CSRSS.exe constant HD reads

[Pon]

I've got a Q9450 w/8GB of RAM running Vista Business x64 on a 75GB partition on a WD 640GB AAKS with a separate 74GB WD Raptor that's currently empty. My HDD LED is constantly blinking because something is accessing the AAKS and according to Process Explorer the culprit is csrss.exe, which is making a huge number of I/O reads. I've googled around and found others have had a similar problem, but no one seems to have provided a solution other than to suggest a possible virus (it's not in my case). I've disabled a bunch of unnecessary services but csrss.exe keeps going. Does anyone know what's going on?

[x3lumin8x]

Read this - http://www.liutilities.com/products/wintas...slibrary/csrss/

[Pon]

Yeah, in searching around before I came across a number of those "what is x process" sites, but they really don't give much insight as to what might be causing the HDD reads. All they say is that 1. csrss.exe is a system critical process and 2. there is a trojan that disguises itself as csrss.exe. I built my system yesterday, installed Vista last night, and virus scans reveal nothing. Being new to Vista I wonder if everyone experiences this but just ignores it? I find it extremely annoying and it seems to be driving up my HDD temp (currently 44C after 120,000 I/O reads by csrss.exe).

[Brandon Live Veteran]

csrss.exe is the Win32 subsystem. It's strange to have lots of I/O coming from it, but I'm not really an expert on the behavior of that particular process. Do you have any command prompt windows open and doing anything?

What files is it accessing?

[Pon]

csrss.exe is the Win32 subsystem. It's strange to have lots of I/O coming from it, but I'm not really an expert on the behavior of that particular process. Do you have any command prompt windows open and doing anything?

What files is it accessing?

Thanks for the reply. I don't have anything unusual running in the background; without installing any programs (right after fresh install) and with no 3rd-party programs running I still see the I/O activity. When I'm logged in there are two instances of csrss.exe running and the one doing all the I/O reads has a session ID of 1 (meaning I guess that it's launched by the user). I created a new temp user just to check and still saw the constant I/O reads. I notice my HDD LED blinking constantly even if I just sit at the welcome screen without logging in.

So, according to Process Explorer csrss.exe is usually running with 9-10 threads. Currently I see several instances of winsrv.dll and csrsrv.dll and one cdd.dll. Usually two of the winsrv.dll threads have constantly fluctuating 6-8 digit "Cycles Delta" values, which I know nothing about.

I really, really need to figure this out because it's driving me nuts. I might have to go buy a XP x64 license if this is unresolvable.

EDIT: OK, so this is weird I think. In Process Explorer I double-clicked on the csrss.exe process to bring up its properties, and then clicked on the Performance Graph tab. The I/O Bytes graph looked random with spikes and troughs. But when I move my mouse around it shoots up to around a max of 12kb. When I stop moving my mouse it goes down to 0, though my HDD LED is always faintly flickering. So, the high I/O reads for csrss.exe seem to directly correlate with my mouse movements, but the constant HDD LED flickering is independent of that...?

Now, just concentrating on the mouse movements issue, I have a Logitech G5 mouse. It is the only USB device that I have connected. I installed the SetPoint drivers but this I/O read thing was happening even before I installed them (i.e., when it was using whatever default driver Vista installs for it). In the device manager I have no unrecognized devices and my mouse is recognized, but under the Human Interface Devices category I have two entries each for HID-compliant device and USB Human Interface Device. I have no idea what they're referring to, whether they're just extra entries for the mouse or what, but the only other input device I have is a keytronic keyboard and it's connected to the PS/2 port.

Edited July 29, 2008 by Pon

[soldier1st]

it could be superfetch but what security software do you have?cdd.dll is a Canonical Display Driver so what you may need to do is upgrade your display drivers to vista compatible ones.btw what is your video card?

Edited July 29, 2008 by soldier1st

[PermaSt0ne]

i'm on vista x64 ultimate with plenty of programs running and my computer has been on for the last 18 hours

when i look in task manager my csrss.exe has 0 I/O writes, but a ton of I/O reads and it goes up whenever i move my mouse. seeing as i also have a G5 mouse, i'd say it's normal. but my LED blinks every second whether i'm moving my mouse or not so i doubt that's causing it to blink

[Pon]

it could be superfetch but what security software do you have?cdd.dll is a Canonical Display Driver so what you may need to do is upgrade your display drivers to vista compatible ones.btw what is your video card?

