Link to home
Start Free TrialLog in
Avatar of CraigSNYC
CraigSNYCFlag for United States of America

asked on

DWM (Desktop Windows Management) is hogging the CPU

Have a system where the process DWM is using so much of the CPU that nothing else will really run.  Once the system is booted, if you startup IE it'll take 5 minutes to load.

Also, when booting the system into Safe Mode, after the Dell splash screen appears, after pressing F8 the lines of text for the boot options and when the system is loading the drivers the lines of text take about 2 seconds/line to draw.  

I ran AVG in SafeMode.  It didn't find anything.

I pulled the drive and have it connected to another system.  Ran AVG again: Clean.  Windows Defender: Clean.  About to run Spybot.

Ideas?
Avatar of johnb6767
johnb6767
Flag of United States of America image

"after pressing F8 the lines of text for the boot options and when the system is loading the drivers the lines of text take about 2 seconds/line to draw"

Do you happen to have another video card you can use to test with? Not many things that early in the bootup process that can affect your speeds.....
ASKER CERTIFIED SOLUTION
Avatar of johnb6767
johnb6767
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
see http://en.wikipedia.org/wiki/Desktop_Window_Manager

what did you do to get dwm hogging the cpu ie how did it start
Avatar of CraigSNYC

ASKER

IanTh DWM manages the process that manages graphics in Vista. It starts at boot.  

I'm running Proc Exp on the system now.  I haven't downloaded debug symbols so looking at the Threads will be pretty inconclusive.

DWM isn't run by a SVCHOST process.  It's its own process.  
Use the Microsoft Symbol Server to obtain debug symbol files
http://support.microsoft.com/kb/311503

Dont need the symbols.....

File>Configure Symbols inside of PE. Paste the following, after creating a c:\Symbols folder.....

SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Sorry, Options>Configure Symbols
Once I pop the drive back in I'll run Proc Exp with symbols and I'll let you know what happens.
After running AVG, SpyBot, MalwareBytes, Defender and CHKDSK /R on the drive I popped it back in the system and it was fine for about 3 minutes then it began to slow down.

Here's the stack from Proc Exp. from the thread that's eating the CPU. (it's using about 50%)

ntkrnlpa.exe!KeWaitForMultipleObjects+0xab7
ntkrnlpa.exe!KeWaitForSingleObject+0x492
ntkrnlpa.exe!PsGetCurrentThreadTeb+0x377
ntkrnlpa.exe!KeInsertQueueDpc+0x670
ntkrnlpa.exe!KeWaitForSingleObject+0x492
ntkrnlpa.exe!NtWaitForSingleObject+0xc8
ntkrnlpa.exe!ZwQueryLicenseValue+0xbd2
ntdll.dll!KiFastSystemCallRet
kernel32.dll!WaitForSingleObject+0x12
milcore.dll!MilComposition_WaitForNextMessage+0x1e1c
milcore.dll!MilComposition_WaitForNextMessage+0x2775
milcore.dll!MilComposition_WaitForNextMessage+0x3122
milcore.dll!MilConnection_CreateChannel+0x9c7
kernel32.dll!BaseThreadInitThunk+0x12
ntdll.dll!RtlInitializeExceptionChain+0x63
ntdll.dll!RtlInitializeExceptionChain+0x36


One other detail: the system is fine when booted into Safe Mode.
Another detail:

I'm sorry, actually DWM is started via SVCHOST. Here's the command line for it:

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
try process explorer to really see whats going on behind the scenes

see
http://download.cnet.com/Process-Explorer/3000-2094_4-10223605.html
IanTh -- Process Explorer is what I'm using.
You're not going to believe this. There were several Windows updates that needed to be installed, so I shutdown the system and let them install.  The problem is gone!

Who knows!  I'll file this under, "FM". f*cking mystery.

As for the points, I'm awarding them to JohnB.  

Thanks!
The solution offered didn't fix the problem but gave great advice on how to track down the issue!
Im glad you are fixed. Sorry for the delay, just getting online. Whats this DLL belong to?

milcore.dll
typical m$ eh glad you got it sorted
Johnb, do you mean who's running MILCORE.DLL?
No, what app does it belong to?
I don't know.