Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Process ID numbers changing


  • Please log in to reply
1 reply to this topic

#1 Gerbera

Gerbera

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:02:20 AM

Posted 24 January 2018 - 12:12 AM

I'm having a problem with service process ID numbers changing on every startup and (some) being renamed with numeric suffixes. What happens is: I run Svchost Process Analyzer and it reports numerous 'atypical' files because a duplicate registry key has been created with the numeric suffix and there are no parameters in the key.  The 'normal' process registry key still exists but when I use Process Explorer to review all this, the 'atypical' files reported by Svchost Process Analyzer have these duplicate startup locations in the registry. Here is an example:

svchost.exe 2172 --
CDPUserSvc_a4af01b -- Connected Devices Platform User Service_a4af01b
Svchost Analyzer reports:
File: <Registry key not found: HKLM\System\CurrentControlSet\Services\CDPUserSvc_a4af01b\Parameters> - The system cannot find the file specified | Status: active | Group: UnistackSvcGroup
From Process Explorer:
Autostart location
HKLM\System\CurrentControlSet\Services\WpnUserService_a4af01b
Command line
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc

Each time I boot, the numeric suffix changes and several Process ID numbers change. Almost all the 'atypical' svchost files reported by Svchost Process Analyzer have startup location: (Windows Push Notifications User Service) HKLM\System\CurrentControlSet\Services\WpnUserService_a4af01b (which has no parameters)

I've searched high and low for any answer to this and found nothing. The processes all run properly and there's no real problem with my machine... but something in all this looks like a virus or something buggy/corrupt in Windows. The PID numbers are starting to reach into the five digits -- Task Manager shows services with the numeric suffix below the normal named one, both as running, but the PID is assigned to the version with the numeric suffix.

Any insight would be great. Thanks in advance.
 



BC AdBot (Login to Remove)

 


#2 jenae

jenae

  • Members
  • 403 posts
  • OFFLINE
  •  
  • Local time:08:20 PM

Posted 24 January 2018 - 12:41 AM

Hi, not sure why you want to run svchost process explorer, probably best if you just enjoy your computer, and not poke around.

 

When you restart your computer the process ID's (PID), will change, actually they can change even when using the computer.

 

Windows Ten introduced some new services mostly to give MS feedback regarding how well the OS is performing, the service codes you see ( eg:- CDPUserSvc_a4af01b) are dynamic and will change with restarts. These are all normal MS services and you are worrying about something that is not a problem, enjoy your computer, before you break it.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users