"System" high CPU usage

[Eastman51]

So my laptop has been plagued with an issue where the System process (as listed in Task Manager) uses approx 10-20% of the CPU for no real reason. I've tried updating every possible driver, sfc /scannow, disabling Superfetch, making Windows clear the page file at shutdown, hunted through Process Explorer and Event viewer looking for trouble processes, and disabling some audio devices in Device Manager. The System process taking this much CPU effectively means that my laptop can never actually "idle" because it's always doing something, but I have no idea wtf the System is trying to do. This bothers me because it slows down my laptop when I'm trying to work or game on it, and it means that it always idles high and never actually cools down all the way (45C idle on the CPU is high, even for a laptop; same with 30% CPU usage at "idle"). 

I will likely try a clean, fresh Windows install tonight when I get home. I have not done so before (still running OEM image, and I cloned it to the Samsung 960 EVO I added in), so this could be the fix. Figured I'd ask around here, for opinions and ideas in case a reinstall doesn't fix it.

 

Laptop: Dell Inspiron 15 5000 Gaming (I think the model is 15577)

Specs:

i5-7300HQ

16GB of RAM (one is an aftermarket module, don't remember the brand atm).

GTX 1050 4GB

OEM WD 1TB 5400rpm HDD

Samsung 960 EVO 500GB

[LogicalDrm]

What is the exact .exe is causing it? System process is everything Windows does.

[GoodBytes]

"System" is not a process by itself, it is the kernel of Windows.

Usually, high CPU or memory usage in there is due to or some drivers that you installed.

[homeap5]

21 hours ago, Eastman51 said:

I will likely try a clean, fresh Windows install tonight when I get home.

For what?

You'll end with the same result.

It may be anything - even scheduled disk defrag. So you made another install and Windows start defrag your HDD anyway.

If you want - use Process Hacker - it may shows you more than Task Manager.

[Eastman51]

3 hours ago, LoGiCalDrm said:

What is the exact .exe is causing it? System process is everything Windows does.

That's the thing, I can't figure out what exact .exe it is. I used Process Explorer to try and pin it down, but I can't get anything more than "System"

If I'm not mistaken, System is the "ntoskernel.exe", but I'm not entirely sure. 

Sadly didn't have time to attempt a clean install, I also need to find my MS Office installer before I do it.

[L S D]

you could try using an application called "Process Explorer". It might shed some light.

[Super Spartan]

Are you sure it's not a virus? What Antivirus do you use?

 

Also, I've noticed this happen when installing some apps that come bundled with PUPs( Potentially Unwanted Programs) like uTorrent, it will literally screw up my system, that's why I stopped using uTorrent. Just a thought, it could be anything.

 

also, where did you get your driver updates from? I noticed one time I installed an updated driver from Station Drivers but upon installing it and rebooting, I got a crash with an error code. When I Googled that error code it seems to be a code that caused the system to reboot erratically because of malware so I then formatted again and installed the latest driver offered by my laptop manufacturer although a bit older, but never got that error. My point is, ensure you are getting your drivers from official sources.

[Eastman51]

Just now, Ultra Male said:

Are you sure it's not a virus? What Antivirus do you use?

 

Also, I've noticed this happen when installing some apps that come bundled with PUPs( Potentially Unwanted Programs) like uTorrent, it will literally screw up my system, that's why I stopped using uTorrent. Just a thought, it could be anything.

 

also, where did you get your driver updates from? I noticed one time I installed an updated driver from Station Drivers but upon installing it and rebooting, I got a crash with an error code. When I Googled that error code it seems to be a code that caused the system to reboot erratically because of malware so I then formatted again and installed the latest driver offered by my laptop manufacturer although a bit older, but never got that error. My point is, ensure you are getting your drivers from official sources.

I have Kaspersky for my anti-virus. I get my driver updates through Nvidia GeForce experience and Intel's little update utility. I have also gotten drivers from the official Dell product page before, but I moved to the Intel utility since I have an intel based system. 

