Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!
What is csrss.exe?
[/al_question]It’s the Windows Client Server Runtime SubSystem. A expensive name for what is a core part of Windows itself.
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
I'll see you there!
Before commenting please:
Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.
I want comments to be valuable for everyone, including those who come later and take the time to read.
I get a visual basic pop up that keeps coming back.
It says:
http:\\donkeysonparade.0catch.com\nukelog.txt
a ping of the site yields 206.63.57.10
IS there a way to “catch” the service that causes this pop up and disable it?
I’d start by running a good spyware scanner. That’s the kind of thing this sounds like. Recommendations here: http://ask-leo.com/d-recommend
What is csrss.exe? Is csrss.exe spyware
or a virus? Process name: Client Server Runtime Process Product
Please read the brief article at the top of this page.
solution for csrss.exe
Please reread the article. It is not a problem, and does not require a solution.
File csrss.exe is a system process but it is widely used by various keyloggers and worms to mislead the user.
Source: http://www.2-spyware.com/file-csrss-exe.html
I understand the csrss.exe is a part of the kernel, but I am seeing multiple csrss.exe processes on WinXP Pro, SP1. Is there a csrss.exe process spawned for each client sub-system running?
http://www.processlibrary.com/directory/files/csrss/
I have a single csrss.exe file but recently it has been draining 58%+ CPU output, putting my CPU usage to 100% and slowing most things to a crawl. It wasn’t always like this and even know it comes and goes but it usually behaves this way.
I am aware of a corrupt profile error that causes something similair but I am almost certain this is not that. Fresh profiles are affected in the same way.
I found the culprit, thought I would post a follow up.
I got Security Task Manager and it listed a lot of “soundfix.exe” and a thing called something like SynthCore R2.0 Midi Interface. I also had a few lines of gibberish in my startup list. I couldn’t take out the gibberish because it came back and the soundfix.exe’s because they weren’t where the said they were (in fact I had no soundfix.exe on my computer at all). However the whole thing collapsed when I quarantined the SynthCore, the soundfix.exe’s disappeared (except one which I could now quartine and delete) and the gibberish now stays gone when removed from my startup list. System performance is back to normal.
I found only a single refrence to this thing on Google and it was listed in a HiJackThis report from someone who had unrelated problem with a browser hi-jacker. I am the first to notice and remove this thing or does it normally go by another name? No autmatic scanner was able to find any trace of it and it seems rather sophisticated since it doesn’t show up at all in processes but somehow make it look like csrss.exe is using that CPU output (the CPU output listed for csrss.exe in Security Task Manager was much lower than what Windows said). I am not looking for bragging rights since the credit goes to the STM program but if this is a new virus/trojan/spyware people should be aware of it’s existance.
I just installed XP service pack 2 and now the hourglass icon is running almost constantly. CPU utilization of csrss.exe runs from 33 to over 50. The hour glass will stop briefly but resume for long periods of time. Is this a known service pack 2 related issue or is their another possible cause? Is there a fix?
I doubt it has anything to do with SP2, probably coindidence. It actually sounds a lot like what I had, especially if your total CPU usage is at 100%. Read my post above to see how I took care of things. Even if you have something different I highly recommend Security Task Manager, it can deal with things most spyware and virus scanners can’t. Be careful though since it is manual and you could screw something up.
service pack 2 is a cpu hog, dont listen to casey. uninstall sp2 you will be happy again. who wants microsoft to have complete control?
Well, excuse me I was only trying to be helpful. I have SP2 and it didn’t do anything like what you said. In fact I downloaded it trying to fix the problem I discussed above (well it didn’t help anything either but whatever). I suggested what worked for me because it worked for me and Security Task Manager IS a good program, there’s no need to be rude.
So, all this talk and the question I have is: How do you keep CSRSS.EXE from getting on the task manager?
You don’t. It’s supposed to be running.
CSRSS.EXE is a system file, but there’s also a virus which uses the same name. My brothers PC had it and it does exactly what you described.
Here’s the details including how to get rid of it:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BUCHON.B&VSect=T
Stu
to whom it may concern take a good look in your system information and see what is really going on with microsoft too many process not set up corectly on my pc any way ? Software enviorment csrss Path not available ? real strange gives you a process ID? then min workin, and max woking both state not available again sent up some red flags to me contacted Microsoft still no answer and this is a Dell Pc less than 2 yrs old . then gives you version and so on lot of these process are not available or dont have a path ? me personally dont give a flyin rats patutty how ever the cost of these products and the time involved to find and figure out is not worth the time or trouble having told Microsoft many times get on the ball and step up to the plate instead of putting a product out there thats CRAP have a nice day and happy fixin Al Microsoft and Bill Gates should be Ashamed of putting a product out at the consumers expense ! Shame on you !
