226

I have noticed that from some time my system is freezing and its probably caused by the high CPU usage which is caused by the system process.

All applications I'm running is the Skype, TeamSpeak and Chrome so it definitely shouldnt eat that amount of CPU.

You can see the problem itself and running processes in the screenshot below:

enter image description here

Sometimes CPU usage is reaching 90%, but the average usage is like 40-65%.

My PC parameters:

  • Windows 8 (customer preview)
  • Intel Core i3 - 2350M
  • 8 GB RAM

I'd appreciate any help attempt! Regards.

--UPDATE--

As the user below posted a great answer, I have noticed that the process that is eating the most CPU in the system is called Arthurx.sys, simple google tells that it's a TPLink driver (an wifi adapter, I have bought like 2 weeks ago!) drivers has been installed from the Windows MSDN, but also tried to install the drivers from the attached CD, but it doesn't help. From the system start, it is using like 5% of the CPU only, but after 2-4 hours of working it is growing up and reaching 40-60% of the CPU usage.

Device name: TPLink WN722N

2
  • 1
    use xperf to trace it. But as other users told you, stop using the CP. All pre-Release version will expire in 2 weeks! Jan 3, 2013 at 5:02
  • @Ramhound I have bought Windows 8 Pro via internet today and will upgrade my system within few minutes, I will keep this updated and will let you know if problem whether has been fixed or not.
    – Scott
    Jan 3, 2013 at 17:32

6 Answers 6

284

Introduction

High CPU usage by the "System" process can often be caused by a hardware driver issue (bug, old version, incompatility etc).

The System process loads (or hosts) multiple hardware drivers from different vendors that require higher level of memory access. This is why diagnosing the specific culprit can require a bit of detective work as described below.

Diagnosing the issue

To diagnose the CPU usage issues, you should use Event Tracing for Windows (ETW) to capture CPU Sampling data / Profile.

To capture the data, install the Windows Performance Toolkit, which is part of the Windows SDK.

The Windows 10 WPT can be used on Windows 8/Server 2012, Windows 8.1/Server 2012R2 and Windows 10/Server 2016. If you still use Windows 7, use the SDK/WPT with Build 15086.

enter image description here (all other entries can be unselected)

Now run WPRUI.exe, select First Level, under Resource select CPU usage and click on start.

enter image description here

Now capture 1 minute of the CPU usage. After 1 minute, click on Save.

Now analyze the generated ETL file with the Windows Performance Analyzer by dragging and dropping the CPU Usage (sampled) graph to the analysis pane and ordering the columns like you see in the picture:

enter image description here

Inside WPA, load the debug symbols and expand Stack of the SYSTEM process. In this demo, the CPU usage comes from the nVIDIA driver.


In the following demo, the CPU usage comes from the Realtek NIC driver:

enter image description here


When you see calls like ntoskrnl.exe!ViKeTrimWorkerThreadRoutine, ntoskrnl.exe!MmVerifierTrimMemory, ntoskrnl.exe!VerifierKeLeaveCriticalRegion, this means you have Driver Verifier enabled. This also hurts performance a lot and causes high SYSTEM usage. Disable Driver Verifier and reboot.

enter image description here


In this demo, the driver iai2ce.sys (Intel Serial IO GPIO Controller driver) causes it:

enter image description here


In this example, the CPU usage comes from the file rtsuvc.sys which seems to be the Realtek UVC webcam Driver

enter image description here


This demo shows that Bitdefender driver ignis.sys

enter image description here


In the following example, the CPU usage is casued by the broadcom network driver bcmwl664.sys

enter image description here


When you see ntoskrnl.exe!MiZeroWorkerPages as cause, it is trickier. This means the function of the kernel which zeros the memory before it can be used again causes the high CPU usage:

enter image description here

There is no real way to detect which process causes it, but I know that Chrome can cause it if you have hardware acceleration enabled in Chrome. So if you see this and use Chrome, turn hardware acceleration in Chrome off.


