Big PROBLEM_ Process CSRSS.exe_ CPU Usage too High

Hi, i am suddenly having a big problem with my computer Performance.  When I open the Task Manager, The CPU Usage is on 30 % and going a little bit up, a little bit lower...

I checked the Processes runing,:
- the Sysem Idle Process is around 70 on the "CPU" column (Which normally is on 99 for me)
- CSRSS.exe  is using 16 on the "CPU coloumn" and also going a little up and down
- spoolsv.exe  is using around 10 and also going a little up and down
- there are a few others that suddenly change from 0 to 1 (one) like, nvsvc32.exe , lsass.exe, ...

And the PFUsage is around 483 MB (stays there)

I dont have any program running. But there are a few things that lunch when the computers starts, they appear at the left of the Time (Windows lower right corner..)  These thhings that lunch on startup are Mcafee Antivirus, In CD. and Updates Icons for Dell support 2, Windows updates, Java updates...

I am using a Laptop Dell XPS M1710: Intel Core 2 Duo 2.16Ghz, 2 gig Ram, Windows Xp Pro SP2, 7200rpm-80 Gig Harddrive (i have 7.25 Gb free space).

I think that is it. I am in a real emergency, I work on 3d (3dsmax and photoshop) and i have to send a work on thursday, and i am not able to render big 3d images because my system resources are with this problem...  I will appreciate it a lot if someone can give me a hand, as soon as possible.  

(I dont want to instal Windows and my software again because i have no time, i am on a deadline for my work)

Who is Participating?
r-kConnect With a Mentor Commented:
That is wonderful news. Sorry I was gone for so long, but I am delighted that you managed to get it fixed in the meantime. Great job!

I should explain why I mentioned possible video problems. There were actually three hints:

(1) Your earlier crash with code c0000006 is normally due to memory or disk corruption. Memory corruption is often caused by video driver or card problems.

(2) Since you mentioned that the system was stable in safe mode, this further implicated the video. At this point I was thinking less likely memory or disk problems, because they would be the same in safe mode or not, In safe mode Windows uses the generic vga driver, so this suggested the video driver.

(3) The Process Explorer image capture shows process nvsvc32.exe using over 12% of cpu time. This is abnormally high. nvsvc32.exe is part of the nVidia driver, further implicating that.

The errors in your System Logs are of the type caused by bad data in memory, again could be bad disk, bad ram, or bad video. I am very glad to hear you've solved the problem by reinstalling the video driver.

The fact it is running well since then implies the hardware is OK. However, it doesn't prove it. If possible check if the Dell diagnostics CD that came with your system has a diagnostic for the video card. They normally do. You can also download and burn that CD from the Dell support site for your specific model and try that way.

Re. the shutdown being slow, try installing SP3 for XP. Sometimes these nagging problems get fixed that way. Before that, log in as a different username and see if "saving settings" still takes long. Create a temp new username if you have to. If it is faster for the new user then the problem is something in your user profile. Also see this link:;en-us;308029

Good luck :)

r-kConnect With a Mentor Commented:
As a quick first step, disable your AV program and see if the CPU usage goes down. The suggestion to post your HJT log is also a good one.

This could be due to a number of reasons. Among them:

(1) Hardware malfunction
(2) Malware or rootkit
(3) Corrupted user profile
(4) Misbehaving AV or other service or driver.

I would suggest the following:
(a) log-in as a different user - does the problem persist, if so then rule out  option (3) above.
(b) Disable any AV program or anything else unnecessary and see if that helps.
(c) Run Process Explorer from 
    It shows a lot more detail then Task Manager. In particular, if it shows CPU
    time being used by "Interrupts" then there might be a hardware problem.
(d) Scan your system for malware. At the very least, run the following two programs:
 (d.1) RootkitRevealer from:
 (d.2) Run HJT as suggested above.
Improved Protection from Phishing Attacks

WatchGuard DNSWatch reduces malware infections by detecting and blocking malicious DNS requests, improving your ability to protect employees from phishing attacks. Learn more about our newest service included in Total Security Suite today!

unrinoceronteAuthor Commented:
Hi guys, thanks for your suggestions, i will try them right now.

Please, excuse me for the next dumb questions ..., so i can keep going with the Solutions:

1-How do I paste here the Hijackthis?  just copy paste?
2-How do i paste or attach some image file? a print screen so you can see?  
3- Regarding r-k suggestion on a)  Log in as different user... I only have one user account. Will i need to create a new one right now? or if the problem is a corrupted user profile and i create a new one it will also be corrupted?

- There are 2 options here that say "Attach Code Snippet" which i have no idea what it is, and "attach File" i am guessing here is where i can attach my Printscreen image?? (Sorry this is my second week on Experts Exchange..)
unrinoceronteAuthor Commented:
I also have 2 photos of a problem that happened to me some days ago (blue screen...), perhaps that is when everything started, but i am not sure..  Just let me know how do i attach them...  
1. Yes, you can copy-and-paste for the HJT log, because it is just all text.

