Comments for csrss.exe

Comment from triad on 2009-08-30

2009-08-30T07:38:46Z

I've seen this virus/worm/malware... I've infected my gf's anti-virus-less internet-less computer by accidentally clicking a file that looks like a folder. I searched the registry but I couldn't find the source...

I went to this website for advice and I figured out how this virus works...

1. It creates a file csrss.exe in Documents and Settings folder
2. The main executable and registry file are located at Program Files\microsoft frontpage
3. Just like any other malware, it creates duplicates on USB flash drives with autorun.inf

I think it creates a registry entry in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer and creates a subdirectory "run". You can find the directory path of the virus through there so you can delete it manually. Delete the whole "Run" subdirectory
Correct me if i'm wrong.

Make sure before attempting to delete the malware, start your computer in safe mode (Press F8 after the BIOS but before Windows loads)

I'd think the creator of this malware is very crafty that he wants the virus not to be detected even by experienced computer users. He didn't put those in the commonly used HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run as this would be too obvious for experienced users

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from silent on 2009-03-31

2009-04-01T04:44:34Z

hi!

to remove RP09.exe

1. run command prompt
2. type cd\
3. type ATTRIB -H -S -R /S /D..it would few minutes if your drive have many files and folders..
4. manually delete autorun.inf, syste~1, niaw folder.. just type "del autorun.inf" etc...

5. run regedit.exe using command prompt or RUN command.
6. Press Ctrl + F.
7. Find syste~1\_resto~1\RP09.exe
8. delete it.
6.

thats it..

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Power on 2009-03-11

2009-03-11T22:28:35Z

Looking at another page I found the help I needed, and I post it here so that it might help someone else. I updated the graphics. As simple as that. All problems gone!

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Power on 2009-03-10

2009-03-10T10:45:36Z

So, I have a huge problem with csrss.exe eating my CPU up to 99%, and I don't have the virus, I only have csrss.exe in the right place (SYSTEM). I started a new profile on my computer and intended to erase the previous one to check if that could help, but before I had the chance to do this, csrss.exe took over the new profile too, which is why I sincerely doubt it will do any good to erase the first profile. I also installed a "hotfix" that would fix a problem with csrss.exe that starts when right-clicking something, when I was unsure that it might be the problem (since the description of my problem was exactly the same: 100% CPU). HEEELP! :-/ Thanx!

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from sge on 2009-03-07

2009-03-07T13:54:58Z

I have a pop up window on my desktop: Windos - No Disk Exception Processing Messag c0000013 Parametes 75b6bf9c 4 75b6bf9c 75b6bf9c. Could this be a problem with the crss.exe file?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Dwight Rimmelzwaan on 2009-02-20

2009-02-20T08:07:50Z

csrss.exe is not always a virus... it can be normal to have it running multiple times. if your not sure open up do this

1. hit windows key+r
2. type in cmd
3. hit enter
4. type in tasklist
5. find and write down the PID of both processes
6. now type in tasklist /v
7. find both csrss.exe and see who authorised it. If it is a virus one of the two is not authorised by "NT AUTHORITY\SYSTEM"
8. remember the PID of the virus and type in tasklist /fi "pid eq (your virus pid)"
9. Now you should see just one process. remember the mem usage (at me 4.652 K) and hit ctrl+shift+esc
10. find your virus and kill the processnow find it and delete it :D

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from JB on 2009-02-16

2009-02-17T06:59:34Z

csrss.exe is a windows program. But when you see two csrss.exe in your task manager, it could be a virus. Avast anti-virus can remove this virus.

Manually delete:
1. Boot in Safe Mode, this limits the program that are running in the background.
2. Goto Start - run, then type MSCONFIG.
3. Goto Startup, then find and uncheck any RP09.exe or csrss.exe that you will see. Don't be afraid of csrss.exe. The original csrss.exe of windows is loaded in different location.
4. Right click "My Computer", then select explore.
5. Click "C:" from the left pane. Then delete "autorun.inf", "ñiäw" folder and an exe file with a filename of your computer name and an icon of folder. ex. if your computer name is andrew, delete the file "andrew.exe".
6. Delete also "RP09.exe" from the following directory:
C:\program files\Microsoft Frontpage\ (as well as the reg file).
C:\Documents and Settings.
C:\System Volume Information.
7. restart you computer...

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from docdoom16 on 2009-02-12

2009-02-13T02:38:53Z

there are 2 other csrss.exe that can be found on your computer once you are infected by this virus. One is on C:\Documents and Settings\user\csrss.exe and the other is on C:\Program files\Microsoft Fronpage\csrss.exe and together with is is a .reg file (18something) and a time.dat. These too are also products of the virus

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Cyberwolf on 2009-02-08

2009-02-09T01:59:21Z

For CODE_RYAN

Just an Info, I have encountered this RP09.EXE, if they said its not a virus then what's inside "ñiäw", there you could also find a copy of RP09.EXE as well as indside the "system volume information" folder.