I had the same problem with csvss.exe after I installed SP2. After uninstalling it, my computer has returned to its blissfully idle state. Hmmm… does that mean that SP2, while fixing security holes, has developed a few of its own; or is it just a piece of crap piece of software? Don’t miss the exciting conclusion on the next episode of “Microsoft vs. Security Issues.”
You guys think you kinda understand what is going on…. Ridiculous, is all I can say after reading most of these posts… Csvss.exe is a vital part of windows, Viruses and parasites, depending on how they are written, will usually overwrite a file at random and then spread from there. As far as SP2 goes… The only thing you need to do to not have any problems is TURN OF YOUR EMAIL PROTECTION in the virus scanner. That simple! DON’T download every freaking toolbar you see, esp. anything gator related. Using multiples of firewalls and virus scanners as well as toolbars and (This is what I can not believe) SEARCH ASSISTANTS, only cause conflicts over which will be the default helper!!!!! 1 firewall, 1 virus scanner and if you have to use a toolbar I would suggest only 1 and that would be Yahoo’s… this includes popup blockers too! The Windows firewall with SP2 is one of the easiest and most secure firewalls out there today…. I would suggest using it and a virus scanner (with the email protection turned off). Run your scanner on the email folder before you open any attachments and problem is solved! Those of you that are having problems with SP2 are probably doing exactly what I have listed above… the DONT’s! Use a little logic and you should have no problems… SP2 was delayed for more them 2 years because of all the fixes and the new firewall..! They finally did something right! SO don’t knock what you do not understand and try to learn instead of throwing a fit and putting on your old obsolete OS…. Humans never cease to amaze me!!!!
I’ll admit i have no clue what csrss.exe is doing, but I’d like to know why it eats up whatever processing power my cpu has to spare.
Can i get any help to think of a way to tone this down a bit? It becomes quite a problem in games.
Yes, I read everything on this page…so, how do I tell the difference between the real csrss.exe file and the worm version of it? Thank you in advance.
Run an up to date virus scanner.
yes there is one major difference
csrss.exe is legitimate windows process and
crss.exe is the worm :)
lolz, just a difference of one letter ” s “
the internet disconect every 5 minutes or so and it says that there is a problem with my firewall or antivirus that it is blocking the csrss.exe and that i need to make sure csrss.exe is can connect to the internet. How can I do that? i have no idea. Please help me
Okay the just a comment about MS (MicroSux).
They have just gone in the right direction the wrong way.
It (XP) isn’t a bad operating system, however some aspects could do with some serious work.
Another issue with XP is that there have been something like 97 essential updates to my version of it (SP2 original version) and that seams like an awful lot 2 me considering the time that SP2 was purchased by myself.
Anyway I have a completely different problem and any help would be appreciated.
I like to use google.com as my search engine and a few weeks ago something went very wrong, I was attacked by some spyware/adware or the like that sends any search I do at google only (yahoo is fine) to sex sites and refuses to load anything at all to do with google itself.
i.e. clicking a link sends me directly to the search of sex sites.
If I hover over a link (google one) I get http://www.google.com.au/about.html appear as http://www.google.com.au/search.php# in the status bar in the bottom left of internet explorer.
?????????????????
If you can help me email [email address removed] and let me know. Maybe I can get you a GMail account for free for helping solve my problem.
It sounds like a classic case of spyware alright. You want this article: http://ask-leo.com/spyware_how_do_i_remove_and_avoid_spyware.html
I 2 have this csrss.exe and would like to know what it does. I recently got dun over by a very bad virus and got sick of the free virus stop programs, so I got a propper one now and all is good. I now have process explorer and that lets me see what is going on, thats where you will be able 2 see csrss.exe(if there)double click on it then at the top click on threads, once done you will see some numbers jump’n around. You have the option 2 kill what ever======TAKE REAL GOOD CARE DON’T GO AROUND AND JUST KILL EVERYTHING THING YOU THINK IS BAD========Once you have valid infomation about a program you may then proceed 2 kill it,but only the highist number, its alot safer that way. This method to kill csrss.exe will not be permanant, this will have to be done everytime you startup, when you click on threads you should see ‘win32k.sys’ this should be doing the most work. I just did a google search on this win32k.sys and alot of other people are hav’n problems with it and related. So just like everyone else I 2 am confussed, I recently have noticed that my desktop is a bit slower at the moment, desktop properties takes while to open. I’m wondering if ‘win32k.sys’ is causing this, my PC still performs very well and have no problems with video, audio and anything else, just sometimes slow opening. If you have any help or advice it would be a great help. CheerS
win32k.sys is part of Windows, so if it’s showing up as part of the problem, it’s probably a symptom of something else. Make sure your anti-virus scans and database are up to date, and also make sure you’re doing an anti-spyware scan.
