Return to Question

I am currently on a Windows 7 x64 machine, using relatively high end GPU (GTX 970 4GB). Windows Aero is enabled.I am using process explorer to examine this case.

I have two csrss.exe processes running, both as SYSTEM, running under session 0 and 1 respectively. I have csrss.exe files, both in the correct directories. Using process explorer, I can see my gpu is being used only by CSRSS.EXE. the session 1 csrss.exe is using it. Closer examination of the processes threads reveals these .dll files.

Cdd.dll - the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.

Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer. So perhaps it's something in csrss.exe actually redirecting calls to cdd.dll. Confirmed further by going back to the first Wikipedia article: instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel. So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.

So dwm.exe, which I would have presumed would have been using the gpu is instead someway showing through csrss.exe.

So that at least explains the story partly. When idle at the desktop, gpu usage is > 0.01%. However, if I interact with certain ui elements of a program, for example hovering over the gpu graphs to bring up stock-like windows ui, or hovering over parts of Steams UI (Steamworks is a video game drm client) the gpu usage for csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over process explorer graphs, it can go to 15-20%.

I selected the csrss.exe process in question and pressed ctrl + h. I found threads related to procexp64.exe, steamwebhelper.exe (displays web api for steam.exe, which is also under this csrss.exe), explorer.exe, dwm.exe, and anything that seemed that would create windows/stock ui elements.

I tried safe mode and creating a new standard user account, but the same activity occurs.

My question is, is this activity normal? Csrss.exe seems to increase its cycle delta when moving the mouse, and when I hover over auch ui. Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing gun usage to rise under csrss.exe because that is the process calling cdd.dll? As I said, on idle gpu usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with aero enabled, but im wondering if this normal activity for a high end machine.

Should csrss.exe be using the gpu like this when calling on things Like cdd.dll and winsrv.dll?

I5 3570k

GTX 970 4GB

8GB RAM

I am currently on a Windows 7 x64 machine, using a relatively high end GPU (GTX 970 4 GB). Windows Aero is enabled. I am using Process Explorer to examine this case.

I have two csrss.exe processes running, both as SYSTEM, one under session 0 and one under session 1. I have csrss.exe files, both in the correct directories. Using Process Explorer, I can see my GPU is being used only by csrss.exe. The session 1 csrss.exe is using it. Closer examination of the process’s threads reveals these .dll files:

Cdd.dll – the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.

Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer.

So perhaps it's something in csrss.exe actually redirecting calls to cdd.dll. Confirmed further by going back to the first Wikipedia article: instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel. So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.

So dwm.exe, which I would have presumed would have been using the GPU, is instead someway showing through csrss.exe.

So that at least explains the story partly. When idle at the desktop, GPU usage is > 0.01%. However, if I interact with certain UI elements of a program, for example hovering over the GPU graphs to bring up stock-like windows UI, or hovering over parts of Steams UI (Steamworks is a video game drm client) the GPU usage for csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over Process Explorer graphs, it can go to 15-20%.

I selected the csrss.exe process in question and pressed Ctrl+H. I found threads related to procexp64.exe, steamwebhelper.exe (displays web API for steam.exe, which is also under this csrss.exe), explorer.exe, dwm.exe, and anything that seemed that would create windows/stock UI elements.

I tried Safe Mode and creating a new standard user account, but the same activity occurs.

My question is, is this activity normal? Csrss.exe seems to increase its cycle delta when moving the mouse, and when I hover over auch ui. Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing GPU usage to rise under csrss.exe because that is the process calling cdd.dll? As I said, on idle GPU usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with Aero enabled, but I’m wondering if this is normal activity for a high end machine.

Should csrss.exe be using the GPU like this when calling on things like cdd.dll and winsrv.dll?

Specs:

• I5 3570k
• GTX 970 4 GB
• 8 GB RAM
• Windows 7, 64-bit

This is a follow up question to conhost.exe and csrss.exe questions

I am currently on a Windows 7 x64 machine, using relatively high end GPU (GTX 970 4GB). Windows Aero is enabled.I am using process explorer to examine this case.

I have two csrss.exe processes running, both as SYSTEM, running under session 0 and 1 respectively. I have csrss.exe files, both in the correct directories. Using process explorer, I can see my gpu is being used only by CSRSS.EXE. the session 1 csrss.exe is using it. Closer examination of the processes threads reveals these .dll files.

Cdd.dll
Winsrv.dll
Csrsrv.dll

Cdd.dll - the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.

Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer. So perhaps it's something in csrss.exe actually redirecting calls to cdd.dll. Confirmed further by going back to the first Wikipedia article: instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel. So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.

So dwm.exe, which I would have presumed would have been using the gpu is instead someway showing through csrss.exe.

So that at least explains the story partly. When idle at the desktop, gpu usage is > 0.01%. However, if I interact with certain ui elements of a program, for example hovering over the gpu graphs to bring up stock-like windows ui, or hovering over parts of Steams UI (Steamworks is a video game drm client) the gpu usage for csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over process explorer graphs, it can go to 15-20%.

I selected the csrss.exe process in question and pressed ctrl + h. I found threads related to procexp64.exe, steamwebhelper.exe (displays web api for steam.exe, which is also under this csrss.exe), explorer.exe, dwm.exe, and anything that seemed that would create windows/stock ui elements.

I tried safe mode and creating a new standard user account, but the same activity occurs.

My question is, is this activity normal? Csrss.exe seems to increase its cycle delta when moving the mouse, and when I hover over auch ui. Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing gun usage to rise under csrss.exe because that is the process calling cdd.dll? As I said, on idle gpu usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with aero enabled, but im wondering if this normal activity for a high end machine.

Should csrss.exe be using the gpu like this when calling on things Like cdd.dll and winsrv.dll?