I you think you're in doubt then try opening your registry "type REGEDIT inside START->RUN" then press F3-find then type "RP09", I know it will find one, under MOUNTPOINTS2 where WORMS usually imprint their AUTORUN.INF instructions.

Be carefull in choosing a drive then using the RIGHT CLICK bcoz EXPLORE, OPEN, AUTOPLAY are already their trigger in spreading.

As of Now, Im doing it manually since I've got nothing, no available anti virus online for now. WE ARE ON OUR OWN, unless any of you guys got some AV for this, please....

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from code_ryan on 2009-02-02

2009-02-03T02:24:23Z

Hello Leo/
do you know how to delete the RP09.exe? is this a virus? I think it is connected to csrss.exe. I have two (2) csrss.exe processing in my TaskManager is this normal? Do you know how to remove "ñiäw", i believe this is some kind of a virus. Tnx...hope U can HELP.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from tony on 2008-12-22

2008-12-22T13:30:16Z

I'm afraid I have deleted csrss system file, and everytime that I try to put on the pc the screen turns black and I just can't do nothing. I've also tried to boot in safe mode but the same thing hapened.

HELP PLEASE
(soz for the english)

You'll need to try a repair-install of Windows.

- Leo
22-Dec-2008

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Yoda on 2008-11-27

2008-11-27T12:59:28Z

Problem: My computer is performing slow. Long periods of time to respond to a mouse selection. The PC does behave similarly when I am getting a "Live Update" from Symantec.

In this case (today) I note that whilst in task manager the csrss.exe is getting frequent cpu hits. Firefox and Outlook Express were running but I had not invoked anything for at least an hour.

Analysis ??

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Chauncey D Broadnax on 2008-09-24

2008-09-25T06:07:35Z

I am getting error message csrss.exe- can not find. How do I sto it?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Reagan on 2008-09-14

2008-09-14T09:07:56Z

Hi Sir,
I'm also having a problem with csrss.exe, I've read an article on how to resolve the error. So I installed HiJackthis and follow the instruction, and restarted my PC. The error was resolved but I cannot access my msdos. Everytime I run cmd, my computer shuts down. Pls help... thanks...

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Dashiella on 2008-08-03

2008-08-03T18:56:49Z

My Anti Virus show me:Windows\media\csrss can be vb Torjan.
well, I in mistake delete it. Now I receve "can ot find..."
Where can I add csrss.exe?
Thanks

Run the system file checker.

-Leo

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Dashiella on 2008-08-02

2008-08-02T20:28:15Z

My Anty Virus show me:Windows\media\csrss can be vb Torjan.
What may I do, delete or not? or download from somewhere csrss?
Thanks

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2008-07-08

2008-07-08T18:42:11Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CSRSS.EXE may not be a worm - it's a part of Windows and is
on every machine. You DEFINITELY do NOT want to remove this
part of Windows.
http://ask-leo.com/csrssexe.html

Leo

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFIc7TzCMEe9B/8oqERAjVsAJ9sVb4MREBVyRB0VurzypNix/A7agCcDaYo
+qRMfGDU32ALW1SXqDPfq6I=
=gsLT
-----END PGP SIGNATURE-----

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Daniel on 2008-04-14

2008-04-14T10:31:07Z

"Hey, im also having an error message showing on pc start up (C:\WINDOWS\media\csrss.exe) error, it says that it cannot read or locate the source?
Can someone let me know what to do, email me if you like ... thanks
Posted by: MUNZ at April 7, 2008 03:12 PM"

Do you have ZoneAlarm? I had the same error message and fixed it by allowing the program to run in ZoneAlarm > Program Control > Add > C:/WINDOWS/Media/Csrss.exe

Hope that helps.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from MUNZ on 2008-04-07

2008-04-07T22:12:32Z

Hey, im also having an error message showing on pc start up (C:\WINDOWS\media\csrss.exe) error, it says that it cannot read or locate the source?
Can someone let me know what to do, email me if you like ... thanks

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from JayzBat on 2008-03-25

2008-03-25T14:51:44Z

Can you help me, i need to know how to hide csrss.exe process on task manager, please reply to my email,

Thank You.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo A. Notenboom on 2007-12-31

2007-12-31T18:40:41Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm a little confused. Quoting the article that you
indicated you read by submitting a comment:

"It's the Windows Client Server Runtime SubSystem. A
expensive name for what is a core part of Windows itself."

It's a part of Windows. Is that not clear?

