System Continuously Using Around 50% CPU

[Mark F]

Hi, I realise my PC is 5 years old now but it's been perfect up to now. I'm trying here before trying the rest of the world (where to start?). Any help or pointers for further investigation will be much appreciated.

Case
CORSAIR CARBIDE SERIES™ 275Q QUIET CASE
Promotional Item
Choose from 6 Incredible Ubisoft Titles FREE with select SAMSUNG SSDs!
Promotional Code
Promotional Item
FREE Red Dead Redemption 2 & More! w/ select Intel i7 & i9 CPUs!
Promotional Code
Processor (CPU)
Intel® Core™ i7 Eight Core Processor i7-9700K (3.6GHz) 12MB Cache
Motherboard
Gigabyte Z390 AORUS PRO: ATX, LG1151, USB 3.1, SATA 6GBs - RGB Ready
Memory (RAM)
32GB Corsair VENGEANCE DDR4 2666MHz (2 x 16GB)
Graphics Card
6GB NVIDIA GEFORCE GTX 1660 Ti - HDMI, DP - GeForce GTX VR Ready!
1st M.2 SSD Drive
500GB SAMSUNG 970 EVO PLUS M.2, PCIe NVMe (up to 3500MB/R, 3200MB/W)
2nd M.2 SSD Drive
1TB SAMSUNG 970 EVO PLUS M.2, PCIe NVMe (up to 3500MB/R, 3300MB/W)
1st Storage Drive
6TB SEAGATE BARRACUDA SATA-III 3.5" HDD, 6GB/s, 5400RPM, 256MB CACHE
DVD/BLU-RAY Drive
NOT REQUIRED
Power Supply
CORSAIR 550W TXm SERIES™ SEMI-MODULAR 80 PLUS® GOLD, ULTRA QUIET
Power Cable
1 x 1 Metre UK Power Cable (Kettle Lead)
Processor Cooling
Corsair H60 Hydro Cooler w/ PCS Ultra Quiet Fans
Thermal Paste
STANDARD THERMAL PASTE FOR SUFFICIENT COOLING
Sound Card
ONBOARD 6 CHANNEL (5.1) HIGH DEF AUDIO (AS STANDARD)
Wireless Network Card
10/100/1000 GIGABIT LAN PORT (Wi-Fi NOT INCLUDED)
USB/Thunderbolt Options
MIN. 2 x USB 3.0 & 2 x USB 2.0 PORTS @ BACK PANEL + MIN. 2 FRONT PORTS
Operating System
Windows 10 Professional 64 Bit - inc. Single Licence
Operating System Language
United Kingdom - English Language
Windows Recovery Media
Windows 10 Multi-Language Recovery Image - Unlimited Downloads from Online Account
Office Software
FREE 30 Day Trial of Microsoft® Office® 365 (Operating System Required)
Anti-Virus
NO ANTI-VIRUS SOFTWARE
Browser
Microsoft® Edge (Windows 10 Only)
Warranty
3 Year Silver Warranty (1 Year Collect & Return, 1 Year Parts, 3 Year Labour)
Delivery
STANDARD INSURED DELIVERY TO UK MAINLAND (MON-FRI)
Build Time
Standard Build - Approximately 6 to 8 working days
Welcome Book
PCSpecialist Welcome Book - United Kingdom & Republic of Ireland

Current
Windows 11 Version 24H2 (OS Build 26100.2605)
BIOS Version/Date American Megatrends Inc. F10, 05/06/2019

The Issue
CPU showing up to about 50% for System, even when pc is idle. I don’t know when this started, the pc is fairly quiet and I don’t have any monitoring onscreen all the time, I just happened to notice on Tuesday when looking at Task Manager (for a reason I don’t remember). On Tuesday I was just checking for any updates for system or software, uploading holiday photos to Lightroom. I did uninstall a few unused apps like Xbox as well (photos were taking a while to upload so I fiddled about). PC is home use, mostly photos and a bit of video (LR, PS, Davinci Resolve).
One of the updates I did was a new Nvidia driver which also prompted me to install the new Nvidia App, the GEForce Experience did not seem to uninstall itself cleanly during this so I suspected this may have been the/part of problem, but I don’t recall whether I noticed the CPU usage before or after any of these updates/uninstalls.

I’ve done a lot of searching the internet, tried various things which I’ve listed below in approximately the right order. I’ve often done power cycles rather than restarts between steps.

Using Process Explorer the ‘culprits’ appear to be 3 threads under the System process using about 13% CPU each, all 3 are named ntoskrnl.exe!RtlNumberOfSetBitsEx+0x680.
I cannot access the stack for the threads, get a message popup ‘unable to access thread’ (tbh I don’t know if I would understand what the stack was saying anyway but it could be useful!).

