csrss.exe

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

I found the culprit, thought I would post a follow up.

I got Security Task Manager and it listed a lot of "soundfix.exe" and a thing called something like SynthCore R2.0 Midi Interface. I also had a few lines of gibberish in my startup list. I couldn't take out the gibberish because it came back and the soundfix.exe's because they weren't where the said they were (in fact I had no soundfix.exe on my computer at all). However the whole thing collapsed when I quarantined the SynthCore, the soundfix.exe's disappeared (except one which I could now quartine and delete) and the gibberish now stays gone when removed from my startup list. System performance is back to normal.

I found only a single refrence to this thing on Google and it was listed in a HiJackThis report from someone who had unrelated problem with a browser hi-jacker. I am the first to notice and remove this thing or does it normally go by another name? No autmatic scanner was able to find any trace of it and it seems rather sophisticated since it doesn't show up at all in processes but somehow make it look like csrss.exe is using that CPU output (the CPU output listed for csrss.exe in Security Task Manager was much lower than what Windows said). I am not looking for bragging rights since the credit goes to the STM program but if this is a new virus/trojan/spyware people should be aware of it's existance.

I just installed XP service pack 2 and now the hourglass icon is running almost constantly. CPU utilization of csrss.exe runs from 33 to over 50. The hour glass will stop briefly but resume for long periods of time. Is this a known service pack 2 related issue or is their another possible cause? Is there a fix?

I doubt it has anything to do with SP2, probably coindidence. It actually sounds a lot like what I had, especially if your total CPU usage is at 100%. Read my post above to see how I took care of things. Even if you have something different I highly recommend Security Task Manager, it can deal with things most spyware and virus scanners can't. Be careful though since it is manual and you could screw something up.

service pack 2 is a cpu hog, dont listen to casey. uninstall sp2 you will be happy again. who wants microsoft to have complete control?

Well, excuse me I was only trying to be helpful. I have SP2 and it didn't do anything like what you said. In fact I downloaded it trying to fix the problem I discussed above (well it didn't help anything either but whatever). I suggested what worked for me because it worked for me and Security Task Manager IS a good program, there's no need to be rude.

SP2 Sucks and does nothing but mess up systems. They spit that SP out to quick. Yes, XP has been around for a while but they didnt start working on SP2 until all this spyware bull shit started hitting as hard as it did. I recommend you all to look into AdAware and Hi-Jack This. Hi-Jack this is sweet because it lets you edit the registry no matter how computer stupid you are. All you have to know is how to tell what is what and if you dont know there is sites out there that will. I however know what is in my system, When I do get on it anyway. Im having to clean this damn computer everytime someone else gets on it. Did you all know Most Spyware is picked up from Porn Sites? Damn perverts! I think Im just going to lock everyone down so that they cant install jack shit and that will take care of it. Also if you want to help keep most spyware off your system, Set up a Limited Account and you wont be able to install nothing. Yes it could be a pain having to log out and back in to the Admin
Mike

So, all this talk and the question I have is: How do you keep CSRSS.EXE from getting on the task manager?

You don't. It's supposed to be running.

CSRSS.EXE is a system file, but there's also a virus which uses the same name. My brothers PC had it and it does exactly what you described.

Here's the details including how to get rid of it:

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BUCHON.B&VSect=T

Stu

to whom it may concern take a good look in your system information and see what is really going on with microsoft too many process not set up corectly on my pc any way ? Software enviorment csrss Path not available ? real strange gives you a process ID? then min workin, and max woking both state not available again sent up some red flags to me contacted Microsoft still no answer and this is a Dell Pc less than 2 yrs old . then gives you version and so on lot of these process are not available or dont have a path ? me personally dont give a flyin rats patutty how ever the cost of these products and the time involved to find and figure out is not worth the time or trouble having told Microsoft many times get on the ball and step up to the plate instead of putting a product out there thats CRAP have a nice day and happy fixin Al Microsoft and Bill Gates should be Ashamed of putting a product out at the consumers expense ! Shame on you !

To post a comment on "csrss.exe", please return to that article's main page.