Leo

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFHeTexCMEe9B/8oqERAndTAJ9B6pd5AWMF4iwkPqtLveW4hi4z6wCeKHHy
zPieHOepyRSRGfyqia13WZk=
=EAF+
-----END PGP SIGNATURE-----

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Teresa on 2007-12-28

2007-12-29T01:22:34Z

I'm a bit confused on this Csrss.exe,is it a virus or trojan?It's in my task manger,Processes,using lots of memory 3,804 K,is this ok or what do i need to do?Using windows vista home premium.
Thank you Teresa

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Rob on 2007-03-17

2007-03-17T16:08:42Z

I have recently been noticing I have 3 processes called csrss.exe under username for one it says SYSTEM and for the other two it says my windows account name. Im not sure whats going on here.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Diane on 2007-03-13

2007-03-14T01:12:14Z

After reading the previous comments about the no disk problem, I thought I would try unmapping a drive I had allocated to device 'B'. By gosh, then it let me cancel the message instead of repeating over and over. Seems like drive letters above C: may also cause the problem.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from kenneth on 2007-03-08

2007-03-08T19:08:53Z

hi i have a probelm that everytime i log it comes this error WINDOWS.EXE-NO DISK.WHEN I GO TO TASK MANAGER and try to see what it is it goes on csrss.exe can you help please
thanks

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Pro on 2007-02-16

2007-02-16T08:05:41Z

There is free program named ThriceSoft Processnik. It shows info about runing processes, info about programs
whose starts with windows and more. You should try it out. http://files.myopera.com/edijus/blog/Processnikv1.8.rar
or visit homepage http://www.thricesoft.com/ By the way, Processnik doesnt reques to be installed. That's why I like it!

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Richard on 2007-01-05

2007-01-06T06:07:51Z

When my PC boots, I get a Windows - no disk error message (retry, cancel, continue - cancel is the only thing that works). Task manager associates it cssrss.exe as the appropriate process. How can I make this go away?
My csrss.exe is ok i keep getting this message. It started when i installed Norton from a floppy then i removed the disk before i closed the Norton program and shut my computer down. Please Help.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Ankush Narula on 2006-08-16

2006-08-16T20:28:53Z

I began experiencing the heavy CPU utilization problem after not having logged into my office computer for 10 days. I tried all the various suggestions (without deleting my profile or reinstalling XP) to no avail. I then killed every system tray application one at a time and discovered that the Google Desktop was the culprit.

My GDS install is setup to index several large file server shares on my network. I am assuming that because I logout before going home every night, it is unable to perform this indexing overnight since GDS (a system tray app) is no longer running. Since I was away for over a week, I think that after I logged in, it had begun catching up by performing large indexing operations. I validated this by leaving myself logged in overnight with GDS running. Today I've noticed no lengthy CPU utilizations by CSRSS.exe.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2006-04-06

2006-04-06T20:14:41Z

If you've spelled it properly (cssrss, not csrss) then you most likely have a virus and need to run up-to-date virus and spyware scans.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Tom on 2006-04-06

2006-04-06T19:23:01Z

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2006-03-25

2006-03-25T17:39:52Z

Have you turned off the Windows Messenger Service? This article shows how: http://ask-leo.com/what_windows_services_can_i_turn_off.html

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Storm on 2006-03-25

2006-03-25T16:05:47Z

Can anybody help me.

I've been receiving these weird popups in windows telling me to install some (random) registry fixer because I allegedly have some errors in my registry. traced the source of those popups and it seemed as though csrss.exe was what creates it. And thus I concluded it being a virus but since it's a Windows essential part, I could not have deleted it. I tried reformatting my C: and reinstalling XP but I still receive the same message(s). Starting to believe my Windows XP cd got proper ******

Help

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from jonathan on 2006-03-09

2006-03-09T20:37:33Z

Okay, I get that csrss.exe is essential. I have checked and there appears to be no virus.

So, why does this piece of code continually do I/O's to the hard drive when there is otherwise nothing going on? In point of fact, it does more reads than all other applications combined.

What gives?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from ED on 2006-02-18

2006-02-18T12:52:13Z

I have this csrss.exe thing on both my pc, it has disabled norton 05 security and i have spent hours trying to remove it. Webroot managed to find it, Spybot detects some "FakeMSNbeta" but neither are able to truly remove it. I believe my pc is still at risk and still infected. I dare not use messenger incase i infect people on my contacts list. I am not able to un- then re-install Norton, access to many sites offering advice on this infection appears blocked.
I haven't got a clue what to do and i'm worried about the safety/health of my pc.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Tracie on 2006-02-11

2006-02-11T22:27:53Z

Hi. I have that same bad red devil face and cannot find what I need to remove it. Can anyone help?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Jimmy on 2006-01-24

2006-01-24T21:56:23Z

I have been going crazy trying to find if this is real or a flase postive,I have downloaded every virus software program on the internet shareware and freeware(all)spyware removers(all) and nobody can find it except,Remove it!Pro,but usually is back in 20 minutes or on reboot after I clean it,I have ran this scan called a-squared HiJackFree Analysis and this is what is said:

VStatus Filename Path Description (green happy face)
csrss.exe %systempath%\ csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem. This process manages most graphical commands in Windows.