I5 3570k

GTX 970 4GB

8GB RAM

This is a follow up question to conhost.exe and csrss.exe questions

I am currently on a Windows 7 x64 machine, using relatively high end GPU (GTX 970 4GB). Windows Aero is enabled.I am using process explorer to examine this case.

I have two csrss.exe processes running, both as SYSTEM, running under session 0 and 1 respectively. I have csrss.exe files, both in the correct directories. Using process explorer, I can see my gpu is being used only by CSRSS.EXE. the session 1 csrss.exe is using it. Closer examination of the processes threads reveals these .dll files.

Cdd.dll
Winsrv.dll
Csrsrv.dll

Cdd.dll - the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.

Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer. So perhaps it's something in csrss.exe actually redirecting calls to cdd.dll. Confirmed further by going back to the first Wikipedia article: instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel. So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.

So dwm.exe, which I would have presumed would have been using the gpu is instead someway showing through csrss.exe.

So that at least explains the story partly. When idle at the desktop, gpu usage is > 0.01%. However, if I interact with certain ui elements of a program, for example hovering over the gpu graphs to bring up stock-like windows ui, or hovering over parts of Steams UI (Steamworks is a video game drm client) the gpu usage for csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over process explorer graphs, it can go to 15-20%.

I selected the csrss.exe process in question and pressed ctrl + h. I found threads related to procexp64.exe, steamwebhelper.exe (displays web api for steam.exe, which is also under this csrss.exe), explorer.exe, dwm.exe, and anything that seemed that would create windows/stock ui elements.

I tried safe mode and creating a new standard user account, but the same activity occurs.

My question is, is this activity normal? Csrss.exe seems to increase its cycle delta when moving the mouse, and when I hover over auch ui. Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing gun usage to rise under csrss.exe because that is the process calling cdd.dll? As I said, on idle gpu usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with aero enabled, but im wondering if this normal activity for a high end machine.

Should csrss.exe be using the gpu like this when calling on things Like cdd.dll and winsrv.dll?

I5 3570k

GTX 970 4GB

8GB RAM

This is a follow up question to conhost.exe and csrss.exe questions

I am currently on a Windows 7 x64 machine, using relatively high end GPU (GTX 970 4GB). Windows Aero is enabled.I am using process explorer to examine this case.

I have two csrss.exe processes running, both as SYSTEM, running under session 0 and 1 respectively. I have csrss.exe files, both in the correct directories. Using process explorer, I can see my gpu is being used only by CSRSS.EXE. the session 1 csrss.exe is using it. Closer examination of the processes threads reveals these .dll files.

Cdd.dll
Winsrv.dll
Csrsrv.dll

Cdd.dll - the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.

Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer. So perhaps it's something in csrss.exe actually redirecting calls to cdd.dll. Confirmed further by going back to the first Wikipedia article: instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel. So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.

So dwm.exe, which I would have presumed would have been using the gpu is instead someway showing through csrss.exe.

So that at least explains the story partly. When idle at the desktop, gpu usage is > 0.01%. However, if I interact with certain ui elements of a program, for example hovering over the gpu graphs to bring up stock-like windows ui, or hovering over parts of Steams UI (Steamworks is a video game drm client) the gpu usage for csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over process explorer graphs, it can go to 15-20%.

I selected the csrss.exe process in question and pressed ctrl + h. I found threads related to procexp64.exe, steamwebhelper.exe (displays web api for steam.exe, which is also under this csrss.exe), explorer.exe, dwm.exe, and anything that seemed that would create windows/stock ui elements.

My question is, is this activity normal? Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing gun usage to rise under csrss.exe because that is the process calling cdd.dll? As I said, on idle gpu usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with aero enabled, but im wondering if this normal activity for a high end machine.

I5 3570k

GTX 970 4GB

8GB RAM

This is a follow up question to conhost.exe and csrss.exe questions

I am currently on a Windows 7 x64 machine, using relatively high end GPU (GTX 970 4GB). Windows Aero is enabled.I am using process explorer to examine this case.

I have two csrss.exe processes running, both as SYSTEM, running under session 0 and 1 respectively. I have csrss.exe files, both in the correct directories. Using process explorer, I can see my gpu is being used only by CSRSS.EXE. the session 1 csrss.exe is using it. Closer examination of the processes threads reveals these .dll files.

Cdd.dll
Winsrv.dll
Csrsrv.dll

Cdd.dll - the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.

Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer. So perhaps it's something in csrss.exe actually redirecting calls to cdd.dll. Confirmed further by going back to the first Wikipedia article: instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel. So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.

So dwm.exe, which I would have presumed would have been using the gpu is instead someway showing through csrss.exe.

So that at least explains the story partly. When idle at the desktop, gpu usage is > 0.01%. However, if I interact with certain ui elements of a program, for example hovering over the gpu graphs to bring up stock-like windows ui, or hovering over parts of Steams UI (Steamworks is a video game drm client) the gpu usage for csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over process explorer graphs, it can go to 15-20%.

I selected the csrss.exe process in question and pressed ctrl + h. I found threads related to procexp64.exe, steamwebhelper.exe (displays web api for steam.exe, which is also under this csrss.exe), explorer.exe, dwm.exe, and anything that seemed that would create windows/stock ui elements.

I tried safe mode and creating a new standard user account, but the same activity occurs.

My question is, is this activity normal? Csrss.exe seems to increase its cycle delta when moving the mouse, and when I hover over auch ui. Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing gun usage to rise under csrss.exe because that is the process calling cdd.dll? As I said, on idle gpu usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with aero enabled, but im wondering if this normal activity for a high end machine.

Should csrss.exe be using the gpu like this when calling on things Like cdd.dll and winsrv.dll?

I5 3570k

GTX 970 4GB

8GB RAM