycles per second) resources from time to time like runnung some scheduled task. Task is running in thread, which have priority lowered by 1 (which still interfered with my background processes at bellow normal priority) started from "ADVAPI32 ! unsigned long ScCheckServiceSids(void) + 0xf7". Search for "ScCheckServiceSids" yelds no results, maybe this is undocumented function? To relocate that system time to my applications I lowered svchost priority to bellow normal and afraid that this can hurt some system-critical tasks. P.S. sorry if my english is bad.