31 replies to this topic

[Pon]

I've got a Q9450 w/8GB of RAM running Vista Business x64 on a 75GB partition on a WD 640GB AAKS with a separate 74GB WD Raptor that's currently empty. My HDD LED is constantly blinking because something is accessing the AAKS and according to Process Explorer the culprit is csrss.exe, which is making a huge number of I/O reads. I've googled around and found others have had a similar problem, but no one seems to have provided a solution other than to suggest a possible virus (it's not in my case). I've disabled a bunch of unnecessary services but csrss.exe keeps going. Does anyone know what's going on?

[x3lumin8x]

Read this - http://www.liutilities.com/products/wintas...slibrary/csrss/

[Pon]

Yeah, in searching around before I came across a number of those "what is x process" sites, but they really don't give much insight as to what might be causing the HDD reads. All they say is that 1. csrss.exe is a system critical process and 2. there is a trojan that disguises itself as csrss.exe. I built my system yesterday, installed Vista last night, and virus scans reveal nothing. Being new to Vista I wonder if everyone experiences this but just ignores it? I find it extremely annoying and it seems to be driving up my HDD temp (currently 44C after 120,000 I/O reads by csrss.exe).

[+Brandon Live]

csrss.exe is the Win32 subsystem. It's strange to have lots of I/O coming from it, but I'm not really an expert on the behavior of that particular process. Do you have any command prompt windows open and doing anything?


What files is it accessing?

[Pon]

Brandon Live, on Jul 27 2008, 17:57, said:

csrss.exe is the Win32 subsystem. It's strange to have lots of I/O coming from it, but I'm not really an expert on the behavior of that particular process. Do you have any command prompt windows open and doing anything?


What files is it accessing?

Thanks for the reply. I don't have anything unusual running in the background; without installing any programs (right after fresh install) and with no 3rd-party programs running I still see the I/O activity. When I'm logged in there are two instances of csrss.exe running and the one doing all the I/O reads has a session ID of 1 (meaning I guess that it's launched by the user). I created a new temp user just to check and still saw the constant I/O reads. I notice my HDD LED blinking constantly even if I just sit at the welcome screen without logging in.

So, according to Process Explorer csrss.exe is usually running with 9-10 threads. Currently I see several instances of winsrv.dll and csrsrv.dll and one cdd.dll. Usually two of the winsrv.dll threads have constantly fluctuating 6-8 digit "Cycles Delta" values, which I know nothing about.

I really, really need to figure this out because it's driving me nuts. I might have to go buy a XP x64 license if this is unresolvable.

EDIT: OK, so this is weird I think. In Process Explorer I double-clicked on the csrss.exe process to bring up its properties, and then clicked on the Performance Graph tab. The I/O Bytes graph looked random with spikes and troughs. But when I move my mouse around it shoots up to around a max of 12kb. When I stop moving my mouse it goes down to 0, though my HDD LED is always faintly flickering. So, the high I/O reads for csrss.exe seem to directly correlate with my mouse movements, but the constant HDD LED flickering is independent of that...?

Now, just concentrating on the mouse movements issue, I have a Logitech G5 mouse. It is the only USB device that I have connected. I installed the SetPoint drivers but this I/O read thing was happening even before I installed them (i.e., when it was using whatever default driver Vista installs for it). In the device manager I have no unrecognized devices and my mouse is recognized, but under the Human Interface Devices category I have two entries each for HID-compliant device and USB Human Interface Device. I have no idea what they're referring to, whether they're just extra entries for the mouse or what, but the only other input device I have is a keytronic keyboard and it's connected to the PS/2 port.

Edited by Pon, 29 July 2008 - 00:36.

[soldier1st]

it could be superfetch but what security software do you have?cdd.dll is a Canonical Display Driver so what you may need to do is upgrade your display drivers to vista compatible ones.btw what is your video card?

Edited by soldier1st, 29 July 2008 - 19:15.

[PermaSt0ne]

i'm on vista x64 ultimate with plenty of programs running and my computer has been on for the last 18 hours

when i look in task manager my csrss.exe has 0 I/O writes, but a ton of I/O reads and it goes up whenever i move my mouse. seeing as i also have a G5 mouse, i'd say it's normal. but my LED blinks every second whether i'm moving my mouse or not so i doubt that's causing it to blink

[Pon]

soldier1st, on Jul 29 2008, 15:08, said:

it could be superfetch but what security software do you have?cdd.dll is a Canonical Display Driver so what you may need to do is upgrade your display drivers to vista compatible ones.btw what is your video card?

