Tom Horsley writes:

Here's a weird one I just noticed: I've been using a Windows 10 virtual machine to run my tax software. I've got it displayed in virt-viewer and all is well, then I close the virt-viewer window and leave the KVM running. About 5 minutes later I see a cpu suddenly pegged at 100%. I run top and see that qemu is the culprit. I start virt-viewer again, and it goes back to normal.

Anyone else seen this? Why would nobody looking at it make it go crazy I wonder?

Because you're using Microsoft Windows 10. Its built-in spyware and telemetry, that runs all the time and needs to report to Redmond, isn't cost- free and is pretty hard on the CPU.

Recall that story, about a week ago, when they caught spear-phishing malware being spread on Huawei-manufactured Win10 boxes, by hacking into Huawei's driver update system? You probably skimmed the headlines, and might've read some lightweight stories on that. Try to find some more in-depth coverage of that, and read it. The hack was discovered by Microsoft from uploaded telemetry collected from end-user PCs, in the wild. Microsoft's Windows 10 telemetry detected Huawei drivers making kernel calls that you don't normally expect hardware drivers of that type to make, and reported that to Microsoft.

That kind of internal monitoring is not cheap, you know. In your case, Windows 10 detects you're not using it, it's idle, so it has a lot of work to catch up, and starts uploading all the collected telemetry to the mothership. Microsoft simply wants to make sure you're not hacked, you know. That takes some serious CPU cost.

Don't even bother closing down the window. Just reboot, and do nothing with windows 10. Just sit there with an open desktop. Within 5 minutes the CPU will quickly spike, and get pegged at 100% for maybe 10-15 minutes, before everything finishes.

It's worse if you don't change the default option that enables "fast startup", or whatever it's called. That's when Windows 10 "shut down" isn't really shut down, but more like "suspend to disk", and then pretend that it shuts down, so that the next boot allegedly goes faster.

I'm pretty sure, after observing the behavior for some time, that Windows' equivalent of cron, after such a "fast startup", suddenly realizes that all the regularly-scheduled telemetry hasn't run in a while, and starts everything immediately, generating some serious wattage from the CPU.

I did not notice any measurable difference in startup speed after disabling "fast startup". Windows 10 still spins on the CPU post-boot, doing its telemetry stuff, but gets it done noticably faster, and goes down to its idle state much quicker.

On 4/6/19 9:27 AM, Tom Horsley wrote:

Here's a weird one I just noticed: I've been using a Windows 10 virtual machine to run my tax software. I've got it displayed in virt-viewer and all is well, then I close the virt-viewer window and leave the KVM running. About 5 minutes later I see a cpu suddenly pegged at 100%. I run top and see that qemu is the culprit. I start virt-viewer again, and it goes back to normal.

Anyone else seen this? Why would nobody looking at it make it go crazy I wonder?

Hi Tom,

I adore qemu-kvm. It is one of Red Hat's many crowing achievements.

Ahhh Windows Nein! Ooops, Windows Ten. I do not adore Windows Nein.

99% it is Nein doing this to you.

Here are some things you can do:

1) Switch to Windows 7

2) run "winver" from the command line. If you are not on build 1908, get ready for all h*** to break loose. You will be downloading about 2.3 GB of data to reinstall Nein to 1908. Be prepared to not recover after it decides to force the upgrade down your throat. (I turn off my update service. Then wipe and reinstall whenever a new build comes out.) The upgrade itself could take up to a day to complete, so be prepared, especially as April 15th rolls around, or like me, go into services and disable the updates.

3) change your boot order to boot off the ISO you installed with. At the install start up screen, check and see if your CPU usage dropped from the qemu-kvm console.

You can also do this with any Linux Live ISO.

4) go into Device Manager and try to figure out who is eating your CPU.

These two are of great help:

AutoRuns: https://technet.microsoft.com/en-us/sysinternals/bb963902

Process Explorer: https://technet.microsoft.com/en-us/sysinternals/processexplorer

Note that both allow you to run your processes through Virus Total to see if you are infected.

A virus scan can peg your CPU. So can your antivirus doing the end around confusing loop with a mutex virus: the running process keep reinstalling the virus file and the anti virus keep removing it.

5) turn off the telemetry. Windows Nein spies and spies and spies: Shut Up 10 https://www.oo-software.com/en/shutup10 Flip the "everything" switch and reboot.

6) try running your tax software under Wine. Wine if really buggy, but there is a chance.

7) I would also say, turn off "fast boot" as Nein never actually reboots, but the feature is wisely not supported in qemu-kvm. You should reboot Nein once a day. Your nightly power off will suffice

HTH, -T

I wonder if I will get tagged for being off topic?