I just got myself a laptop from my dad’s workplace… and as I’m browsing I get hit by these seemingly ‘official’ warning pop ups sayin things like “Message from SYSTEM to ERROR at Windows has detected 47 critical errors.”
Ok, I can buy that… but then my computer, having apparently achieved a miracules state of self awareness and gone through the internet on my behalf for solutions, actually OFFERS me website addresses from where I can update patches and changes to fix the various errors it has alerted me to.
Naturally this gets my suspicious juices flowing, but then to seal the deal I get messages from wonderful ladies such as Carla and Moni offering to go to their webcam websites for them to make me ‘cum’. Naturally I declined.
Both pop ups, the error ones and the sexy ones are the same in design and all (according to the task manager) are from the CSRSS.EXE module that for some reason I am unable to shut down because “Access is denied”? Due to it being a critical system componant or something.
There is a spyware scanner in this compy but it’s not a brilliant one, I’m gonna run off and get myself spybot, AVG… Norton or something, once I have scanned I will tell you how it went.
In the mean time if anyone can offer any advice as to what is goin on here? I find it unsettling when my own computer says access is denied after first offering my oral webcam sex. Get my drift?
The Founder
What you’re seeing are popups delivered through the WIndows Messenger Service. It’s easily turned off. This article has quick instructions: http://ask-leo.com/whats_the_difference_between_msn_messenger_windows_messenger_and_windows_messenger.html
HI all
I also seem to have been hit by some hideous virus/trojan whatever. It changed my web homepage setting, but also changed the url of any security sites I type in(by adding its own extra characters) rendering them unreachable. I ran several virus checkers like AVG and that identified a Backdoor virus and ‘cured’ it, but I still get a reference to csrss.exe on start-up, something to do with the the registry looking for some files that, I think AVG ditched. I also still get the url corruption. Is there a genius out there?
Regards
Steviebobs
csrss.exe has been running my hard drive up & down for about 1 hour now. I installed Security Task Manager & it reads all the other Tasks but not this one that is using about 20% of my resources.
I have a process also running in the background that is most obviously a trojan. I got it from my MSN messenger becausei accepted a file from someone i trusted. Well now it opens up conversations from my contact list and trys to send them links to more viruses ever five minutes or so. Its located in C Windows System32 Pekslr cssrs.exe Its running in my user processes but says i cant end it because its a system process. I have used just about every anti spyware anti virus program i can think of and have access to. I have tried deleting it from my registry and more. I have about 5 programs to end and manage task and processes. None of them can touch this thing. What should i do?
Hi
can any1 tell me wat csrssrs.exe do….my sys got slower then i checkes in task manager–>there i saw csrssrs.exe is using 70-80% of CPU usage.i cant able to delete it also my sys got very much slower…can any1 tell me how to cope up with tat
I keep getting after login csrss.exe error path/file access error.
After clicking ok, it disappears, there are no virus’s or spyware on my pc.
how can I reinstall this and is there a problem?
I’d run the system file checker: http://ask-leo.com/what_is_the_system_file_checker_and_how_do_i_run_it.html
When I first boot up my computer (Windows XP home version) I get a “No Disk Windows” popup and it wants to “cancel, try again, or continue”. After several “cancel” it goes away until the next boot up. Task manager tells me that it is coming from CSRSS.EXE. I have noticed that when “cancel(ing)” that it is stepping thru a process (McAfee Security system) once I get past the McAfee setup usually the next “cancel” clears it. Can any help me resolve this headache?