2. Capture the screen, paste it into some image editing program (like Paint), then save it as a jpg or bmp. Then you can use the "attach file" option to attach the image file.

3. Yes, you can create a new username (name it Test e.g.) just for testing as I suggested. You can alsways delete that new user later.

"Attach code snippet" is basically for attaching text, so that's another way to attach your HJT log.

Or save the HijackThis log to a text file and upload it using the "Attach File" option.
unrinoceronteAuthor Commented:
Hi again, i have tried everything you suggested, i still have the problem but i will answer according to your suggestions:

(a) log-in as a different user:
_ The problem persists in other Guest account or administrator account.  However if I restart my computer on SAFE MODE, the CPU Usage and Processes look normal.

(b) Disable any AV program or anything else unnecessary and see if that helps:
_I did it and does not solve the problem

(c) Run Process Explorer... if it shows CPU  time being used by "Interrupts" then there might be a hardware problem:
_I am attaching a Print Screen with Process Explorer.  However how do i know if the CPU Time is being used by interrupts??.... Is it on the first column wher it contains a line called INTERRUPTS, and under the 3rd column "CPU", variable numbers appear, changing form  0.76 to 1.52  , or 2.27, etc...

(d) Scan your system for malware.
 (d.1) RootkitRevealer
 (d.2) Run HJT
_ I did this and i am attaching 2 txt files for both.

I also runned a little program called CCLEANER v1.39.502, and under the ISSUES Tab, under REGISTRY INTEGRITY, a lot of things appeared, mostly " missing Shared DLL" and other stuff... I don't know if these is helpful but i am attaching also a Print screen for CCLEANER (i don't know how to save a Txt file from this...

- Again, the processes that are going a little crazy with CPU Usage are:
 csrss.exe, nvsvc32.exe , spoolsv.exe , and just a little: svchost.exe

- In My computer specs i forgot to mention my video card:  Geforce 7900 GS

- I have been worknig on HEAVY (ram) 3d projects, which sometimes go above the 2 Gb PF USAGE

- To be able to work this projects without crashes i did a XP tweak, called the 3GB Switch, for those who are not familiar here is the link:

I Have been using the 3gb switch without a problem for a year now... but i mention this just in case you think that working with Heavy Projects might have caused the problem....

Something did not work when you tried to attach the files. Can you try that again, thanks.
unrinoceronteAuthor Commented:

Please read the previous comment. Here are the attached files for everything you asked for and more..

Please take note that the Two Photos from my monitor that i attached might have no relation to the problem, i just put them "just in case..." That blue screen happened 2 weeks ago when my computer crashed while working on a 3d project..
Your HijackThis log seems clean. Maybe it's a hardware problem. Did you check your event viewer for any related errors?
unrinoceronteAuthor Commented:
How do i check EVENT VIEWER??   sorry i am a newbie in this area...!
orangutangConnect With a Mentor Commented:
Run eventvwr.msc, click the "System" section, check for items with a red circle and a white X, double-click them and check their descriptions.
unrinoceronteAuthor Commented:
Ok, i found out how to use the Event Viewer,  thanks also orangutang for this. There are TONS of ERRORS!! both in "Application" and on "SYSTEM" , but more on SYSTEM.

Will it be useful if I attach here the Event Viewer List for you to check it out??   There is an option that says Expor List, and i can save as an TXT...

Any comment on my other attachments in Previous comments?  Process Explorer, RootkitRevealer, Ccleaner???
No, just tell us the most common errors in the "System" section that you think might be related to your problem.
unrinoceronteAuthor Commented:
Ok, This are the most common errors, but i dont have any idea what they mean.:

a) Source: EVENTLOG _ A driver packet received from the I/O subsystem was invalid.  The data is the packet.

b) Source: SR _ The System Restore filter encountered the unexpected error '0xC000009A' while processing the file 'change.log' on the volume 'HarddiskVolume2'.  It has stopped monitoring the volume.

c) Source: SIDEbySIDE (THERE are over 200 consecutive Errors from this in each of the following dates: June 5, June 6 and June 10!!!)   There are mostly 3 kinds of error messages saying this:

- Generate Activation Context failed for C:\WINDOWS\system32\SHELL32.dll. Reference error message: The operation completed successfully.

But each error varies on the name of the .DLL

- Resolve Partial Assembly failed for Microsoft.Windows.Common-Controls. Reference error message: Insufficient system resources exist to complete the requested service.

-Syntax error in manifest or policy file "C:\WINDOWS\WinSxS\Policies\x86_Policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.2982.Policy" on line 0.

also from SidebySide:

-Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Multiprocessor Free

There are also a lot of WARNINGS on a Yellow triangle...

Ok , hope this gives a hint on my problem...

The RootkitRevealer log is clean. I think we can rule out malware.

Based on what you sent so far, I am starting to suspect a problem with the video card or driver, or possibly the hard drive.

Can you do a screen capture of the Event Viewer sections that show many errors and post it here.