Note, the issue does not occur in Safe Mode but it DOES with a ‘clean boot’ with all services and startup apps disabled.

Suspecting it was Nvidia stuff I used DDU in Safe Mode to remove Nvidia drivers etc. Note as part of doing this I turned off Windows Fast Start and automatic device updates. Reinstalled them in Normal Mode.

Check and updated lates Windows and 2 optional drivers (both Intel things).

Did system file checks with sfc /scannow and DISM…RestoreHealth.

Windows Memory Diagnostic tool to check RAM.

Samsung Magician appears to show no issues with SMART data for both NVMEs and two 4Tb 870 EVOs (not in original build).

Windows Defender Full Scan and Offline Scan (which said it would show results on restart but I never saw anything!).

I’ve done those things twice over. Second go at removing Nvidia stuff I used DDU and Nvidia Cleaner.

Any help appreciated, thanks.

 

[SpyderTracks]

My default response would be to clean install but if you could follow @ubuysa advife below, he may be able to pinpoint a cause with his Sherlock skills

I'd like some hard data, so please download the SysnativeBSODCollectionApp and save it to the Desktop. Then run it and upload the resulting zip file to a cloud service with a link to it here (I do appreciate that you're not having BSODs). The SysnativeBSODCollectionApp collects all the available troubleshooting data and will make diagnosing your problem easier. It DOES NOT collect any personally identifying data. It's used by several highly respected Windows help forums (including this one). I'm a senior BSOD analyst on the Sysnative forum where this tool came from, so I know it to be safe.

You can of course look at what's in the zip file before you upload it, most of the files are txt files. Please don't change or delete anything though. If you want a description of what each file contains you'll find that here.

 

[Mark F]

Thanks for the quick response. While the app was running there were messages about the Services and Tracert reports taking too long to run and being skipped (I assume that'll be mentioned in the files somewhere).
Link to the file on WeTransfer https://we.tl/t-QWfNQxnlGk

I've not had to do anything much with fixing Windows or PCs in general this century! We had IBM pc's at work back in the 80's.

 

[SpyderTracks]

Thanks for the quick response. While the app was running there were messages about the Services and Tracert reports taking too long to run and being skipped (I assume that'll be mentioned in the files somewhere).
Link to the file on WeTransfer https://we.tl/t-QWfNQxnlGk

I've not had to do anything much with fixing Windows or PCs in general this century! We had IBM pc's at work back in the 80's.

He's normally on in the mornings, hopefully he'll take a look some point soon and give you far better insight than I could

 

[ubuysa]

Just seen this on my phone. I'll get too it first thing in the morning (it's 9:30pm here now).

Have you virus checked it? Use two different tools to be sure.

That it's OK in Safe Mode suggests that it's a software/driver issue, so don't bother testing hardware any further (for now anyway).

BTW. The RtlNumberOfSetBitsEx function is a runtime library function commonly called in drivers, so this may well be a misbehaving driver, or one not fully compatible with Windows 11 or with 24H2. You might want to check your driver versions.

 

[ubuysa]

I have another question: were you aware of this excessive CPU use before you upgraded to 24H2? There are some compatibility issues with 24H2 and you are running some aged drivers on there....

There is a driver on there called ddcdrv.sys that dates from 2008, that pre-dates the initial release of Windows 7!!...

0: kd> lmDvmDDCDrv
Browse full module list
start             end                 module name
fffff805`27700000 fffff805`27709000   DDCDrv     (deferred)           
    Image path: \??\C:\windows\system32\drivers\DDCDrv.sys
  Image name: DDCDrv.sys
    Browse all global symbols  functions  data  Symbol Reload
    Timestamp:        Tue Apr  8 10:50:11 2008 (47FB23B3)
    CheckSum:         00009C58
    ImageSize:        00009000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

This Windows XP driver appears to be part of a product called WinI2C/DDC from NicomSoft Ltd that allows direct control of display devices. It appears to have been discontinued and although it supports Windows 7, running it on a Windows 11 system is pushing things a bit. I have no idea what you need this product for, but I suggest you look for something that is Windows 11 compatible because this driver is prehistoric.

Something else that makes me think that this driver is problematic is a large number of errors for nvlddmkm.sys, the Nvida graphics driver, in your System log...

Source:        nvlddmkm
Date:          10/01/2025 17:11:03
Event ID:      153
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      The-Desktop
Description:
The description for Event ID 153 from source nvlddmkm cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

\Device\Video3
Restarting TDR occurred on GPUID:100

The message resource is present but the message was not found in the message table

These are all for the same device (\Device\Video3) and it would not surprise me in the least to find that the errors are related to that ddcdrv.sys driver.