I think my computer is infected with the csrss.exe worm. I ran a couple of virus scans, which found it but couldn’t delete it. It is making some programs not run correctly, and after the computer has been on for about 15 mins, the internet cuts out and i have to restart. I have no idea what to do
Hi all,
My pc is also infected with the csrss.exe worm. I noticed it when a friend supposedly sent me a link asking me if the link was me. I clicked on it (it was tied to a hotmail account I don’t use, other than for windows messenger) and something weird happened and now I am no longer able to sign into ANY of my email accounts. This included gmail, hotmail, and comcast. I also am unable to use messenger. The error message I receive while in IE is “This page cannot be displayed” and in firefox, I get “Connection refused by http://www.____.com” in an error box. It disabled all my firewall and antivirus settings (but did not touch my spysweeper) and I cannot delete it from my registry. I booted in safe mode, tried to do it then, and still to no avail. I really REALLY do not want to reinstall windows, as I just had it done not two months ago. Is there anything at all that I can do to get rid of this stupid thing?
Rescently I was on MSN messanger (Yea, I know) and my buddy sent me a picture of his house or so it said, so naturally I clicked on it and waddaya know, my popup blocker sends me an alert but the download verification didn’t bother to pop up, then I have an error message saying some critical files were replaced in my system and it was requesting my CD. Naturally I cleaned up my log files and scanned useing Ewido, AVG, SpybotS+D, and even AdAware. Surprisingly, Ewido was the only one to come up with any results. 9 results all “destroyed and replaced”. Since then when I log in my computer sends me several errors that csrss.exe isn’t running or doesn’t exist on my computer. Yet it’s still in the task manager? What am I dealing with here?
Yes, I’ve got exactly the same problem as Jermuny and my laptop also is a lot slower than before and there’s no viruses on my computer (got it checked by Norton and Antivir).
What can I do? That gets on my nerves!
MMkay well, I downloaded this block-checker thing for msn messenger and stuff and it screwed up my computer really bad. Immediately I deleted the program but it was still advertising this block-checker to my friends on msn. after downloading numerous programs to wash the phony csrss.exe virus away, when i turn the computer on there’s like 5 pop ups all saying that the path cannot be found for csrss.exe. I think i might’ve accidently deleted the important file! How do i get it back?!?!?!
hi, i also had problem with csrss.exe, so i just deleted it, was this wrong? and if so, what should i do now?
Yes, deleting csrss is a problem. You’ll need to attempt a repair install of Windows.
this program isnt ALWAYS a virus but it is an essential part of windows.. i pulled the following information from another site.
File: csrss.exe
Security Rating:
This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment.
Note: The csrss.exe file is located in the c:\windows\System32 folder. In other cases, csrss.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.
I’m getting an error message saying that the csrss file is blocked by firewall and needs to be unblocke so I can connect to the internet. How do I fix it. It’s not even letting me stay on long enough to reply to emails and it’s getting annoying. :(
i keep getting this box that pops up saying that i need to download stuff to fix things with my windows when i pull up task manager and check this annoying little box out it says that it is a csrss.exe file i don’t want to download theese things and this has never happened before what is it a virus or is it for real please help as i am considering taking a hammer to my computer
Sounds like messemger *service* spam. Check out this article: http://ask-leo.com/whats_the_difference_between_msn_messenger_windows_messenger_and_windows_messenger.html – in includes instructions about 2/3rds the way down to turn off the Windows Messenger *Service* that may be allowing these popups.
i have almost 7 instances of SVCHOST running in my task manager at the same time.. and also SERVICES.EXE and SERVICE~1.EXE.
Also at times my mouse poinetr starts moveing by itself. I have scanned for spyware/ adware / viruses.. and my system is perfectly clean..
Please tell me if my system is alrite or not..
Would appreciate you people’s co-operation.
Ketan.
“i keep getting this box that pops up saying that i need to download stuff to fix things with my windows when i pull up task manager and check this annoying little box out it says that it is a csrss.exe file i don’t want to download theese things and this has never happened before what is it a virus or is it for real please help as i am considering taking a hammer to my computer”
i get that also, its says that there is 36 or 39 critical objects on my computer, and automatically I knew it was fake because i dont think Microsoft would refer to another company. and I also get another one saying something else. i went to task manager and followed the alert to the source and it was csrss.exe … would it be ok if i deleted it if the annoying program WAS from csrss?
No. You probably just need to turn off the messenger service. This article includes the instructions how: http://ask-leo.com/whats_the_difference_between_msn_messenger_windows_messenger_and_windows_messenger.html
If csrss.exe is running from \Windows\System32 it is probably fine. Run a virus scan, such as the free AVG Anti Virus (www.grisoft.com).
