csrss.exe

You have a problem with a corrupted user profile as the first thing to look at http://support.microsoft.com/default.aspx?scid=kb;en-us;555021 QUOTE:

"CAUSE
Your user profile is corrupt.
Back to the top

RESOLUTION
Before continuing, make sure you have backed up the contents of your My Documents folder, and any other important data stored in your profile such as application settings. Once your profile is deleted, you will not be able to recover data stored inside of it.

In order to delete your profile, you must be logged in with an account which has administrative privileges which is also not yours. Once you are logged in, open the user profiles list. To locate the list of local user profiles, right-click My Computer, click Properties, and then on the Advanced tab, click Settings under User Profile. Select your profile from the list, and then click Delete.

Logoff, and then log back on as yourself. A new profile will be created when you log on.

CAUTION
If the corrupted profile is that of a domain administrator, and it is located on the first domain controller in the forest, the EFS recovery key must first be backed up. See KB Article 324897 for details on this procedure."

There are also trojans especially if the "csrss.exe" file is discovered in other then the C;\Windows\System32\ subfolder.

"Process File: csrss.exe
Process Name: Microsoft Client/Server Runtime Server Subsystem

Description: csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem. This process manages most graphical commands in Windows. This program is important for the stable and secure running of your computer and should not be terminated.

Note: csrss.exe could also be a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. It could also be a registered security risk and should be removed immediately.

Determining whether this process is a virus or a legitimate Windows process depends on the directory location it executes or runs from in WinTasks." http://www.processlibrary.com/directory/files/csrss/
 
I need to end the process for a short ammount of time, and then start it back up, there is nothing wrong with it.

[EDIT: It's a critical system process, it says that task manager wont allow me to end it, and I also tried the cmd line: taskkill /im csrss.exe and it also said the same.]
 
twentyoneth said:
I need to end the process for a short ammount of time, and then start it back up, there is nothing wrong with it.

[EDIT: It's a critical system process, it says that task manager wont allow me to end it, and I also tried the cmd line: taskkill /im csrss.exe and it also said the same.]

Then read the previous post to understand just what it is or could be. If it is a genuine Microsoft system file and not a virus you could try overwriting it by expanding a fresh copy while at the recovery console. There you would go to the cd drive and into the I386 folder at the prompt and enter "expand csrss.exe C:\(drive Windows is installed on)Windows\System32\" and press the enter/return key. When asked if you want to overwrite the file answer yes. For information on expanding files manually, http://www.microsoft.com/resources/.../proddocs/en-us/bootcons_expand.mspx?mfr=true
 
csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem. This process manages most graphical commands in Windows. This program is important for the stable and secure running of your computer and should not be terminated.

This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment.

For the love of Windows, don't disable it.
 
If the file name seen is a trojan you will need to run a few programs for spyware/adware and even antivirus for removing the source of this problem. But if it turns out to be a corrupted or missing system you may have to go with an install to repair option if not deletion of the current user account. After running a few removers for a possible trojan you could perform the repair of XP by the steps outlined at http://www.michaelstevenstech.com/XPrepairinstall.htm
 
Back
Top