There are also two other drivers (aksdf.sys and aksfridge.sys) that pre-date the release of Windows 10...

0: kd> lmDvmaksdf
Browse full module list
start             end                 module name
fffff805`27570000 fffff805`27584d00   aksdf      (deferred)           
    Image path: \??\C:\windows\system32\drivers\aksdf.sys
    Image name: aksdf.sys
    Browse all global symbols  functions  data  Symbol Reload
   Timestamp:        Thu Oct 17 11:47:38 2013 (525FA42A)
    CheckSum:         0001E5E9
    ImageSize:        00014D00
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

0: kd> lmDvmaksfridge
Browse full module list
start             end                 module name
fffff805`27590000 fffff805`275b6000   aksfridge   (deferred)           
    Image path: \??\C:\windows\system32\drivers\aksfridge.sys
    Image name: aksfridge.sys
    Browse all global symbols  functions  data  Symbol Reload
    Timestamp:        Tue Jun 24 12:44:36 2014 (53A94884)
    CheckSum:         000281E9
    ImageSize:        00026000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

These two drivers seem to be associated with an Aladdin Knowledge Systems product for a DRM dongle? Again, I have no idea what you use this product for but these drivers are ancient, so I suggest you either look for an update to this product/tool or you look for an alternative that is Windows 11 compatible.


All of the above drivers are kernel-mode drivers and would not be loaded in Safe Mode, when only critical services and drivers are loaded, but they would be loaded in a Clean Boot, when the all Windows services and drivers are loaded.

I would address these issues above ASAP and if the overutilisation of the CPU continues we'll look again.

 

[Mark F]

Ubuysa, thanks for the replies.

I'm not sure when the issue started, it could have been going on for weeks without me noticing, I only noticed it a few days ago.

Not sure when I updated to 24H2 to be honest. I'd call myself a consumer, so update occasionally as and when I notice somethings there.

Regarding the drivers and dongle, off the top of my head I have no idea what they are, I'll investigate.

I've only done virus checking using Windows Defender, Full Scan and Offline Scan, I'll look into using another tool.

I'm not around much over the next few weeks and the PC is sort of working enough for me to do day to day stuff so it'll be a while before I get back to you again.

I'm doing frequent backups of my data just in case!

Thanks again.

 

[SpyderTracks]

've only done virus checking using Windows Defender, Full Scan and Offline Scan, I'll look into using another tool.

I would suggest MalwareBytes Free, other live scanners will clutter the system, cancel the trial, just run the free on demand scanner, do a custom scan and include rootkits and all attached drives

Official Site | Malwarebytes: Antivirus, Anti-Malware & Privacy

Malwarebytes offers real-time antivirus, advanced anti-malware and privacy protection for all your devices. Launched in 2004 as a free virus scan, we still offer a free basic version 20 years later. Learn more.

www.malwarebytes.com

Malwarebytes is industry recognised.

 

[ubuysa]

I would get those drivers uninstalled, especially if you don't know why they're there....

 

[Mark F]

Thanks both.
Is there an easy way of finding what/where a driver is used other than manually going through every device using device manager?

 

[SpyderTracks]

Thanks both.
Is there an easy way of finding what/where a driver is used other than manually going through every device using device manager?

they may be hidden devices in which case first try the following in device manager

Viewing Hidden Devices - Windows drivers

Viewing hidden devices

learn.microsoft.com

Was gonna let @ubuysa advise on that, but there is a way to identify what branch the driver is on within device manager, but I still find device manager tricky to navigate at the best of times

Found this on GitHub, GitHub is Microsofts code repository for OpenSource projects, it's scanned for suspicious code on any change or upload, and it's also 3rd party verified by the regulars on there. Check this particular project, it's still well supported (just updated in December)

From there should make it easier to identify these 2 drivers and you can also uninstall them from there as well.

GitHub - lostindark/DriverStoreExplorer: Driver Store Explorer [RAPR]

Driver Store Explorer [RAPR]. Contribute to lostindark/DriverStoreExplorer development by creating an account on GitHub.

github.com

 

[ubuysa]

Thanks both.
Is there an easy way of finding what/where a driver is used other than manually going through every device using device manager?

Open an elevated command prompt and enter the following command...

dism /Online /get-drivers /format:table > C:\temp\drivers.txt

In your Temp folder on the system drive there will be a file called drivers.txt, upload that text file to here (or copy and paste it).