I'm not running any security software, I have superfetch disabled, and I have a Radeon 4870 running the latest Catalyst 8.7 drivers (downloaded from amd.com and installed straight from the exe).

I checked another computer running XP 32-bit and when I move the mouse on it I get the same I/O reads by csrss.exe. So I guess that's a common Windows thing. However, that computer does not have the constant HDD LED flickering the way I do. I mean if every Vista user has constant HDD LED flickering then I suppose I can ignore it, but right now my worry is that it's indicative of something weird/problematic going on with the OS somewhere. I dunno, maybe it's a hardware issue? The LED doesn't flicker when I'm in the BIOS, maybe I'll try installing Linux at some point and see if it happens there.

[ShaneSparky_YYZ]

I have this running on XP SP3 too, but not causing any issues here.

[EduardValencia]

It could be superfetch and indexing procedures when the Vista installation is fresh,it willl calm down in a few days,give it more time,you'll be satisfied.

[Brandon Live Veteran]

I checked another computer running XP 32-bit and when I move the mouse on it I get the same I/O reads by csrss.exe. So I guess that's a common Windows thing.

The tool you're using might be reporting cached I/O, which isn't actually hitting the disk. It could be something as simple as reading the mouse cursor image from the resource.

However, that computer does not have the constant HDD LED flickering the way I do. I mean if every Vista user has constant HDD LED flickering then I suppose I can ignore it, but right now my worry is that it's indicative of something weird/problematic going on with the OS somewhere. I dunno, maybe it's a hardware issue? The LED doesn't flicker when I'm in the BIOS, maybe I'll try installing Linux at some point and see if it happens there.

Is it just the flickering light that is bothering you? Or do you feel that the disk activity is making your machine unresponsive or slower?

If you use Resource Monitor and sort by the processes with the most disk activity (sort by Read B/min or Write B/min), which ones are at the top?

[Pon]

Is it just the flickering light that is bothering you? Or do you feel that the disk activity is making your machine unresponsive or slower?

Well, it bothers me. I can't say that my machine feels slower since I have no comparison point as it's newly built and very fast in general. If the HDD LED is constantly blinking for no discernible reason then it suggests something I don't know about is accessing my disk (possibly a security concern), which also lessens the utility of having an LED to inform me of disk activity (kind of like someone constantly pulling a fire alarm when there's no fire).

If you use Resource Monitor and sort by the processes with the most disk activity (sort by Read B/min or Write B/min), which ones are at the top?

The list of processes in the disk activity area varies, sometimes it even empties, but when it's empty I still see the LED flickering. I watched the disk activity list for a few minutes with nothing open and sorting according to Read B/min and Write B/min, and the most common appearances were by System. System was writing to various files, often C:\Windows\System32\config, C:\$mft, c:\$bitmap and c:\$logfile. They were almost exclusively writes, not reads. But again, even when the Resource Monitor didn't show anything accessing the disk the HDD LED was still blinking. Incidentally, I disabled the Distributed Link Tracking Client service (which from the description sounded like it might be the culprit).

I installed Ubuntu 8.04 on a separate partition and when I wasn't doing anything explicit to cause disk access my HDD LED was appropriately dark (no flickering). So the cause, whatever it is, seems Windows specific.

[Brandon Live Veteran]

Well, beginning with Windows Vista we started deferring lots of I/O to idle time. This usually provides a better experience overall, as the system can be more responsive while you're using it and can queue up other tasks that require access to the disk until you're not busy.

If it is a brand new system, you'll likely see things settle down a bit after a few days. If you leave it idle for a little while, does the activity eventually stop? Or continue indefinitely?

[random_n]

Automatic disk defrag, automatic file indexing, automatic boot optimization, automatic prefetch optimization, and automatic restore point creation are all tasks that run by default in Vista and can do disk I/O without your asking. Most of them should settle down within the week, and all run at low disk I/O priority, but if it's persistent and annoying you then turn them off one by one until it stops.