I haven't run an anti-virus scan in a while, I don't think its set to run weekly like I have it on my desktops. I'll go ahead and give that spin

[Super Spartan]

4 minutes ago, Eastman51 said:

I have Kaspersky for my anti-virus. I get my driver updates through Nvidia GeForce experience and Intel's little update utility. I have also gotten drivers from the official Dell product page before, but I moved to the Intel utility since I have an intel based system. 

I haven't run an anti-virus scan in a while, I don't think its set to run weekly like I have it on my desktops. I'll go ahead and give that spin

Well if you have Kaspersky then you should be fine in terms of not having a virus even if you didn't run a scan for a while because if it is running, then you wouldn't get a virus anyway, I mean 99.9% at least.

 

What I would do in Kaspersky though is, if you dig into the settings, under the virus protection, there is a setting to enable protection against potentially unwanted programs (PUPs) which is not checked by default so go ahead and check that. 

 

Here's the guide on how to enable it:

 

https://support.kaspersky.com/us/12407

 

Then run a scan again after doing that.

 

Finally, can you tell us what are all the programs you have installed? Maybe take a screenshot of Control Panel / Programs & Features lemme have a look.

[Eastman51]

27 minutes ago, Ultra Male said:

Well if you have Kaspersky then you should be fine in terms of not having a virus even if you didn't run a scan for a while because if it is running, then you wouldn't get a virus anyway, I mean 99.9% at least.

 

What I would do in Kaspersky though is, if you dig into the settings, under the virus protection, there is a setting to enable protection against potentially unwanted programs (PUPs) which is not checked by default so go ahead and check that. 

 

Here's the guide on how to enable it:

 

https://support.kaspersky.com/us/12407

 

Then run a scan again after doing that.

 

Finally, can you tell us what are all the programs you have installed? Maybe take a screenshot of Control Panel / Programs & Features lemme have a look.

Setting was already enabled.

Here's my installed programs:

 

 

Edit: Here's my startup programs (Task Manager):

 

[Super Spartan]

4 minutes ago, Eastman51 said:

Setting was already enabled.

Here's my installed programs:

 

All looks good to be honest.

 

Few questions:

 

1) Can you open up command prompt or power shell and type Winver then post the screenshot of the Windows build you're on

 

2) Did you do a clean install of the latest build or was this like an upgrade from an older build?

 

3) Can you uninstall Java and Samsung Magician and reboot then tell me if you still have that high CPU Usage?

[Eastman51]

1 minute ago, Ultra Male said:

All looks good to be honest.

 

Few questions:

 

1) Can you open up command prompt or power shell and type Winver then post the screenshot of the Windows build you're on

 

2) Did you do a clean install of the latest build or was this like an upgrade from an older build?

 

3) Can you uninstall Java and Samsung Magician and reboot then tell me if you still have that high CPU Usage?

This is a laptop I got from Dell, it has the stock image on it (ofc Windows updates have occurred since then). I uninstalled almost all the Dell bloatware (the TrueColor thing shipped with the laptop). I have not run a clean install on this machine before. I added in a 960 EVO a while back (last april, I think) and cloned the OS over to it, then did a full wipe on the original HDD with diskpart to use it as a game/storage drive.

[Super Spartan]

1 minute ago, Eastman51 said:

This is a laptop I got from Dell, it has the stock image on it (ofc Windows updates have occurred since then). I uninstalled almost all the Dell bloatware (the TrueColor thing shipped with the laptop). I have not run a clean install on this machine before. I added in a 960 EVO a while back (last april, I think) and cloned the OS over to it, then did a full wipe on the original HDD with diskpart to use it as a game/storage drive.

That's VERY puzzliny man. That is the latest build which have most of the Windows 10 Redstone 5 ironed out.

 

Do you remember what version did your laptop ship with initially when you first got it? (ie. Redstone 2,3,4)

 

Sometimes upgrades don't go very smoothly due to the fact that many registry changes occur in between upgrades in addition to many windows file updates so a fresh install is the best but I like to avoid that as much as possible and keep it as a last resort.