When you see those ntoskrnl.exe!RtlpGenericRandomPatternWorker, ntoskrnl.exe!RtlpTestMemoryRandomUp calls

enter image description here

the CPU usage comes from the Kernel to test memory for issues (memtest). This usage is triggered via the idle maintenance task of Windows 8.1/10. You can use Task Scheduler to disable the idle task.

enter image description here

In Windows 10, the task is called RunFullMemoryDiagnostics under Microsoft > Windows > MemoryDiagnostic > RunFullMemoryDiagnostic.

enter image description here


In this case, the CPU usage seems to come from the Data Deduplication Feature (dedup.sys!DdpPostCreate) of Windows Server:

enter image description here


In this demo, the CPU usage is caused by the WIFI card driver athrx.sys

enter image description here

Search for a driver update if you see this.


In the following demo, a citrix driver is involved:

enter image description here

So contact your IT for how to solve Citrix issues.


In this demo, the function usbhub.sys!UsbhPortRecycle causes the CPU usage:

enter image description here

Changing USB2.0 ports to 1.1 speed or connecting USB drives to other USB 2.0 ports helped for some users.


In this case, a small amount of SYSTEM usage comes from the Acronis driver tdrpm251.sys:

enter image description here


In this demo, the CPU usage ntoskrnl.exe!KeAcquireSpinLockRaiseToDpc and ntoskrnl.exe!KeReleaseSpinLock.

enter image description here

so a driver is using SpinLocks very heavily. Disable some devices/drivers until you see one which causes it.


In this case, the CPU usage is caused by the driver L1C62x64.sys

enter image description here

This is the qualcomm atheros AR8171/8175 PCI-E gigabit Ethernet driver. So update the driver if you see it in the stack.


Here, the CPU usage comes from scanning the host file (netbt.sys!DelayedScanLmHostFile)

enter image description here

make sure your hosts file is not too large to avoid this usage.


In this case, the CPU usage comes from SRTSP64.SYS from symantec.

enter image description here

Update your used symantec product to the latest version.


Here, the CPU usage comes from the AMD GPU driver (atikmdag.sys)

enter image description here

if you see this, go to AMD site and get the latest driver for your AMD card.


Here, the drivers TMXPFlt.sys and VsapiNt.sys cause the high CPU usage.

enter image description here

From what I see, those files are part of Trend Micro AV suite. Update the tool or remove it.


In this example, the CPU usage comes from the function ntoskrnl.exe!MmGetPageFileInformation

enter image description here

This function gets information about the pagefile.

Routine Description: This routine returns information about the currently active paging files.

Disable the pagefile, reboot and enable it again and see if this fixes it. Also, removing Intel services (e.g Intel Content Protection HECI Service) seems to fixed it for a user.


Here, you can see that the driver Netwtw04.sys (Intel Wifi driver) calls the function flushCompleteAllPendingFlushRequests and this causes a high CPU usage.

enter image description here

Because the debug symbols get loaded the Windows inbox driver is used. Only here we can get debug symbols to see the callstack with the function name flushCompleteAllPendingFlushRequests.

Here, you should install the latest driver from Intel to fix it.


The most complicated case of SYSTEM usage is ACPI.sys usage in the callstack:

Line #, DPC/ISR, Module, Stack, Count, Process, Weight (in view) (ms), TimeStamp (s), % Weight
6, , ,   |    |- ACPI.sys!ACPIWorkerThread, 40246, , 39.992,941063, , 4,13
7, , ,   |    |    ACPI.sys!RestartCtxtPassive, 40246, , 39.992,941063, , 4,13
8, , ,   |    |    ACPI.sys!InsertReadyQueue, 40246, , 39.992,941063, , 4,13
9, , ,   |    |    ACPI.sys!RunContext, 40246, , 39.992,941063, , 4,13
10, , ,   |    |    ntoskrnl.exe!KeReleaseSpinLock, 40246, , 39.992,941063, , 4,13
11, , ,   |    |    ntoskrnl.exe!KiDpcInterrupt, 40246, , 39.992,941063, , 4,13
12, , ,   |    |    ntoskrnl.exe!KiDispatchInterruptContinue, 40246, , 39.992,941063, , 4,13
13, , ,   |    |    ntoskrnl.exe!KxRetireDpcList, 40246, , 39.992,941063, , 4,13
14, , ,   |    |    ntoskrnl.exe!KiRetireDpcList, 40246, , 39.992,941063, , 4,13
15, , ,   |    |    |- ntoskrnl.exe!KiExecuteAllDpcs, 40198, , 39.945,173325, , 4,13
16, , ,   |    |    |    |- ACPI.sys!ACPIInterruptDispatchEventDpc, 27565, , 27.408,930428, , 2,83
17, , ,   |    |    |    |    |- ACPI.sys!ACPIGpeEnableDisableEvents, 24525, , 24.384,921620, , 2,52
18, , ,   |    |    |    |    |    ACPI.sys!ACPIWriteGpeEnableRegister, 24525, , 24.384,921620, , 2,52
19, , ,   |    |    |    |    |    |- hal.dll!HalpAcpiPmRegisterWrite, 24421, , 24.281,015516, , 2,51
20, , ,   |    |    |    |    |    |    |- hal.dll!HalpAcpiPmRegisterWritePort, 24166, , 24.027,316013, , 2,48