 

[Mark F]

I was a bit reluctant to 'delete' the drivers. It's many years since I've 'fiddled' with PCs, when I was working our corporate build laptops just worked, this home PC has worked fine from new (5 years ago) up until very recently. Anyway, doing a bit of searching I came across AutoRuns which I had used way back but had forgotten about. I used AutoRuns to disable drivers...

Disabled DDCDrv.sys, restart, no change.
Disabled aksdf.sys and aksfridge.sys, restart, got an improvement! When PC is idle System task CPU is around 17%, there is now only 1 thread named ntoskrnl.exe!RtlNumberOfSetBitsEx+0x680 running about 13%.

I ran MalwareBytes, nothing found.

Drivers.text file attached as screen snip png, doesn't allow upload of txt files. I did try pasting the text in this message but it all ended up too many characters.

In Device Manager I have an unknown device with a yellow ! No idea if this is relevant to current issue or how long it has been there (ordinarily I've no need to look in Device Manager). Device Instance Path = ROOT\VMS_VSMP\0000, Hardware ID = vms_vsmp. A bit of searching seems it relates to a virtual machine, not something I deliberately do or know about.

 

[ubuysa]

I'd have preferred the drivers to be uninstalled rather than deleted. The way to do that is to uninstall the product that delivered them.

I was going to suggest navigating to C:\Windiows\System32\Drivers and locating these drivers in there. Then rename them to change the ,sys suffix to .old. This will stop them being loaded, because they're no longer recognised as drivers, but will preserve them in case you really do need them. A reboot will ensure that these drivers are no longer loaded.

There are three other drivers in that list above related to the same product...

• akshasp.sys
• akshhl.sys
• aksusb.sys

You should rename or uninstall these too. The fact that removing the other two caused an improvement suggests that removing these three might eliminate the problem altogether.

These drivers are associated with a company called SafeNet Inc but they have changed hands many times and are now owner by the French Thales Group. SafeNet Inc was a data security company producing authentication, encryption, and key management solutions. The list above shows those three drivers are being USB related, so I wonder whether the SafeNet Inc product you have is some sort of dongle authentication key? If that's enough information to help you discover what product you installed that included these SafeNet Inc drivers then I would now uninstall it.

 

[Mark F]

@ubuysa , thank you.
I noticed after I'd posted the update this morning that in AutoRuns the aksdf and aksfridge Publisher was Sentinel Inc, also there was another Sentinel Inc driver named hardlock.sys. A bit of gooling showed hardlock was also something to do with security dongles or some such. I don't use such a thing, have no Sentinel software on the PC and cannot recall ever having such (so I can't uninstall it).

I disabled hardlock.sys in AutoRuns, restarted, problem has gone away. System cpu when idle is normal 0.1-0.2%.

I've launched all my apps. Plugged in some devices that are not permanently attached (x-rite monitor calibrator, wacom tablet, some external usb hdd's that use bitlocker for backups). No issues found.

In C:\Windows\System32\Drivers I have renamed aksdf, aksfridge and hardlock from sys to old.

I cannot find akshasp, akshhl or aksusb in C:\Windows\System32\Drivers, doing a search for the under C:\Windows I've found them in the DriverStore\FileRepository as in this example for akshasp.sys
C:\Windows\System32\DriverStore\FileRepository\akshasp.inf_amd64_603e7bc8bb5ae113

Do I need to rename these, or are they 'out of the way'?

Thanks again.

 

[Mark F]

This PC was built by PC Specialist and despatched 16/12/2019. I have found under C:\Program Files (x86)\Common Files, folders for Aladdin Shared\HASP and SafeNet Sentinel, the folders both have creation date of 20/12/1019. So this stuff was either part of the build or something I did in the first day or 2 of having the machine (and since forgotten about!).

 

[ubuysa]

I would suggest you phone PCS and ask them whether those are products that they installed. If they are, then I'd ask them why and explain that the aged drivers have been causing you problems and ask them how best to remove them.

It's possible that these products were installed along with some other software you installed in the first day or so, something that possibly required an authentication dongle? Perhaps you decided not to continue with the product and these got left behind? In that case you'll need to remove them, here's how to do that...

1. First open an elevated command prompt or PowerShell session.
   
   
2. We now need the OEM number of each driver, this can be obtained from the list you posted in post #13...
   

       akshasp.sys   oem13
       akshhl.sys    oem58
       aksusb.sys    oem68

   
   
3. Enter the following command...
   

   pnputil /delete-driver oem13.inf /uninstall /force

   ...to remove the akshasp.sys driver.
   
   
4. Now repeat that command using oem58 and oem68, one at a time, to remove the other two drivers.

You then need to keep a very close eye on your system to detect whether or not these missing drivers are causing problems.