Why is my CPU running at 100%?

Malware hunt

One common cause of high CPU utilisation is a malware infection, and so it's important to rule that out first. Run a full system scan with your antivirus package, right now, to see what it turns up. (You don't have one? Download something like AVG Free [free.avg.com] - this isn't going away on its own.)

Your antivirus tool may give you a clean bill of health, but be careful - you can't trust this entirely. It could be that you've been infected by something brand new. This happened to us recently, an instance of svchost.exe began using way too much CPU time, our antivirus package found nothing but we uncovered the malware ourselves. And you may be able to do the same.

To assist in your malware hunting, download and install a copy of Process Hacker [processhacker.sourceforge.net]. Launch the program and you'll see it's basically a more powerful version of Task Manager. Locate the process that's using all your CPU time, and make a note of its Process ID (PID).

Heavy load

HEAVY LOAD: Process Manager provides in-depth data about everything running on your PC

Now click the Network tab, which shows all the network and internet connections that may be open right now. Pay particular attention to any with an entry in the Remote Address column that looks like an internet address (that is, not something local like "127.0.0.1"). If you find your buggy process has a connection open to an address that you don't recognise, and you're not sure why, then that could mean it's malware.

Switch back to the Processes tab, double-click the dubious process and click the Memory tab. Now click String Scan, and Process Hacker will scan every byte of the processes' RAM, looking for text strings: web addresses, file names, messages, whatever they might be. Scroll down the list of everything it finds, looking for anything suspicious. We can't tell you exactly what this might be, but in the case of our svchost.exe infection, for instance, we found a URL something like "www.site.ru/newbot.php": fairly conclusive evidence that we'd been hit by a brand new specimen of malware.

Process hacker

FIND MALWARE: Process Hacker can search a process's RAM, helping to identify malware

If, at the end of this, you also find signs of malware, then you've probably found the cause of your "CPU 100% problem". And the priority is to get it cleaned up.

Try your antivirus package again in a day or two, when maybe an update will help to recognise it, or perhaps download the trial versions of some other packages (though don't install more than one at a time). And in the meantime, treat this PC as compromised: disconnect it from the web, and don't use it to access banking sites or do anything else faintly sensitive.

If there's no hint of viruses or bots, though, you'll need to look elsewhere. And there are plenty of routes you might take.

Bug fixes

If your process problems are the result of a bug, then someone has almost certainly experienced, and probably solved it before. Head off to Google, enter your process name, and keywords like CPU 100, just to see what comes up. And check Device Manager and the Windows Event Viewer for errors that might reveal an underlying issue.

It's also a good idea to identify the author of your troublesome process, too, if you've not done so already. If you discover it belongs to a particular application you've installed, visit the author's website looking for answers, or perhaps try uninstalling, reinstalling or updating the program. Or, if it's a Windows component, try searching at support.microsoft.com.

If none of this produces an answer then Process Hacker may again be able to help. The next time the process goes rogue, reduce its priority and affinity settings, as we recommended earlier, then launch Process Hacker, and locate and double-click the errant application for a closer look.

Click the Threads tab. This shows you every thread the program has open, everything that's actually running some code, along with the number of CPU cycles they're using. Look at the most active threads, then check the "Start Address" to see what they're doing. Now this area of Process Hacker is aimed at programmers, so there are no concessions to ease of use here, but as long as you know the basic rules then you may still be able to extract some useful information.

Driver easy

DRIVER PROBLEMS: Could your 100% CPU issue be caused by a buggy driver? DriverEasy will help you find updates

An Outlook thread start address might look like this, for instance: "iTunesOutlookAddIn.dll!DllUnregisterServer+0x1a6c2". The first part of this address, everything up to the !, tells us the file containing the code that the thread is running. The name here very obviously tells us where it's come from, so if this thread were causing problems then we might disable the addin, or uninstall iTunes. But if you don't recognise the file name, Google it for more information.

And the second part of the address, everything between ! and +, tells us the function that the thread is calling. This is generally more technical, less useful, but may at least give you some clues: if the function name seems related to printing, for instance, then you might go looking at your printer driver and print-related Windows services.

If the very best that Google and Process Hacker have to offer still tell you nothing,though, the best you can do is resort to some more generic solutions.

Update your drivers, for example - a tool like DriverEasy will help identify available upgrades.

You might try updating Windows and your applications, too. Check Windows Update for optional updates it recommends for your PC.

Then simplify your system by ruthlessly uninstalling anything you don't need. Use UpdateStar to highlight available updates for everything else. And if all else fails, reinstalling Windows should at least fix Windows components, freeing up your valuable CPU time and getting your PC back to normal.

Mike Williams
Lead security reviewer

Mike is a lead security reviewer at Future, where he stress-tests VPNs, antivirus and more to find out which services are sure to keep you safe, and which are best avoided. Mike began his career as a lead software developer in the engineering world, where his creations were used by big-name companies from Rolls Royce to British Nuclear Fuels and British Aerospace. The early PC viruses caught Mike's attention, and he developed an interest in analyzing malware, and learning the low-level technical details of how Windows and network security work under the hood.