If it’s running from another directory, e.g. \Program Files\Block Checker reboot into safe mode, then delete the file. csrss.exe is a Microsoft required process but is also used as a mask for Block Checker etc.
James, the thing you’re describing sounds similar to Microsoft (Windows) Update. Go to windowsupdate.microsoft.com and run the scan – see if it identifies the same/similar number of ‘Critical Updates’ and install them from there just to be sure.
You can right click on My Computer and check Properties, then the Automatic Updates tab to see if it’s switched on or off. You may prefer to switch it off and check the MS Update site manually.
When I start up my computer, I get an error message that says the attempt to load the file C:\WINDOWS\system32\pvxprkh\csrss.exe failed, and to attempt to find the file or fix the registry. I’ve found the file references in the registry, but should I delete them? There’s only two, with the titles load and run.
Because it’s in that oddly named subdirectory (pvxprkh) it’s more likely that this is a virus, and you should run both up-to-date anti-virus and anti-spyware scans.
I get a window that says “csrss.new.exe file is missing” 4 times when i start windows. Is there anyway I can get rid of this?
I would first run an up-to-date anti=virus and anti-spyware scan, as this symptom is often caused by one or the other.
If that doesn’t fix it, then I’d start looking at my startup-programs and remove references to csrss.new.exe. This article may help that process: http://ask-leo.com/whats_all_this_stuff_running_after_i_boot_windows.html
I have been going crazy trying to find if this is real or a flase postive,I have downloaded every virus software program on the internet shareware and freeware(all)spyware removers(all) and nobody can find it except,Remove it!Pro,but usually is back in 20 minutes or on reboot after I clean it,I have ran this scan called a-squared HiJackFree Analysis and this is what is said:
VStatus Filename Path Description (green happy face)
csrss.exe %systempath%\ csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem. This process manages most graphical commands in Windows.
BAD Red Devil Face!
csrss.exe %winpath%\ This worm is transmitted via e-mail and attempts to install itself on your computer:
PLease can anybody help me? I have shut down every service that is not needed but this is alway’s showing up over and over and it does have an effect on my task manager,shut’s it off! When it feels like it.
So is this a-squared HiJackFree Analysis true? Or something that could get in?,but it seems to be in my computer just can’t find it! tried everything safemode also I can not remove it.
And so far nobody can help, I hope this is the place because I am out of ideas,thank you in advance for any info.I have tried evething on the internet and nothing can get rid of csrss.exe %winpath%.Thanks
Hi. I have that same bad red devil face and cannot find what I need to remove it. Can anyone help?
I have this csrss.exe thing on both my pc, it has disabled norton 05 security and i have spent hours trying to remove it. Webroot managed to find it, Spybot detects some “FakeMSNbeta” but neither are able to truly remove it. I believe my pc is still at risk and still infected. I dare not use messenger incase i infect people on my contacts list. I am not able to un- then re-install Norton, access to many sites offering advice on this infection appears blocked.
I haven’t got a clue what to do and i’m worried about the safety/health of my pc.
Okay, I get that csrss.exe is essential. I have checked and there appears to be no virus.
So, why does this piece of code continually do I/O’s to the hard drive when there is otherwise nothing going on? In point of fact, it does more reads than all other applications combined.
What gives?
Can anybody help me.
I’ve been receiving these weird popups in windows telling me to install some (random) registry fixer because I allegedly have some errors in my registry. traced the source of those popups and it seemed as though csrss.exe was what creates it. And thus I concluded it being a virus but since it’s a Windows essential part, I could not have deleted it. I tried reformatting my C: and reinstalling XP but I still receive the same message(s). Starting to believe my Windows XP cd got proper ******
Help
Have you turned off the Windows Messenger Service? This article shows how: http://ask-leo.com/what_windows_services_can_i_turn_off.html
When my PC boots, I get a Windows – no disk error message (retry, cancel, continue – cancel is the only thing that works). Task manager associates it cssrss.exe as the appropriate process. How can I make this go away?
If you’ve spelled it properly (cssrss, not csrss) then you most likely have a virus and need to run up-to-date virus and spyware scans.
I began experiencing the heavy CPU utilization problem after not having logged into my office computer for 10 days. I tried all the various suggestions (without deleting my profile or reinstalling XP) to no avail. I then killed every system tray application one at a time and discovered that the Google Desktop was the culprit.