BAD Red Devil Face!
csrss.exe %winpath%\ This worm is transmitted via e-mail and attempts to install itself on your computer:

PLease can anybody help me? I have shut down every service that is not needed but this is alway's showing up over and over and it does have an effect on my task manager,shut's it off! When it feels like it.

So is this a-squared HiJackFree Analysis true? Or something that could get in?,but it seems to be in my computer just can't find it! tried everything safemode also I can not remove it.

And so far nobody can help, I hope this is the place because I am out of ideas,thank you in advance for any info.I have tried evething on the internet and nothing can get rid of csrss.exe %winpath%.Thanks

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2006-01-21

2006-01-21T17:34:32Z

I would first run an up-to-date anti=virus and anti-spyware scan, as this symptom is often caused by one or the other.

If that doesn't fix it, then I'd start looking at my startup-programs and remove references to csrss.new.exe. This article may help that process: http://ask-leo.com/whats_all_this_stuff_running_after_i_boot_windows.html

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Sophie on 2006-01-20

2006-01-20T18:00:48Z

I get a window that says "csrss.new.exe file is missing" 4 times when i start windows. Is there anyway I can get rid of this?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo A. Notenboom on 2006-01-17

2006-01-17T19:43:17Z

Because it's in that oddly named subdirectory (pvxprkh) it's more likely that this is a virus, and you should run both up-to-date anti-virus and anti-spyware scans.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Megan on 2006-01-16

2006-01-17T07:59:31Z

When I start up my computer, I get an error message that says the attempt to load the file C:\WINDOWS\system32\pvxprkh\csrss.exe failed, and to attempt to find the file or fix the registry. I've found the file references in the registry, but should I delete them? There's only two, with the titles load and run.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from coffeelover on 2005-12-27

2005-12-27T21:47:43Z

If csrss.exe is running from \Windows\System32 it is probably fine. Run a virus scan, such as the free AVG Anti Virus (www.grisoft.com).

If it's running from another directory, e.g. \Program Files\Block Checker reboot into safe mode, then delete the file. csrss.exe is a Microsoft required process but is also used as a mask for Block Checker etc.

James, the thing you're describing sounds similar to Microsoft (Windows) Update. Go to windowsupdate.microsoft.com and run the scan - see if it identifies the same/similar number of 'Critical Updates' and install them from there just to be sure.

You can right click on My Computer and check Properties, then the Automatic Updates tab to see if it's switched on or off. You may prefer to switch it off and check the MS Update site manually.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-12-21

2005-12-22T06:03:29Z

No. You probably just need to turn off the messenger service. This article includes the instructions how: http://ask-leo.com/whats_the_difference_between_msn_messenger_windows_messenger_and_windows_messenger.html

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from James on 2005-12-21

2005-12-22T00:38:55Z

"i keep getting this box that pops up saying that i need to download stuff to fix things with my windows when i pull up task manager and check this annoying little box out it says that it is a csrss.exe file i don't want to download theese things and this has never happened before what is it a virus or is it for real please help as i am considering taking a hammer to my computer"

i get that also, its says that there is 36 or 39 critical objects on my computer, and automatically I knew it was fake because i dont think Microsoft would refer to another company. and I also get another one saying something else. i went to task manager and followed the alert to the source and it was csrss.exe ... would it be ok if i deleted it if the annoying program WAS from csrss?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from KETAN on 2005-12-18

2005-12-19T07:23:15Z

i have almost 7 instances of SVCHOST running in my task manager at the same time.. and also SERVICES.EXE and SERVICE~1.EXE.

Also at times my mouse poinetr starts moveing by itself. I have scanned for spyware/ adware / viruses.. and my system is perfectly clean..

Please tell me if my system is alrite or not..

Would appreciate you people's co-operation.

Ketan.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-12-07

2005-12-08T06:56:02Z

Sounds like messemger *service* spam. Check out this article: http://ask-leo.com/whats_the_difference_between_msn_messenger_windows_messenger_and_windows_messenger.html - in includes instructions about 2/3rds the way down to turn off the Windows Messenger *Service* that may be allowing these popups.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from scott on 2005-12-01

2005-12-01T08:39:30Z

i keep getting this box that pops up saying that i need to download stuff to fix things with my windows when i pull up task manager and check this annoying little box out it says that it is a csrss.exe file i don't want to download theese things and this has never happened before what is it a virus or is it for real please help as i am considering taking a hammer to my computer

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leya on 2005-11-26

2005-11-26T22:32:11Z

I'm getting an error message saying that the csrss file is blocked by firewall and needs to be unblocke so I can connect to the internet. How do I fix it. It's not even letting me stay on long enough to reply to emails and it's getting annoying. :(

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from mike on 2005-11-20

2005-11-21T02:22:11Z

this program isnt ALWAYS a virus but it is an essential part of windows.. i pulled the following information from another site.