[Eastman51]

2 minutes ago, Ultra Male said:

That's VERY puzzliny man. That is the latest build which have most of the Windows 10 Redstone 5 ironed out.

 

Do you remember what version did your laptop ship with initially when you first got it? (ie. Redstone 2,3,4)

 

Sometimes upgrades don't go very smoothly due to the fact that many registry changes occur in between upgrades in addition to many windows file updates so a fresh install is the best but I like to avoid that as much as possible and keep it as a last resort.

Don't remember what it shipped with (I did get this laptop Black Friday 2017).

I'm totally OK with a fresh install, I can easily back up my files and the games are stored on the second drive (have fast internet anyways).

[Super Spartan]

5 minutes ago, Eastman51 said:

Don't remember what it shipped with (I did get this laptop Black Friday 2017).

I'm totally OK with a fresh install, I can easily back up my files and the games are stored on the second drive (have fast internet anyways).

Try using O&O ShutUp10 instead but don't blindly disable everything, read what the description says. Most importantly, disable telemetry 1/2/3 and disable Windows Defender and all of the stuff related to it. Once you exit it, it will prompt you to reboot, then run it again and it will give you a message that one of the components has re-enabled itself (which would be Telemetry 3), just click revert changes then exit the program again and it will prompt you for another reboot.

 

Then download Autoruns to help you see and disable startup items. After you extract it, right click on Autoruns64.exe and choose Run as Admin

 

Now in the filter, type Defender

 

then uncheck all the entries related to Windows Defender since you use Kaspersky you don't want anything from Windows defender to conflict with your third party AV

[Super Spartan]

FYI, ClassicShell has been discontinued and the development was continued by some other guy then he renamed it to OpenShell. The Classic Shell you are using does not support Windows 10 Redstone 5 properly so consider upgrading it to the latest version of OpenShell: 

 

OpenShell 4.4.131 Download

 

http://m.majorgeeks.com/files/details/classic_start.html

 

You can save your current settings within classic shell as an XML file and then import it into OpenShell when you restore it. I recommend you reboot first after uninstalling ClassiShell

[Eastman51]

1 minute ago, Ultra Male said:

FYI, ClassicShell has been discontinued and the development was continued by some other guy then he renamed it to OpenShell. The Classic Shell you are using does not support Windows 10 Redstone 5 properly so consider upgrading it to the latest version of OpenShell: 

 

OpenShell 4.4.131 Download

 

http://m.majorgeeks.com/files/details/classic_start.html

 

You can save your current settings within classic shell as an XML file and then import it into OpenShell when you restore it. I recommend you reboot first after uninstalling ClassiShell

Oh, thanks. I'll replicate this across all my machines.

 

I've also done the O&O and Autoruns stuff. I also disabled the Skype for business stuff in autoruns, as it annoys me.

[Eastman51]

33 minutes ago, Ultra Male said:

Try using O&O ShutUp10 instead but don't blindly disable everything, read what the description says. Most importantly, disable telemetry 1/2/3 and disable Windows Defender and all of the stuff related to it. Once you exit it, it will prompt you to reboot, then run it again and it will give you a message that one of the components has re-enabled itself (which would be Telemetry 3), just click revert changes then exit the program again and it will prompt you for another reboot.

 

Then download Autoruns to help you see and disable startup items. After you extract it, right click on Autoruns64.exe and choose Run as Admin

 

Now in the filter, type Defender

 

then uncheck all the entries related to Windows Defender since you use Kaspersky you don't want anything from Windows defender to conflict with your third party AV

I did not disable the telemetry 1/2/3 (it has caused issues with achievements in Xbox play anywhere games), but I did do the defender stuff in both. This seems to be the fix! My CPU usage is now around ~2%~ at a true idle.

[Super Spartan]

7 minutes ago, Eastman51 said:

I did not disable the telemetry 1/2/3 (it has caused issues with achievements in Xbox play anywhere games), but I did do the defender stuff in both. This seems to be the fix! My CPU usage is now around ~2%~ at a true idle.