Our messages crossed. Are the above errors from the System log, or the Application log? Can you also mention the error numbers.
Can you post some of the errors from the System log, along with event ID numbers. Thanks.
unrinoceronteAuthor Commented:
Here are the EVENT Viewer Screen Captures on a Zip file. I took a lot of them, but since there are many errors by the Source Sidebyside, i did not capture them all...

And how about a problem with the RAM memory? is it possible... i am just guessing, since what i have been doing all these days is work on heavy 3D projects..

Just a tought regarding the Hardrive: i mostly save and use  files from an external Harddrive for my work, I do not save many things on the local HD... Since my laptop has a small HD (80 gigs)  And also i dont move my laptop because is a 17 inch, only on rare occations for a meeting...
unrinoceronteAuthor Commented:
R-K, the above errors are from the System Log.  

In the Screen captures above appers the Event ID number, is this what you are asking me for?  hope it is, if not let me know and i do it.
Yes, the screen captures should be useful. I have to run but will be checking a bit later.
Thanks for the additional info.
unrinoceronteAuthor Commented:
Thanks to you guys! i will be patiently waiting for your responses.

thanks really.

unrinoceronteAuthor Commented:
Well, during this time it seems that I have managed to solve my problem!!!

The process that was causing all the trouble was  NVSVC32.EXE , after reading what R-K said about it probably being a VIDEO Card or Driver problem, i checked on the internet what this Nvsvc32.exe process did, so I Ended the process in Task Manager, and inmediately all my problems Dissapeared!

The other processes that where going crazy on CPU usage stopped doing that.   So i decided to go into SAFE MODE and Uninstalled NVIDIA Video DRIVERS from Control Panel, Remove Programs.

Then I restarted normally and the computer detected the Geforce Video Card and installed itself again.
Since that, the problems have dissapeared.  I restarted the computer several times, and used the software i normally use (3dmax and photoshop) and is running smoothly!

Just in case,after this, i decided to UPDATE my Nvidia Video Driver, so I went to DELL webpage (my laptop is a Dell XPS M1710) and downloaded the driver from their Support page.

I installed it and everything is still Perfect.

I will keep monitoring this for a couple of days more to just in case the problem reappears somehow.

I would like to thank you all, and specially R-K for giving me a hint on what it was, and for all his usefull information. I truly learned a lot. Those programs that you suggested are wonderful and they will be very handy for the future.

Also Thanks to Orangutang for telling me about EVENT VIEWER, now i think i know how to use it, and will be definetely using it a lot in the future. Thanks for your time with the Hijackthis also. I would love to know how to be able to read and understand a Hijackthis Log, but perhaps that is a New Question...

Finally, the Event Viewer shows NO ERRORS since this driver Unistallation. All the warning and errors that normally appeared each time i restarted the computer are gone from that moment on!

There is still one issue, and is that when i restart or turn off my computer, the "Saving your settings" screen takes too long, almost 1 minute...  

- One last thing until further notice: Since this was a Video Driver problem, how can i be sure my Video Card did not suffered any damage? any idea how to check this? I am still under warranty, so it will be a good thing to do.

unrinoceronteAuthor Commented:
Thanks R-K and Orangutang for your effort helping me,, i was truly desperate because i had a deadline in one project, but because of both your help i managed to solve the problem, and finish on time.
unrinoceronteAuthor Commented:
Thanks R-K for the extra feedback, is very important because with that i understand better the problem i had. I will do what you reccomended for SP3, (i did not know it existed...)..  Also i will try the Diagnostic CD, or cal Dell just to be safe my hardware did not suffer...

Everything is still working fperfectly, but regarding what i said about no more errors on EVENT Viewer, i was wrong.. There is still one quite frequently..  I am attaching a Screen Capture, perhaps you can hgive me a hand with this a last time... Perhaps itis related to my other problem so i rather keep it here than start a new question.. If it gets big i will...

Here are the errors:

- The error is : EVENTLOG  ID:  6004  , and says " A driver packet received from the I/O subsystem was invalid.  The data is the packet."

- Also a common warning: Source: DISK, ID: 51_ and says_ " An error was detected on device \Device\Harddisk2\D during a paging operation."

- another WArning:  Source:MrxSmb, ID: 3019 _ and says: " he redirector failed to determine the connection type."

Thanks , i will appreciate a lot if you could take a lookk ath this for a last time.


unrinoceronteAuthor Commented:
Please Help with this Last issue.. in previous comment...
You can check if you have errors in your event viewer. You have to pay for a membership for some solutions, though.
unrinoceronteAuthor Commented:
hmm , thanks orangutang.    ,,,

is there other way?    microsoft itself?
There are some indications on the web that the Event ID 6004 may be caused by the AV program. Can you temporarily disable your AV program from doing realtime scanning and see if the 6004 events go away.

How many Event ID 51's are you getting for Harddisk2/D? Let's see if those go away after disabling AV, else it may point to possible bad block on that drive.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.