Lots of them are useful, though, so evaluate your needs and decide what should stay on. Don't forget that if your performance is fine, but the blinkenlight still bothers you, electrical tape over the front or unplugging the light is always an option! :)

[Pon]

So far the blinking has been constant, regardless of how long I leave it idle (I disabled suspend, in part because the computer won't wake from suspend, it just starts and stops until I cut the power and reboot). I went through the services one by one and turned off indexing, superfetch, readyboost, system restore, etc. Still blinks. I don't intend on running it so barebones in general but right now I'm just trying to eliminate possibilities.

[franzon]

So far the blinking has been constant

try to uninstall your antivirus

[markwolfe Veteran]

try to uninstall your antivirus

Or try booting in safe mode. I think AV will not be started in that case, and will help isolate if this is some hardware or basic OS issue, or (more likely) something added after the fact.

[Pon]

I'm not running any antivirus, but I will try safe mode and see.

[Pon]

OK so I booted into safe mode and left it for 5 minutes and came back, and the LED was still blinking. No programs open, nothing running beyond what the OS loads. I checked Resource Monitor and it was the same as before: mostly just System doing the I/O accesses, but even when nothing was reported the LED was still blinking.

[markwolfe Veteran]

Well, it seems to not indicate anything abnormal, I would surmise.

You mentioned checking it out under Linux. I would not bother with an install for this, but if you want to boot something like Ubuntu or Knoppix as a Live CD, it might be of interest to see if the behavior is different.

But it certainly doesn't seem to mean there is abnormal activity.

[Pon]

Well, it seems to not indicate anything abnormal, I would surmise.

You mentioned checking it out under Linux. I would not bother with an install for this, but if you want to boot something like Ubuntu or Knoppix as a Live CD, it might be of interest to see if the behavior is different.

But it certainly doesn't seem to mean there is abnormal activity.

Actually I did install Ubuntu 8.04 on a separate partition just to check, wasn't much of a bother as it only took about 5 minutes installing off a USB stick (probably the easiest OS install ever even though ATI's proprietary drivers reverted me to basic display mode). Anyway, in Linux the HDD LED blinking stopped; it only lit up when I was doing something to cause a hard disk read/write.

[random_n]

Hmm... that *is* a bit bizarre. The only situation I've seen where a system keeps hitting the HDD even in safe mode where there wasn't 3rd party (and often malicious) software at play was a fringe case where the USN journal of an NTFS volume on a Windows 2000 domain controller had grown either stupidly large or corrupted itself (was rather hard to tell which).

Even Vista doesn't run anything automatically in safe mode... you could try a fresh install to another partition if you have any left. Check if the light is still blinking when booting that into safe mode with the new install. If not, add software and keep checking to find the culprit. If it's still blinking in a new install in safe mode, then check your mass storage controller drives. Failing that... I don't know! :wacko:

Also, you don't have to enter a key in Vista for a month, so don't worry about using up your activations while testing things. :yes:

[Pon]

I think I'm going to try installing XP Pro 32-bit when I get a chance and see what happens then. I've already formatted once and reinstalled Vista and it was the same thing. I even activated once because I thought maybe the culprit was some secret Vista activation polling service.

[moesidefx]

I know the last post on this thread was 18 months ago, but I'm having the exact same problem with Windows 7. I have 2 computers with Win7, and it only happens on 1 of them. Anyone have a clue?

[ilikepie]

I also am having the same problem on Windows 7 Ultimate 64-bit. Every 2 seconds or so, the HD activity light blinks- so evenly that I could use it to keep time. csrss.exe has easily the highest count of I/O Reads out of any process running and like Pon, whenever I move the mouse, the number jumps up- the more I move the mouse, the larger the increase. Also bizarre is the fact that I have two csrss.exe's running but when I check the file location of both, it points to the exact same file in the System 32 folder. In addition, the 2nd one does not increase when I move the mouse and as of now it's reads are 4,684 as compared to the almost 4,000,000 by the other one.

I don't think it's slowing down my computer in any way but I just don't want to put unnecessary stress on the HD and the blinking light is awfully annoying. I have avast! as my anti-virus and it finds nothing suspicious so I really don't have a clue. Anyone have any ideas?