WOW!! amazing man! Glad we nailed this! Saved us from a format!

[GoodBytes]

23 minutes ago, Ultra Male said:

WOW!! amazing man! Glad we nailed this! Saved us from a format!

That is not amazing at all. He just buried his problem under the carpet.

[Super Spartan]

2 minutes ago, GoodBytes said:

That is not amazing at all. He just buried his problem under the carpet.

Why so? If he's using another Antvirus, in this case Kaspersky, he does not need the Windows Defender DLLs loaded upon startup. In fact, that is the first thing I go when I format my system, first I disable Windows Defender from the app itself, then from Group Policy, then I uncheck its startup files (not delete them) that way I know nothing is going to interfere with my Antivirus when I come to install it.

[homeap5]

13 hours ago, GoodBytes said:

That is not amazing at all. He just buried his problem under the carpet.

Alternative was reinstalling system (OP wanted to do it) and that is buried problem under the carpet too. So at least now he know that defender somehow causes the problem (which is better than "SOMETHING is wrong with my OS, so I made reinstall").

 

I may just add that Defender main protection can be disabled by single registry entry (this is what ShutUp10 do in fact when you want to disable Defender using this tool) and rest of protections may be configured using control panel.

[GoodBytes]

15 hours ago, Ultra Male said:

Why so? If he's using another Antvirus, in this case Kaspersky, he does not need the Windows Defender DLLs loaded upon startup. In fact, that is the first thing I go when I format my system, first I disable Windows Defender from the app itself, then from Group Policy, then I uncheck its startup files (not delete them) that way I know nothing is going to interfere with my Antivirus when I come to install it.

Windows Defender is more than just anti-virus. It is an anti-malware, anti-spyware and network inspection.

The anti-virus part should get automatically disabled if you have an anti-virus installed and running. Defender will kick start again if the anti-virus you have, trial or subscription has ended.

 

In his case, it is not Windows Defender using your CPU usage, it is SYSTEM.

So what if CPU usage of SYSTEM is related to, say, disk activity due to a SATA controller driver issue?

What if it is related to networking? or something else?

We have no idea. All he has done, is hide the problem and not go down to the issue of why SYSTEM is taking so much resources. Now 1 thing that was not addressed is his system specs. perhaps it is normal that SYSTEM consumes so much, because he runs a Celeron CPU, or Atom, or Pentium Silver, or Y series CPU. I don't know...

 

My point is trying to randomly disable things without knowing things is not how to fix things. You need to investigate the issue, find the cause, and now take action.

 

[Eastman51]

4 hours ago, GoodBytes said:

Windows Defender is more than just anti-virus. It is an anti-malware, anti-spyware and network inspection.

The anti-virus part should get automatically disabled if you have an anti-virus installed and running. Defender will kick start again if the anti-virus you have, trial or subscription has ended.

 

In his case, it is not Windows Defender using your CPU usage, it is SYSTEM.

So what if CPU usage of SYSTEM is related to, say, disk activity due to a SATA controller driver issue?

What if it is related to networking? or something else?

We have no idea. All he has done, is hide the problem and not go down to the issue of why SYSTEM is taking so much resources. Now 1 thing that was not addressed is his system specs. perhaps it is normal that SYSTEM consumes so much, because he runs a Celeron CPU, or Atom, or Pentium Silver, or Y series CPU. I don't know...

 

My point is trying to randomly disable things without knowing things is not how to fix things. You need to investigate the issue, find the cause, and now take action.

 

Well, I may have spoken too soon. I opened my laptop up in class today, and System is taking up 10% of CPU still. O&O settings are the same. I think a clean install may be in order tonight.

 

 

[Eastman51]

22 hours ago, Ultra Male said:

WOW!! amazing man! Glad we nailed this! Saved us from a format!

Didn't actually fix the problem. I'm just going to do a clean install; this gives me a good excuse to put the time into creating a custom Windows image.