File: csrss.exe

Security Rating:
This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment.

Note: The csrss.exe file is located in the c:\windows\System32 folder. In other cases, csrss.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-11-15

2005-11-16T04:36:16Z

Yes, deleting csrss is a problem. You'll need to attempt a repair install of Windows.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Martin on 2005-11-15

2005-11-15T20:53:01Z

hi, i also had problem with csrss.exe, so i just deleted it, was this wrong? and if so, what should i do now?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Jessica on 2005-11-12

2005-11-13T02:23:27Z

MMkay well, I downloaded this block-checker thing for msn messenger and stuff and it screwed up my computer really bad. Immediately I deleted the program but it was still advertising this block-checker to my friends on msn. after downloading numerous programs to wash the phony csrss.exe virus away, when i turn the computer on there's like 5 pop ups all saying that the path cannot be found for csrss.exe. I think i might've accidently deleted the important file! How do i get it back?!?!?!

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Axel on 2005-11-08

2005-11-08T21:58:04Z

Yes, I've got exactly the same problem as Jermuny and my laptop also is a lot slower than before and there's no viruses on my computer (got it checked by Norton and Antivir).

What can I do? That gets on my nerves!

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Jermuny on 2005-10-28

2005-10-28T18:37:53Z

Rescently I was on MSN messanger (Yea, I know) and my buddy sent me a picture of his house or so it said, so naturally I clicked on it and waddaya know, my popup blocker sends me an alert but the download verification didn't bother to pop up, then I have an error message saying some critical files were replaced in my system and it was requesting my CD. Naturally I cleaned up my log files and scanned useing Ewido, AVG, SpybotS+D, and even AdAware. Surprisingly, Ewido was the only one to come up with any results. 9 results all "destroyed and replaced". Since then when I log in my computer sends me several errors that csrss.exe isn't running or doesn't exist on my computer. Yet it's still in the task manager? What am I dealing with here?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Jennifer on 2005-10-27

2005-10-27T19:44:46Z

Hi all,

My pc is also infected with the csrss.exe worm. I noticed it when a friend supposedly sent me a link asking me if the link was me. I clicked on it (it was tied to a hotmail account I don't use, other than for windows messenger) and something weird happened and now I am no longer able to sign into ANY of my email accounts. This included gmail, hotmail, and comcast. I also am unable to use messenger. The error message I receive while in IE is "This page cannot be displayed" and in firefox, I get "Connection refused by www.____.com" in an error box. It disabled all my firewall and antivirus settings (but did not touch my spysweeper) and I cannot delete it from my registry. I booted in safe mode, tried to do it then, and still to no avail. I really REALLY do not want to reinstall windows, as I just had it done not two months ago. Is there anything at all that I can do to get rid of this stupid thing?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Bob on 2005-10-10

2005-10-10T22:52:48Z

I think my computer is infected with the csrss.exe worm. I ran a couple of virus scans, which found it but couldn't delete it. It is making some programs not run correctly, and after the computer has been on for about 15 mins, the internet cuts out and i have to restart. I have no idea what to do

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Walter Kemp on 2005-10-10

2005-10-10T16:28:58Z

When I first boot up my computer (Windows XP home version) I get a "No Disk Windows" popup and it wants to "cancel, try again, or continue". After several "cancel" it goes away until the next boot up. Task manager tells me that it is coming from CSRSS.EXE. I have noticed that when "cancel(ing)" that it is stepping thru a process (McAfee Security system) once I get past the McAfee setup usually the next "cancel" clears it. Can any help me resolve this headache?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-10-03

2005-10-03T16:32:27Z

I'd run the system file checker: http://ask-leo.com/what_is_the_system_file_checker_and_how_do_i_run_it.html

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from jd on 2005-10-03

2005-10-03T08:46:28Z

I keep getting after login csrss.exe error path/file access error.
After clicking ok, it disappears, there are no virus's or spyware on my pc.
how can I reinstall this and is there a problem?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Shahab on 2005-10-02

2005-10-02T19:11:45Z

Hi
can any1 tell me wat csrssrs.exe do....my sys got slower then i checkes in task manager-->there i saw csrssrs.exe is using 70-80% of CPU usage.i cant able to delete it also my sys got very much slower...can any1 tell me how to cope up with tat

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Skinner on 2005-08-31

2005-08-31T12:35:27Z

I have a process also running in the background that is most obviously a trojan. I got it from my MSN messenger becausei accepted a file from someone i trusted. Well now it opens up conversations from my contact list and trys to send them links to more viruses ever five minutes or so. Its located in C Windows System32 Pekslr cssrs.exe Its running in my user processes but says i cant end it because its a system process. I have used just about every anti spyware anti virus program i can think of and have access to. I have tried deleting it from my registry and more. I have about 5 programs to end and manage task and processes. None of them can touch this thing. What should i do?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from John on 2005-08-29