this is extremely difficult to debug. In a sysinternals topic, I listed some advice:

  • make sure the CPU doesn't overheat because of dust in the CPU fan
  • update or re-flash the (same) BIOS/UEFI
  • load default BIOS/UEFI settings
  • make sure the battery is not damaged, remove the battery from the notebook or disable the battery in device manager.
  • change jumper on HDD caddy if you have replaced the DVD/Blue-Ray Drive with a Caddy to install an SSD next to your old HDD

enter image description here


In the following demo, the Intel HD driver igdkmd64.sys in version .4574 for the Intel HD 630 causes the issue:

enter image description here

The solution is to update to driver with version of at least .4590.


In the following case, the CPU usage of the SYSTEM process is caused by the driver stdriverx64.sys

enter image description here

This seems to be an audio streaming driver. So update this software/driver if you see this in WPA.


If you see a driver called risdxc64.sys in callstack of SYSTEM that causes the high CPU usage, update the Ricoh PCIe SDXC/MMC Host Controller driver or disable the SD card reader in device manager if no driver update fixes it.

enter image description here

This SD card reader seems to be built-in to many Lenovo devices.


The user @stevemidgley showed a new issue of higher CPU usage with Wdf01000.sys!FxSystemWorkItem::_WorkItemThunk

enter image description here

Here you can see a driver UDE.sys causing it.

In symbol hub

enter image description here

I can see it belongs to Modem driver and PNP data of the trace shows Fibocom L850-GL (LTE Modem) as possible device:

enter image description here

And the solution is to disable the modem and USB composite device in device manager.


The user @fajar provided the following case:

enter image description here

Here the cpu usage is small, but if you change the view to DPC/ISR usage

enter image description here

you can see that the avgNetHub.sys driver causes a lof of DPC usage

enter image description here

The name indicates that this driver is part of AVG anti virus software. So update the software or remove it if you see this in your trace.


7
  • Is the full SDK needed? Or is it possible to install just the WPT and uncheck everything else? I have some problem running the SDK installed. I already have VS 2019 and a Windows SDK version 2004 (10.0.19041.0) installed, but the installation doesn't include WPT. I downloaded the SDK installer (same version), but when I run it, there's a spash screen for a second, which then disappears and nothing happens. In the end I downloaded the SDK .iso version, mounted it, and manually installed Installers\WPTx64-x86_en-us.msi Jan 16, 2023 at 10:15
  • @GenePavlovsky if you already have SDK installed via VS, open control panel->installed program, select the SDK and select "change/repair" and select the WPT. Jan 16, 2023 at 13:25
  • @magicandre1981 Thanks, I managed to install it already, but meanwhile the System CPU usage that I wanted to investigate disappeared... Jan 17, 2023 at 14:20
  • @GenePavlovsky does it happen when the device is idle? I also covered this in the topic, here the idle maintenance task kicks up and scans the installed programs, tests RAM and other things. Jan 17, 2023 at 18:49
  • @magicandre1981 Yes it was idle. I just replaced my thinkpad x230 stock i7-3520m motherboard with another one from AliExpress featuring a quad-core i7-3612qe CPU, and this happened. So I was wondering if it has something to do with the new hardware. It didn't happen again so who knows, maybe it was just coincidence and it was indeed that maintenance task you mentioned. Jan 18, 2023 at 20:11
121

This can be caused by a faulty driver or other module loaded by the system. To look inside the System process, you can use a tool like Process Explorer.

Download and run it, then select the System process, right-click and select Properties:

enter image description here

Switch to the Threads tab (ignore the dialog box that mentions symbols):

enter image description here

This will show which file is using the excessive CPU usage, from which you can then attempt to diagnose it.

As others have said in the comments however, you really do need to move away from the Preview versions as soon as possible!