I'm not running any security software, I have superfetch disabled, and I have a Radeon 4870 running the latest Catalyst 8.7 drivers (downloaded from amd.com and installed straight from the exe).

I checked another computer running XP 32-bit and when I move the mouse on it I get the same I/O reads by csrss.exe. So I guess that's a common Windows thing. However, that computer does not have the constant HDD LED flickering the way I do. I mean if every Vista user has constant HDD LED flickering then I suppose I can ignore it, but right now my worry is that it's indicative of something weird/problematic going on with the OS somewhere. I dunno, maybe it's a hardware issue? The LED doesn't flicker when I'm in the BIOS, maybe I'll try installing Linux at some point and see if it happens there.

[TheNay]

I have this running on XP SP3 too, but not causing any issues here.

[EduardValencia]

It could be superfetch and indexing procedures when the Vista installation is fresh,it willl calm down in a few days,give it more time,you'll be satisfied.

[+Brandon Live]

Pon, on Jul 29 2008, 12:30, said:

I checked another computer running XP 32-bit and when I move the mouse on it I get the same I/O reads by csrss.exe. So I guess that's a common Windows thing.

The tool you're using might be reporting cached I/O, which isn't actually hitting the disk. It could be something as simple as reading the mouse cursor image from the resource.

Quote

However, that computer does not have the constant HDD LED flickering the way I do. I mean if every Vista user has constant HDD LED flickering then I suppose I can ignore it, but right now my worry is that it's indicative of something weird/problematic going on with the OS somewhere. I dunno, maybe it's a hardware issue? The LED doesn't flicker when I'm in the BIOS, maybe I'll try installing Linux at some point and see if it happens there.

Is it just the flickering light that is bothering you? Or do you feel that the disk activity is making your machine unresponsive or slower?

If you use Resource Monitor and sort by the processes with the most disk activity (sort by Read B/min or Write B/min), which ones are at the top?

[Pon]

Brandon Live, on Jul 29 2008, 18:12, said:

Is it just the flickering light that is bothering you? Or do you feel that the disk activity is making your machine unresponsive or slower?

Well, it bothers me. I can't say that my machine feels slower since I have no comparison point as it's newly built and very fast in general. If the HDD LED is constantly blinking for no discernible reason then it suggests something I don't know about is accessing my disk (possibly a security concern), which also lessens the utility of having an LED to inform me of disk activity (kind of like someone constantly pulling a fire alarm when there's no fire).

Brandon Live, on Jul 29 2008, 18:12, said:

If you use Resource Monitor and sort by the processes with the most disk activity (sort by Read B/min or Write B/min), which ones are at the top?

The list of processes in the disk activity area varies, sometimes it even empties, but when it's empty I still see the LED flickering. I watched the disk activity list for a few minutes with nothing open and sorting according to Read B/min and Write B/min, and the most common appearances were by System. System was writing to various files, often C:\Windows\System32\config, C:\$mft, c:\$bitmap and c:\$logfile. They were almost exclusively writes, not reads. But again, even when the Resource Monitor didn't show anything accessing the disk the HDD LED was still blinking. Incidentally, I disabled the Distributed Link Tracking Client service (which from the description sounded like it might be the culprit).

I installed Ubuntu 8.04 on a separate partition and when I wasn't doing anything explicit to cause disk access my HDD LED was appropriately dark (no flickering). So the cause, whatever it is, seems Windows specific.

[+Brandon Live]

Well, beginning with Windows Vista we started deferring lots of I/O to idle time. This usually provides a better experience overall, as the system can be more responsive while you're using it and can queue up other tasks that require access to the disk until you're not busy.

If it is a brand new system, you'll likely see things settle down a bit after a few days. If you leave it idle for a little while, does the activity eventually stop? Or continue indefinitely?

[random_n]

Automatic disk defrag, automatic file indexing, automatic boot optimization, automatic prefetch optimization, and automatic restore point creation are all tasks that run by default in Vista and can do disk I/O without your asking. Most of them should settle down within the week, and all run at low disk I/O priority, but if it's persistent and annoying you then turn them off one by one until it stops.

Lots of them are useful, though, so evaluate your needs and decide what should stay on. Don't forget that if your performance is fine, but the blinkenlight still bothers you, electrical tape over the front or unplugging the light is always an option!

[Pon]

So far the blinking has been constant, regardless of how long I leave it idle (I disabled suspend, in part because the computer won't wake from suspend, it just starts and stops until I cut the power and reboot). I went through the services one by one and turned off indexing, superfetch, readyboost, system restore, etc. Still blinks. I don't intend on running it so barebones in general but right now I'm just trying to eliminate possibilities.