2005-08-30T03:58:58Z

csrss.exe has been running my hard drive up & down for about 1 hour now. I installed Security Task Manager & it reads all the other Tasks but not this one that is using about 20% of my resources.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from steviebobs on 2005-08-16

2005-08-16T13:23:05Z

HI all

I also seem to have been hit by some hideous virus/trojan whatever. It changed my web homepage setting, but also changed the url of any security sites I type in(by adding its own extra characters) rendering them unreachable. I ran several virus checkers like AVG and that identified a Backdoor virus and 'cured' it, but I still get a reference to csrss.exe on start-up, something to do with the the registry looking for some files that, I think AVG ditched. I also still get the url corruption. Is there a genius out there?

Regards

Steviebobs

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-07-23

2005-07-24T01:56:12Z

What you're seeing are popups delivered through the WIndows Messenger Service. It's easily turned off. This article has quick instructions: http://ask-leo.com/whats_the_difference_between_msn_messenger_windows_messenger_and_windows_messenger.html

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from The Founder on 2005-07-23

2005-07-24T01:38:56Z

I just got myself a laptop from my dad's workplace... and as I'm browsing I get hit by these seemingly 'official' warning pop ups sayin things like "Message from SYSTEM to ERROR at Windows has detected 47 critical errors."

Ok, I can buy that... but then my computer, having apparently achieved a miracules state of self awareness and gone through the internet on my behalf for solutions, actually OFFERS me website addresses from where I can update patches and changes to fix the various errors it has alerted me to.

Naturally this gets my suspicious juices flowing, but then to seal the deal I get messages from wonderful ladies such as Carla and Moni offering to go to their webcam websites for them to make me 'cum'. Naturally I declined.

Both pop ups, the error ones and the sexy ones are the same in design and all (according to the task manager) are from the CSRSS.EXE module that for some reason I am unable to shut down because "Access is denied"? Due to it being a critical system componant or something.

There is a spyware scanner in this compy but it's not a brilliant one, I'm gonna run off and get myself spybot, AVG... Norton or something, once I have scanned I will tell you how it went.

In the mean time if anyone can offer any advice as to what is goin on here? I find it unsettling when my own computer says access is denied after first offering my oral webcam sex. Get my drift?

The Founder

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-07-17

2005-07-17T21:29:13Z

win32k.sys is part of Windows, so if it's showing up as part of the problem, it's probably a symptom of something else. Make sure your anti-virus scans and database are up to date, and also make sure you're doing an anti-spyware scan.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Shawn on 2005-07-16

2005-07-17T01:17:01Z

I 2 have this csrss.exe and would like to know what it does. I recently got dun over by a very bad virus and got sick of the free virus stop programs, so I got a propper one now and all is good. I now have process explorer and that lets me see what is going on, thats where you will be able 2 see csrss.exe(if there)double click on it then at the top click on threads, once done you will see some numbers jump'n around. You have the option 2 kill what ever======TAKE REAL GOOD CARE DON'T GO AROUND AND JUST KILL EVERYTHING THING YOU THINK IS BAD========Once you have valid infomation about a program you may then proceed 2 kill it,but only the highist number, its alot safer that way. This method to kill csrss.exe will not be permanant, this will have to be done everytime you startup, when you click on threads you should see 'win32k.sys' this should be doing the most work. I just did a google search on this win32k.sys and alot of other people are hav'n problems with it and related. So just like everyone else I 2 am confussed, I recently have noticed that my desktop is a bit slower at the moment, desktop properties takes while to open. I'm wondering if 'win32k.sys' is causing this, my PC still performs very well and have no problems with video, audio and anything else, just sometimes slow opening. If you have any help or advice it would be a great help. CheerS

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-06-18

2005-06-18T21:52:09Z

It sounds like a classic case of spyware alright. You want this article: http://ask-leo.com/spyware_how_do_i_remove_and_avoid_spyware.html

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Eugene on 2005-06-18

2005-06-18T15:31:02Z

Okay the just a comment about MS (MicroSux).
They have just gone in the right direction the wrong way.
It (XP) isn't a bad operating system, however some aspects could do with some serious work.
Another issue with XP is that there have been something like 97 essential updates to my version of it (SP2 original version) and that seams like an awful lot 2 me considering the time that SP2 was purchased by myself.

Anyway I have a completely different problem and any help would be appreciated.

I like to use google.com as my search engine and a few weeks ago something went very wrong, I was attacked by some spyware/adware or the like that sends any search I do at google only (yahoo is fine) to sex sites and refuses to load anything at all to do with google itself.
i.e. clicking a link sends me directly to the search of sex sites.
If I hover over a link (google one) I get http://www.google.com.au/about.html appear as http://www.google.com.au/search.php# in the status bar in the bottom left of internet explorer.