6
  • 2
    @Scott I noticed that you're upgrading now; if this issue is still not resolved after that, TPLink have a beta Windows 8 driver on their site available which may help. It can be found here: tp-link.com/en/support/download/… Jan 3, 2013 at 18:00
  • 2
    It seems risdxc64.sys is a usual suspect with Thinkpad laptops which is the driver for the card reader, see e.g. here: forums.lenovo.com/t5/ThinkPad-X-Series-Laptops/… - I solved it by reinstalling the latest one on win 10
    – Patrick
    Aug 7, 2015 at 10:29
  • I had a similar problem in Windows 10. For me it was avc3.sys that was using a lot of cpu. Turns out to be a part of Bitdefender Antivirus Free.
    – Bruno
    Oct 21, 2015 at 13:53
  • 2
    @Legends you used the wrong tool. ProcExp shows a shapshot which is not that helpful. I wrote an answer about Windows Performance Toolkit to show it in detail how to analyze cpu usage Sep 11, 2018 at 14:39
  • great.. this tip works with process hacker as well... seems mine is aswbidsdriver.sys.. I guess you get what you pay for... Avast Free is eating a constant 5-6% of i7-8750H CPU! unacceptable
    – Mikey
    May 13, 2019 at 18:08
5

A note on loading debugging symbols to add to magicandre1981's excellent answer: if loading the symbols in Windows Performance Analyzer works correctly, after ticking Trace > Load Symbols you should see a progress bar on the top with Loading symbols which shows file names beside it and takes several minutes to complete. Also you should see many lines like the below in the Diagnostic Console:

SYMSRV:  File: Accessibility.ni.pdb

SYMSRV:  Notifies the client application that a proxy has been detected.
SYMSRV:  Connecting to the Server: http://msdl.microsoft.com/download/symbols.
SYMSRV:  Successfully connected to the Server.
SYMSRV:  Sending the information request to the server.
SYMSRV:  Successfully sent the information request to the server.
SYMSRV:  Waiting for the server to respond to a request.
SYMSRV:  Successfully received a response from the server.
SYMSRV:  Closing the connection to the Server.
SYMSRV:  Successfully closed the connection to the Server.
SYMSRV:  Get File Path: /download/symbols/Accessibility.ni.pdb/7B46178957827CDAB7EE4C86EDEE1DAE1/Accessibility.ni.pdb

If you don't see either of these, loading debug symbols likely hasn't worked and you won't be able to properly interpret your trace.

In my case initially loading debug symbols didn't work. I fixed it by following these instructions:

  1. Figure out if you are using the x86 or x64 version of the Windows Performance Toolkit.

    This is easy on x86 builds of Windows. On x64 builds, you can check the Task Manager for the *32 tag. If it’s not there, then you’re running the x64 version.

    Note that WPT always installs to Program Files (x86) regardless of architecture.

  2. Copy the dbghelp.dll and symsrv.dll files from the correct debugger directory to the Windows Performance Toolkit directory. On my system, the relevant directories are:

    C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 and C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit

  3. Restart Windows Performance Analyzer so that the correct version of dbghelp.dll is picked up.

2
  • 7
    you should add this to my answer as an edit. this is not a real answer Jul 13, 2017 at 19:04
  • Edits are usually rejected if they don't match author's intent. I think this is ok as a partial answer and no idea why it's reported.
    – Destroy666
    Feb 16 at 16:04
3

My problem was that the CPU usage was ridiculously high when downloading anything (up to 4 GHz). I have a predator Helios 300 with a Killer WiFi card, so the Killer driver was pre-installed. I used Process Explorer to go into System's properties → Threads tab and found out that "kfeco10x64.sys" was causing the high CPU usage. Since "kfeco10x64.sys" was part of the killer network service, I disabled it by running msconfig and unchecking every service from "Rivet Networks".

After a restart, the problem went away for me. Most importantly, there doesn't seem to be any speed reduction when downloading. I hope this helps anybody who faces the same problem.

0

Answer added by @magicandre1981 is the key to solve any problem. My case wasn't listed there, but I found a similar word in stack described under The most complicated case of SYSTEM usage is ACPI.sys usage in the callstack: section. In my case installing Intel Rapid Storage driver was helped. I didn't expect this as far as all were working for a lot of time without this driver and without any CPU issues. I put my stack here, probably somebody will found this answer by similar keywords.

