Vista Cryptographic services throttles one of my cores.

[Korporativ]

In the last week or two, I noticed my processor chart always sitting at 50% or so. Upon further investigation, I noticed svchost.exe was the culprit. I tracked the processor ID and through trial and error figured out that cryptographic services was throttling one of my cores fully. It seems like a useful process, and it'd suck to have to run vista with that perminately stopped. If i disable the service and re-enable it, it is usually fine for about half an hour then freaks out again.

Does anyone have any insight into what could be causing these issues with Cryptographic Services in Vista? The only thing I have installed recently was Hamachi, but I can't imagine that being the problem.

 

[Smilin]

how did you track down the processor ID again? Unless you manually hard set the affinity things will run back and forth on both processors (although a single threaded process may stick a bit to one in particular).

 

[Korporativ]

It's a threaded process, you can simply take task manager, check your svchost.exe file, go to the services associated with the PID of the problem, then examine which of those listed are causing problems. Trial and error basically. You can track the same thing through some dos commands, but ultimately does nothing. Does anyone have an idea on how to fix this? It's starting to get highly annoying, I just tried to install a java update... which needed CryptSvc to start, and it pegged both cores at 100%.

I get the feeling I'm going to have to call Microsoft and have words with them.

 

[bsobel]

Does anyone have any insight into what could be causing these issues with Cryptographic Services in Vista? The only thing I have installed recently was Hamachi, but I can't imagine that being the problem.

I don't have any ideas on this one except to point out that Hamachi does do encryption (albeit I don't know if they use the system api's to do so or not). Further, I didn't realize they had a Vista bulid out (need to go peek).

If you are up for it, system restore before the Hamachi install and see if it goes away.

Bill

 

[Smilin]

cryptographic services are only used on occasion, not continuously so that would indeed be odd.

You'll have to enlighten me on that "trial and error" thing. I'm not sure how you can determine which hosted service is causing a cpu spike with just tasklist & taskmanager alone.

I believe process explorer from sysinternals might show that. Can't remember. In any case if you want to isolate crypto services to be sure you can put them in their own svchost. Do this:
goto system32 and make a copy of svchost called like "mysvchost" or "crypt_svchost" or something.
Open regedit and find the crtypsvc in hklm\system\ccs\services.
Change the start command in there from svchost to whatever you named your copy
reboot and you'll now be able to get a look at that specific service using taskmanager or something. You'll also be able to get a solid handle count and things like that.

Questions:
When you stop crtypto services do both cpus drop to idle?
Does CPU use peg again when you start the service?
Is the high cpu usage present from the moment you boot, or does it appear later?

One thing I've seen cause issue is corrupted driver sigs (or related) If the problem appeared after a windows update do this:
chkdsk /r your drive.
Stop crtypto services.
rename windows\system32\catroot2 (don't touch catroot!)
restart crypto.

 

[Korporativ]

Yup, if i stop crypto, both processors go solid idle again. If i start the services again, it pegs near instantly.

By trial and error I just mean I went to the services associated with SVCHOST.exe on the PID, and stopped and started them one by one to see where the problem was. CryptSvc was the winner.

Because of the way crypto services are, they don't start up immediately with windows, it's set to "delayed startup" or whatever. But when they're activated it goes to crap. I set it to manual startup, then loaded an app that I know requires it, and it instantly pegged one processor at 50%, then to my chagrin, pegged the other one to 100%. It wouldn't let me stop crypt services so I had to reboot.

It's possible that the problem is being caused by corrupt driver somewhere, I know the first driver razer released for vista installed just fine, but its uninstaller was only 32-bit and the drivers didn't properly work in x64 Vista. So I was stuck with em installed until they released new ones that actually cleaned the old ones. (I tried manual removal of the old ones even and it didn't help). I'll give the chkdsk/r a try.

 

[Smilin]

the chkdsk /r part is just to catch a bad spot if there happens to be one sitting under a corrupted driver signature...it's mostly to be sure you don't get things fixed then the problem pop right up again.

the renaming of catroot2 is the real magic.

 

[Korporativ]

So far so good after renaming the catroot2 folder, what does that folder contain? Certificate cache or something?

Renamed it in safe mode just to be sure.

Never mind, I just had to let it idle with Cryptsvc running for a while, and it is back to the usual behavior. How odd. I'll call MS on Monday and see if they have a solution.

 

[Smilin]

That folder contains a catalog of signatures used by signed drivers (crytpo service chews away in there a lot). I've seen Windows update problems related to that folder that will cause the crypto service to CPU spike.

Giving MS a call wouldn't be a bad idea. The perf guys have a bag of tricks that I don't know and I've been out of the setup team since before Vista was released. Being this early in the product lifetime there is a better chance than say XP that this could be a bug. If it is a bug they'll refund your case after they fix things. Post the results though. Very interesting.