?????????????????

If you can help me email [email address removed] and let me know. Maybe I can get you a GMail account for free for helping solve my problem.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from yolitzen on 2005-05-15

2005-05-16T00:16:13Z

the internet disconect every 5 minutes or so and it says that there is a problem with my firewall or antivirus that it is blocking the csrss.exe and that i need to make sure csrss.exe is can connect to the internet. How can I do that? i have no idea. Please help me

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from p on 2005-04-13

2005-04-13T07:43:41Z

yes there is one major difference

csrss.exe is legitimate windows process and
crss.exe is the worm :)

lolz, just a difference of one letter " s "

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2005-04-07

2005-04-07T22:38:10Z

Run an up to date virus scanner.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Ramona on 2005-04-07

2005-04-07T22:12:57Z

Yes, I read everything on this page...so, how do I tell the difference between the real csrss.exe file and the worm version of it? Thank you in advance.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Zach on 2005-03-29

2005-03-30T00:35:40Z

I'll admit i have no clue what csrss.exe is doing, but I'd like to know why it eats up whatever processing power my cpu has to spare.
Can i get any help to think of a way to tone this down a bit? It becomes quite a problem in games.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Tommy on 2005-03-26

2005-03-27T05:16:15Z

You guys think you kinda understand what is going on.... Ridiculous, is all I can say after reading most of these posts... Csvss.exe is a vital part of windows, Viruses and parasites, depending on how they are written, will usually overwrite a file at random and then spread from there. As far as SP2 goes... The only thing you need to do to not have any problems is TURN OF YOUR EMAIL PROTECTION in the virus scanner. That simple! DON'T download every freaking toolbar you see, esp. anything gator related. Using multiples of firewalls and virus scanners as well as toolbars and (This is what I can not believe) SEARCH ASSISTANTS, only cause conflicts over which will be the default helper!!!!! 1 firewall, 1 virus scanner and if you have to use a toolbar I would suggest only 1 and that would be Yahoo's... this includes popup blockers too! The Windows firewall with SP2 is one of the easiest and most secure firewalls out there today.... I would suggest using it and a virus scanner (with the email protection turned off). Run your scanner on the email folder before you open any attachments and problem is solved! Those of you that are having problems with SP2 are probably doing exactly what I have listed above... the DONT's! Use a little logic and you should have no problems... SP2 was delayed for more them 2 years because of all the fixes and the new firewall..! They finally did something right! SO don't knock what you do not understand and try to learn instead of throwing a fit and putting on your old obsolete OS.... Humans never cease to amaze me!!!!

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Travis on 2004-11-20

2004-11-20T09:07:56Z

I had the same problem with csvss.exe after I installed SP2. After uninstalling it, my computer has returned to its blissfully idle state. Hmmm... does that mean that SP2, while fixing security holes, has developed a few of its own; or is it just a piece of crap piece of software? Don't miss the exciting conclusion on the next episode of "Microsoft vs. Security Issues."

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Al on 2004-11-04

2004-11-04T22:23:04Z

to whom it may concern take a good look in your system information and see what is really going on with microsoft too many process not set up corectly on my pc any way ? Software enviorment csrss Path not available ? real strange gives you a process ID? then min workin, and max woking both state not available again sent up some red flags to me contacted Microsoft still no answer and this is a Dell Pc less than 2 yrs old . then gives you version and so on lot of these process are not available or dont have a path ? me personally dont give a flyin rats patutty how ever the cost of these products and the time involved to find and figure out is not worth the time or trouble having told Microsoft many times get on the ball and step up to the plate instead of putting a product out there thats CRAP have a nice day and happy fixin Al Microsoft and Bill Gates should be Ashamed of putting a product out at the consumers expense ! Shame on you !

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Stuart on 2004-11-02

2004-11-02T22:32:26Z

CSRSS.EXE is a system file, but there's also a virus which uses the same name. My brothers PC had it and it does exactly what you described.

Here's the details including how to get rid of it:

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BUCHON.B&VSect=T

Stu

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-10-30

2004-10-31T06:03:33Z

You don't. It's supposed to be running.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Mike on 2004-10-30

2004-10-31T01:39:55Z

So, all this talk and the question I have is: How do you keep CSRSS.EXE from getting on the task manager?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Mike on 2004-10-05

2004-10-06T01:53:43Z

SP2 Sucks and does nothing but mess up systems. They spit that SP out to quick. Yes, XP has been around for a while but they didnt start working on SP2 until all this spyware bull shit started hitting as hard as it did. I recommend you all to look into AdAware and Hi-Jack This. Hi-Jack this is sweet because it lets you edit the registry no matter how computer stupid you are. All you have to know is how to tell what is what and if you dont know there is sites out there that will. I however know what is in my system, When I do get on it anyway. Im having to clean this damn computer everytime someone else gets on it. Did you all know Most Spyware is picked up from Porn Sites? Damn perverts! I think Im just going to lock everyone down so that they cant install jack shit and that will take care of it. Also if you want to help keep most spyware off your system, Set up a Limited Account and you wont be able to install nothing. Yes it could be a pain having to log out and back in to the Admin
Mike