Line #, Process, Stack, Count, Weight (in view) (ms), TimeStamp (s), % Weight
3, , [Root], 45104, 45,300.439000, , 16.21
4, ,   ntoskrnl.exe!KiStartSystemThread, 45104, 45,300.439000, , 16.21
5, ,   ntoskrnl.exe!PspSystemThreadStartup, 45104, 45,300.439000, , 16.21
6, ,   |- ntoskrnl.exe!SMKM_STORE_MGR<SM_TRAITS>::SmCompressCtxWorkerThread, 38830, 38,997.540000, , 13.95
7, ,   |    |- ntoskrnl.exe!SMKM_STORE_MGR<SM_TRAITS>::SmCompressCtxProcessEntry, 38708, 38,874.943400, , 13.91
8, ,   |    |    |- ntoskrnl.exe!memcpy, 33888, 34,032.390100, , 12.18
9, ,   |    |    |    |- ntoskrnl.exe!memcpy<itself>, 33655, 33,795.069100, , 12.09
10, ,   |    |    |    |- ntoskrnl.exe!KiDpcInterrupt, 228, 232.331300, , 0.08
11, ,   |    |    |    |- ntoskrnl.exe!KiInterruptDispatchNoLockNoEtw, 4, 3.989700, , 0.00
12, ,   |    |    |    |- ntoskrnl.exe!KiInterruptDispatch, 1, 1.000000, , 0.00
13, ,   |    |    |- ntoskrnl.exe!RtlCompressBuffer, 2571, 2,585.541600, , 0.93
14, ,   |    |    |- ntoskrnl.exe!SMKM_STORE_MGR<SM_TRAITS>::SmCompressCtxProcessReadyQueue, 2015, 2,022.554900, , 0.72
15, ,   |    |    |- ntoskrnl.exe!MmBuildMdlForNonPagedPool, 129, 129.294600, , 0.05
16, ,   |    |    |- ntoskrnl.exe!SMKM_STORE_MGR<SM_TRAITS>::SmCompressCtxProcessEntry<itself>, 63, 62.901700, , 0.02
17, ,   |    |    |- ntoskrnl.exe!ExAcquireSpinLockExclusive, 31, 31.208200, , 0.01
18, ,   |    |    |- ntoskrnl.exe!MetroHash64::Hash, 10, 10.033100, , 0.00
19, ,   |    |    |- ntoskrnl.exe!KiDpcInterrupt, 1, 1.019200, , 0.00
20, ,   |    |- ntoskrnl.exe!SMKM_STORE_MGR<SM_TRAITS>::SmCompressCtxWorkerThread<itself>, 78, 78.477100, , 0.03
21, ,   |    |- ntoskrnl.exe!ExAcquireSpinLockExclusive, 39, 39.068100, , 0.01
22, ,   |    |- ntoskrnl.exe!KeWaitForSingleObject, 5, 5.051400, , 0.00
23, ,   |- ntoskrnl.exe!SMKM_STORE<SM_TRAITS>::SmStWorkerThread, 5420, 5,445.923200, , 1.95
24, ,   |- ntoskrnl.exe!SmKmStoreHelperWorker, 495, 496.265200, , 0.18
25, ,   |- ntoskrnl.exe!SMKM_STORE<SM_TRAITS>::SmStReadThread, 359, 360.710600, , 0.13
26, , n/a, 16760, 16,773.871200, , 6.00

Update: Unfortunately issue came back. After restart PC works fine some time but then same CPU leak appear with the same stack

4
-3

First, the review and information supplied is very informative, however you can usually figure this out with much less intelligence! I simply used MSCOFIG.EXE and a binary search to isolate the offending service. I have found most problems like this are caused by Intel software. I start by disabling any service that does not have a company name. Then I start on Intel services. Then the full binary search. Usually takes an hour at most to fix the problem in someone's PC. Intel was never a good computer company, and their software demonstrates it. Let's face it the Pentium architecture was a decade old when it was released. Who would have built a computer architecture with paged memory in the days of VAX? Well, I won't bore you with the history. Not that I am fan of AMD or Microsoft either. Perhaps someday we'll get back to building real computers again.

1
  • You do realize that the VAX uses paged memory, right? And why wouldn't you use paged memory today? Sep 21, 2018 at 7:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .