GPU usage while Windows idle

[ImpavidTurtle]

Hello,

 

I recently bough an RX6800XT. It's an XFX Speedster Swift. The issue I'm getting is that I can hear fans ramping up after a short time of idling. Windows Task Manager doesn't display any apps using the GPU but I can see dedicated memory usage and "copy" time.

 

First I though that I might have picked up some malware (a miner or something), but I guess that would use some of the rendering engines, not only copy? I've scanned the entire PC with Malwarebytes and it only found an auto refresh browser extension as a PUP. I've tried disabling the extension but get the same thing.

 

I never (willingly) installed or used any software that would use the GPU in the background. Mostly I've got games and development software, 99% of the software isn't even allowed to start with Windows, but rather I start it manually and it happens with nothing running in the background.

 

CPU and RAM usage are normal while the GPU ramps up.

 

I'm attaching a screenshot of the GPU usage in Windows Task Manager.

EDIT: If it matters, I've only tuned the fan speeds in the AMD driver and turned on SmartAccess Memory.

Also, doing anything on the PC, moving the mouse or pressing anything on the keyboard will cause the GPU to return back to idle usage.

 

Full specs:
Windows 10 Pro (legit version)

ASUS PRIME B450M-A

AMD R5 3600

32GB 3000MHz

XFX Speedster Swift RX6800XT

Multiple drives of all sorts.

[Makaroni]

To be 80% sure if your PC has a secret mining log on your PC i would completely disable the internet and leave the PC at idle. Bonus i would literally stop every single standard app that you use on a daily basis open up Hardware info and start stalking it and waiting for it to go idle.

If there is no change that means somewhere in your PC there is a log port (backdoor log) that tells a server that your GPU is idle and then makes it mine eth or whatever other crypto currency the malware is farming.

Maybe someone else in the fourms has more experience with this. I personally have security features set on my Deco system so this topic is sort of a blackbox to me also i have not had an AMD card in maybe 9 years so i do not know their behavior.

[tikker]

I'd get something like MSI Afterburner to get a more reliable probe of how much it's being used. Task manager isn't always the greatest at it. Then you can see the GPU usage during idle.

 

Lots of things can use the GPU for hardware acceleration. This varies from browsers to Windows search. It can very well be that Windows runs some background task that can leverage the GPU. I wouldn't suspect a mining virus unless you see 100% usage during idle time.

[ImpavidTurtle]

Spoiler

Thanks for the idea @Makaroni. So, I gave it multiple "runs" both with and without an internet connection (physically unplugging the ethernet cable).

 

Without internet, nothing happens for over 10 minutes. I plugged it back in and after a minute or two, voila, see screenshot.

Unplugged again, nothing for 10 plus minutes. Plugged the internet back in, and instantly I see a rise in GPU memory usage. The "Copy" from Windows Task Manager only shows that something was copied into the GPU memory as it seems.

 

No RAM usage fluctuation, a minor CPU spike (4-5%), minor internet traffic (20kbps for a second or two). Moving the mouse dropped the GPU memory usage entirely as always.

 

Max recorded GPU core power: 181W

Max recorded GPU ASIC power: 254W

Max recorded GPU utilization: 20% for D3D, 100% for compute "GPU Computing (Compute 1), max "general" utilization: 99%

Average usages are 3-4% so there are not just milisecond spikes in usages. Also, temperatures reached over 60° with fans ramped up, so there was something going on.

 

@tikkerwhat background task would ever use such a powerful GPU enough to cause fans to ramp up? I've played relatively new games that never get the GPU fans to turn on. Also, no hardware acceleration is needed with nothing being open and the PC idling.

 

I have left what I originaly intended to post up above, but here is what I found while digging further.

I have realised that you can select dedicated GPU memory column in the task manager details tab. And I did. Soon, I saw .NET Optimization Framework pop up. Suspicion was felt. I also selected the "Image path name" column to see where the exe is. Lo and behold, it is in a legit .NET folder with legit .NET stuff (at least it appears so) and there are logs since March 1st this year.

Here's the first line of every log file:

Quote

2022.03.01:19:15:27.341: main Phoenix Miner 5.0e Windows/msvc - Release build

So, there indeed was a miner on my PC. Exe name was: mscorsvw.exe in C:\Windows\Microsoft.NET\Framework\v3.5\

I am currently searching for any similar log files to see if there may be any more miner .exe on my PC.

 

[tikker]

7 minutes ago, ImpavidTurtle said:

what background task would ever use such a powerful GPU enough to cause fans to ramp up? I've played relatively new games that never get the GPU fans to turn on. Also, no hardware acceleration is needed with nothing being open and the PC idling.

If your fans are low RPM or even off, then especially a powerful GPU suddenly kicking into full gear will heat up rapidly and cause the fans to ramp up. An idling PC can still use hardware acceleration if background tasks that use it are running.

7 minutes ago, ImpavidTurtle said:

2022.03.01:19:15:27.341: main Phoenix Miner 5.0e Windows/msvc - Release build

Yep, that's a miner. That explains the 100% compute load.

[ImpavidTurtle]

6 minutes ago, tikker said:

If your fans are low RPM or even off, then especially a powerful GPU suddenly kicking into full gear will heat up rapidly and cause the fans to ramp up. An idling PC can still use hardware acceleration if background tasks that use it are running.

Yep, that's a miner. That explains the 100% compute load.

You completely misunderstood my (rhetorical) question. No legitimate background tasks would ever cause GPU fans to ramp up, especially not on such a powerful GPU. I understand GPU thermals, which is why I wrote that some relatively new games cannot get the fans going and I guess we both know gaming is relatively intensive on PC resources in general.

With all that said, anything that causes GPU fans to ramp up uses very significant power and is not something to ignore. If anyone ever finds this thread with similar issues, please (for the love of all that is holy, please) investigate further.

[tikker]

8 minutes ago, ImpavidTurtle said:

You completely misunderstood my (rhetorical) question. No legitimate background tasks would ever cause GPU fans to ramp up, especially not on such a powerful GPU. I understand GPU thermals, which is why I wrote that some relatively new games cannot get the fans going and I guess we both know gaming is relatively intensive on PC resources in general.

With all that said, anything that causes GPU fans to ramp up uses very significant power and is not something to ignore. If anyone ever finds this thread with similar issues, please (for the love of all that is holy, please) investigate further.

Nobody said to ignore high usage. The task manager screenshot you shared in the OP simply did not show high usage or heavy load with everything at 0%, hence the suggestion to confirm this with another tool purpose built for monitoring GPU usage (Afterburner will have shown high usage when the miner kicks in).

[Makaroni]

15 hours ago, ImpavidTurtle said:

  Hide contents

Thanks for the idea @Makaroni. So, I gave it multiple "runs" both with and without an internet connection (physically unplugging the ethernet cable).

 

Without internet, nothing happens for over 10 minutes. I plugged it back in and after a minute or two, voila, see screenshot.

Unplugged again, nothing for 10 plus minutes. Plugged the internet back in, and instantly I see a rise in GPU memory usage. The "Copy" from Windows Task Manager only shows that something was copied into the GPU memory as it seems.

 

No RAM usage fluctuation, a minor CPU spike (4-5%), minor internet traffic (20kbps for a second or two). Moving the mouse dropped the GPU memory usage entirely as always.

 

Max recorded GPU core power: 181W

Max recorded GPU ASIC power: 254W

Max recorded GPU utilization: 20% for D3D, 100% for compute "GPU Computing (Compute 1), max "general" utilization: 99%

Average usages are 3-4% so there are not just milisecond spikes in usages. Also, temperatures reached over 60° with fans ramped up, so there was something going on.

 

@tikkerwhat background task would ever use such a powerful GPU enough to cause fans to ramp up? I've played relatively new games that never get the GPU fans to turn on. Also, no hardware acceleration is needed with nothing being open and the PC idling.

 

I have left what I originaly intended to post up above, but here is what I found while digging further.

I have realised that you can select dedicated GPU memory column in the task manager details tab. And I did. Soon, I saw .NET Optimization Framework pop up. Suspicion was felt. I also selected the "Image path name" column to see where the exe is. Lo and behold, it is in a legit .NET folder with legit .NET stuff (at least it appears so) and there are logs since March 1st this year.

Here's the first line of every log file:

So, there indeed was a miner on my PC. Exe name was: mscorsvw.exe in C:\Windows\Microsoft.NET\Framework\v3.5\

I am currently searching for any similar log files to see if there may be any more miner .exe on my PC.

 

Hey man. I am happy to help. and i am glad you found out your problem.

For some extra security i would suggest you maybe do a check on your others PCs or devices maybe that have been connected to the same network as your PC as more sophisticated malware can create idle backdoors on other devices if your network is unsecure (example is the Emotet trojan)

some advice; there has been a trend to embed malware into pictures lately (or at least their base code to prevent detection) so make 100% sure that you trust the sources from where you download. (what i do is use Microsoft paint and PrtScr to get wallpapers)
 
I might actually use your case as a team building exercise for one of my IT teams.

 

[ImpavidTurtle]

On 6/17/2022 at 8:53 AM, Makaroni said:

Hey man. I am happy to help. and i am glad you found out your problem.

For some extra security i would suggest you maybe do a check on your others PCs or devices maybe that have been connected to the same network as your PC as more sophisticated malware can create idle backdoors on other devices if your network is unsecure (example is the Emotet trojan)

some advice; there has been a trend to embed malware into pictures lately (or at least their base code to prevent detection) so make 100% sure that you trust the sources from where you download. (what i do is use Microsoft paint and PrtScr to get wallpapers)
 
I might actually use your case as a team building exercise for one of my IT teams.

 

The miner most likely came from a torrent. Even as a dev I cannot afford to buy every bit of software/game I want (eastern Europe is a fun place) so it was most likely packed in a .net redistributable or within some installation. Luckily I only have one laptop on the same network so it wont take much to check, but good advice anyway.

But probably only the PC got infected since I only have one device active on the network at one time.

Feel free to use this as an example.

[Gorn21]

I had after an forced windows update an simillar issue with high GPU usage which came from desktop window manager (dwm.exe) which i could deactivate in the system settings. Good i hate windows Updates. 40% GPU usage just with Internet browser open i have no idea what windows tryed to do there but it seriusly fucked up that much GPU usage is mostly not even reached by most of my games on max settings (rtx 3080).

[ImpavidTurtle]

11 hours ago, Gorn21 said:

I had after an forced windows update an simillar issue with high GPU usage which came from desktop window manager (dwm.exe) which i could deactivate in the system settings. Good i hate windows Updates. 40% GPU usage just with Internet browser open i have no idea what windows tryed to do there but it seriusly fucked up that much GPU usage is mostly not even reached by most of my games on max settings (rtx 3080).

I sometimes get 500MB gpu memory usage from it. It spikes on its own and drops back on its own, but it doesnt use the gpu core so it doesnt worry me that much.

On idle I get 3-10% gpu core usage, but the frequency is in double digit range, so it uses <15W. I only worry if something causes the frequency to get into 3 or 4 digit range since that increases power usage in 3 digit range as well.

[Gorn21]

2 hours ago, ImpavidTurtle said:

I sometimes get 500MB gpu memory usage from it. It spikes on its own and drops back on its own, but it doesnt use the gpu core so it doesnt worry me that much.

On idle I get 3-10% gpu core usage, but the frequency is in double digit range, so it uses <15W. I only worry if something causes the frequency to get into 3 or 4 digit range since that increases power usage in 3 digit range as well.

well i turned it off and it didnt really affect anything and just reduced the gpu usage while pc wasnt under heavy load.

[ImpavidTurtle]

6 hours ago, Gorn21 said:

well i turned it off and it didnt really affect anything and just reduced the gpu usage while pc wasnt under heavy load.

You can use O&O Shut Up to turn off a lot of unnecessary windows "features". Just be careful not to turn off something you actually need.