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Casey on 2004-10-03

2004-10-04T03:32:16Z

Well, excuse me I was only trying to be helpful. I have SP2 and it didn't do anything like what you said. In fact I downloaded it trying to fix the problem I discussed above (well it didn't help anything either but whatever). I suggested what worked for me because it worked for me and Security Task Manager IS a good program, there's no need to be rude.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from john on 2004-10-01

2004-10-01T21:35:45Z

service pack 2 is a cpu hog, dont listen to casey. uninstall sp2 you will be happy again. who wants microsoft to have complete control?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Casey on 2004-09-30

2004-09-30T19:56:20Z

I doubt it has anything to do with SP2, probably coindidence. It actually sounds a lot like what I had, especially if your total CPU usage is at 100%. Read my post above to see how I took care of things. Even if you have something different I highly recommend Security Task Manager, it can deal with things most spyware and virus scanners can't. Be careful though since it is manual and you could screw something up.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from john on 2004-09-30

2004-09-30T18:32:45Z

I just installed XP service pack 2 and now the hourglass icon is running almost constantly. CPU utilization of csrss.exe runs from 33 to over 50. The hour glass will stop briefly but resume for long periods of time. Is this a known service pack 2 related issue or is their another possible cause? Is there a fix?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Casey on 2004-09-28

2004-09-29T01:57:07Z

I found the culprit, thought I would post a follow up.

I got Security Task Manager and it listed a lot of "soundfix.exe" and a thing called something like SynthCore R2.0 Midi Interface. I also had a few lines of gibberish in my startup list. I couldn't take out the gibberish because it came back and the soundfix.exe's because they weren't where the said they were (in fact I had no soundfix.exe on my computer at all). However the whole thing collapsed when I quarantined the SynthCore, the soundfix.exe's disappeared (except one which I could now quartine and delete) and the gibberish now stays gone when removed from my startup list. System performance is back to normal.

I found only a single refrence to this thing on Google and it was listed in a HiJackThis report from someone who had unrelated problem with a browser hi-jacker. I am the first to notice and remove this thing or does it normally go by another name? No autmatic scanner was able to find any trace of it and it seems rather sophisticated since it doesn't show up at all in processes but somehow make it look like csrss.exe is using that CPU output (the CPU output listed for csrss.exe in Security Task Manager was much lower than what Windows said). I am not looking for bragging rights since the credit goes to the STM program but if this is a new virus/trojan/spyware people should be aware of it's existance.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Casey on 2004-09-27

2004-09-28T05:17:07Z

I have a single csrss.exe file but recently it has been draining 58%+ CPU output, putting my CPU usage to 100% and slowing most things to a crawl. It wasn't always like this and even know it comes and goes but it usually behaves this way.

I am aware of a corrupt profile error that causes something similair but I am almost certain this is not that. Fresh profiles are affected in the same way.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from angel on 2004-09-27

2004-09-27T12:12:37Z

http://www.processlibrary.com/directory/files/csrss/

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Jim on 2004-09-25

2004-09-26T04:34:04Z

I understand the csrss.exe is a part of the kernel, but I am seeing multiple csrss.exe processes on WinXP Pro, SP1. Is there a csrss.exe process spawned for each client sub-system running?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from csrss.exe on 2004-09-18

2004-09-18T07:40:08Z

File csrss.exe is a system process but it is widely used by various keyloggers and worms to mislead the user.
Source: http://www.2-spyware.com/file-csrss-exe.html

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-09-17

2004-09-17T15:47:38Z

Please reread the article. It is not a problem, and does not require a solution.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from jagannathan on 2004-09-17

2004-09-17T12:10:36Z

solution for csrss.exe

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-08-02

2004-08-02T17:10:04Z

Please read the brief article at the top of this page.

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from nisim on 2004-07-31

2004-08-01T03:09:48Z

What is csrss.exe? Is csrss.exe spyware
or a virus? Process name: Client Server Runtime Process Product

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-07-10

2004-07-10T23:59:45Z

I'd start by running a good spyware scanner. That's the kind of thing this sounds like. Recommendations here: http://ask-leo.com/d-recommend

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Khaight on 2004-07-10

2004-07-10T18:46:45Z

I get a visual basic pop up that keeps coming back.
It says:
http:\\donkeysonparade.0catch.com\nukelog.txt

a ping of the site yields 206.63.57.10

IS there a way to "catch" the service that causes this pop up and disable it?

]]>

A comment on: csrss.exe

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.