Task Manager shows higher total CPU usage than the sum of all running processes. Hidden process?

In Windows Task Manager and AVG Task Manager (included in TuneUp Utilities), I see that the sum of all the running processes is much lower than the total CPU usage shown in "performance" tab. Does this mean that my PC is running a hidden process or some malware that's not displaying in the Task Manager?

EDIT: inbuilt monitor showing this too, and show processes from all users showing too. laptop is two-cores, and I'm taking total load of both.

tensojka

Posted 2014-09-21T17:30:40.670

Reputation: 225

3How large is the difference? If it's not too big (relative to the total number of processes), it could easily be from the fractions of a % adding up. – Kitsune – 2014-09-21T20:33:01.317

1Is there a "Show Processes from All Users" button? Sometimes the windows task manager will hide system processes if you don't click the button. – None – 2014-09-22T01:34:46.197

1In addition to the comment above about showing all users processes, it could well be hardware interrupts, which task manager doesn't show. You'd be better using the built in resource monitor, by opening task manager, going to "Performance" and clicking on resource monitor. – Chris Murray – 2014-09-22T07:59:37.103

Interesting queston, did you take load per core and hyperthreading into account ? I'm not sure if a keylogger would be that obvious to notice. – None – 2014-09-21T18:26:10.347

You would need to run a facility that explicitly takes into account the CPU usage of the kernel and other users. I don't know Windows well enough to know whether the Task Manager does that for you out of the box but you ought to check. For the matter a keylogger is such a trivial piece of code that it should not consume any noticeable amount of CPU. – None – 2014-09-22T16:55:07.727

keylogger - and what about screenshots taking? video? encrypting it... – None – 2014-09-22T17:02:44.360

@hoschiCZ it would be much easier to detect either the disk or network usage than to try and guess based on CPU usage.. – user2813274 – 2014-09-22T21:20:55.570

Answers

This is because the task manager round up or round down the CPU usage values per process. You can see a lot of process using "0" CPU time, this is false, they use "0,xxxxxxx" cpu time.

What you need is a process manager showing more precise value to you.

Some process can also be hidden (negative PID, running as another user) or some piece of hardware may have direct access to the CPU by passing your operating system (but probably not)

Zulgrib

Posted 2014-09-21T17:30:40.670

Reputation: 280

1negative PID? how can I view processes with negative PID? – tensojka – 2014-09-29T16:57:51.477

2This is another question and should have it's own question page. If my answer is correct about the specific question you asked you can mark it as answer with the checkmark icon. You could ask "How to list process with negative PID on Windows" on the new question page. – Zulgrib – 2014-09-30T18:54:47.143

There is no such thing as a "negative PID" in Windows. PIDs are not signed numbers, at all. – Jamie Hanrahan – 2015-08-01T20:40:33.203

Thanks for your input, this explains why security software actively track process with negative PID.

http://support.kaspersky.com/6658

Have a nice day.

– Zulgrib – 2015-08-02T09:19:00.523

Run Process Explorer and you'll see the cpu usage for everything including services like anti-virus checkers. (I just had the same issue and I found Symantec's ccSvcHst.exe was taking up 13% of my cpu.)

nevster

Posted 2014-09-21T17:30:40.670

Reputation: 166

I had the same issue, where the built in task manager recorded a CPU usage much higher than the processes I was running.

Using Process Explorer, I found that the process using up my CPU was a image editor that was running on another Windows user.

Switching to that user, logging out and then logging back in to the first user confirmed that the CPU was now down to expected levels.

Gustav

Posted 2014-09-21T17:30:40.670

Reputation: 1