Bdtyktl

This is a follow up question to conhost.exe and csrss.exe questions

I am currently on a Windows 7 x64 machine, using a relatively high end GPU (GTX 970 4 GB). Windows Aero is enabled. I am using Process Explorer to examine this case.

I have two csrss.exe processes running, both as SYSTEM, one under session 0 and one under session 1. I have csrss.exe files, both in the correct directories. Using Process Explorer, I can see my GPU is being used only by csrss.exe. The session 1 csrss.exe is using it. Closer examination of the process’s threads reveals these .dll files:

Cdd.dll

Winsrv.dll

Csrsrv.dll

Cdd.dll – the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.

Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer.

So perhaps it's something in csrss.exe actually redirecting calls to cdd.dll. Confirmed further by going back to the first Wikipedia article:
instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel.
So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.

So dwm.exe, which I would have presumed would have been using the GPU, is instead someway showing through csrss.exe.

So that at least explains the story partly. When idle at the desktop, GPU usage is > 0.01%. However, if I interact with certain UI elements of a program, for example hovering over the GPU graphs to bring up stock-like windows UI, or hovering over parts of Steams UI (Steamworks is a video game drm client) the GPU usage for csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over Process Explorer graphs, it can go to 15-20%.

I selected the csrss.exe process in question and pressed Ctrl+H. I found threads related to procexp64.exe, steamwebhelper.exe (displays web API for steam.exe, which is also under this csrss.exe), explorer.exe, dwm.exe, and anything that seemed that would create windows/stock UI elements.

I tried Safe Mode and creating a new standard user account, but the same activity occurs.

My question is, is this activity normal? Csrss.exe seems to increase its cycle delta when moving the mouse, and when I hover over auch ui. Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing GPU usage to rise under csrss.exe because that is the process calling cdd.dll? As I said, on idle GPU usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with Aero enabled, but I’m wondering if this is normal activity for a high end machine.

Should csrss.exe be using the GPU like this when calling on things
like cdd.dll and winsrv.dll?

Specs:

• I5 3570k


• GTX 970 4 GB


• 8 GB RAM


• Windows 7, 64-bit

I was just having the same issue. I was going to terminate csrss.exe, but then noticed one thing in Task Manager. The Video Encoder part of the GPU was in use.

So the problem was that my AMD Radeon Crimson ReLive was doing this thing called 'Instant Replay' in which the gameplay of last few minutes is continuously captured.
Even though I had disabled 'Record Desktop' in settings, it was still recording. So this was just a bug which was using GPU.

TL;DR:
Disable Instant Replay. How to disable it? It depends on what recording/streaming software does your PC has. Just Google it.

Note:
If disabling Instant Replay does not solve the issue, or it is already OFF or you don't have streaming software, your PC might be infected by a virus or something.