My GDS install is setup to index several large file server shares on my network. I am assuming that because I logout before going home every night, it is unable to perform this indexing overnight since GDS (a system tray app) is no longer running. Since I was away for over a week, I think that after I logged in, it had begun catching up by performing large indexing operations. I validated this by leaving myself logged in overnight with GDS running. Today I’ve noticed no lengthy CPU utilizations by CSRSS.exe.
When my PC boots, I get a Windows – no disk error message (retry, cancel, continue – cancel is the only thing that works). Task manager associates it cssrss.exe as the appropriate process. How can I make this go away?
My csrss.exe is ok i keep getting this message. It started when i installed Norton from a floppy then i removed the disk before i closed the Norton program and shut my computer down. Please Help.
There is free program named ThriceSoft Processnik. It shows info about runing processes, info about programs
whose starts with windows and more. You should try it out. http://files.myopera.com/edijus/blog/Processnikv1.8.rar
or visit homepage http://www.thricesoft.com/ By the way, Processnik doesnt reques to be installed. That’s why I like it!
hi i have a probelm that everytime i log it comes this error WINDOWS.EXE-NO DISK.WHEN I GO TO TASK MANAGER and try to see what it is it goes on csrss.exe can you help please
thanks
After reading the previous comments about the no disk problem, I thought I would try unmapping a drive I had allocated to device ‘B’. By gosh, then it let me cancel the message instead of repeating over and over. Seems like drive letters above C: may also cause the problem.
I have recently been noticing I have 3 processes called csrss.exe under username for one it says SYSTEM and for the other two it says my windows account name. Im not sure whats going on here.
I’m a bit confused on this Csrss.exe,is it a virus or trojan?It’s in my task manger,Processes,using lots of memory 3,804 K,is this ok or what do i need to do?Using windows vista home premium.
Thank you Teresa
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1
I’m a little confused. Quoting the article that you
indicated you read by submitting a comment:
“It’s the Windows Client Server Runtime SubSystem. A
expensive name for what is a core part of Windows itself.”
It’s a part of Windows. Is that not clear?
Leo
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.7 (MingW32)
iD8DBQFHeTexCMEe9B/8oqERAndTAJ9B6pd5AWMF4iwkPqtLveW4hi4z6wCeKHHy
zPieHOepyRSRGfyqia13WZk=
=EAF+
—–END PGP SIGNATURE—–
Can you help me, i need to know how to hide csrss.exe process on task manager, please reply to my email,
Thank You.
Hey, im also having an error message showing on pc start up (C:\WINDOWS\media\csrss.exe) error, it says that it cannot read or locate the source?
Can someone let me know what to do, email me if you like … thanks
“Hey, im also having an error message showing on pc start up (C:\WINDOWS\media\csrss.exe) error, it says that it cannot read or locate the source?
Can someone let me know what to do, email me if you like … thanks
Posted by: MUNZ at April 7, 2008 03:12 PM”
Do you have ZoneAlarm? I had the same error message and fixed it by allowing the program to run in ZoneAlarm > Program Control > Add > C:/WINDOWS/Media/Csrss.exe
Hope that helps.
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1
CSRSS.EXE may not be a worm – it’s a part of Windows and is
on every machine. You DEFINITELY do NOT want to remove this
part of Windows.
http://ask-leo.com/csrssexe.html
Leo
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.7 (MingW32)
iD8DBQFIc7TzCMEe9B/8oqERAjVsAJ9sVb4MREBVyRB0VurzypNix/A7agCcDaYo
+qRMfGDU32ALW1SXqDPfq6I=
=gsLT
—–END PGP SIGNATURE—–
My Anty Virus show me:Windows\media\csrss can be vb Torjan.
What may I do, delete or not? or download from somewhere csrss?
Thanks
My Anti Virus show me:Windows\media\csrss can be vb Torjan.
well, I in mistake delete it. Now I receve “can ot find…”
Where can I add csrss.exe?
Thanks
-Leo
Hi Sir,
I’m also having a problem with csrss.exe, I’ve read an article on how to resolve the error. So I installed HiJackthis and follow the instruction, and restarted my PC. The error was resolved but I cannot access my msdos. Everytime I run cmd, my computer shuts down. Pls help… thanks…
I am getting error message csrss.exe- can not find. How do I sto it?
Problem: My computer is performing slow. Long periods of time to respond to a mouse selection. The PC does behave similarly when I am getting a “Live Update” from Symantec.
In this case (today) I note that whilst in task manager the csrss.exe is getting frequent cpu hits. Firefox and Outlook Express were running but I had not invoked anything for at least an hour.
Analysis ??
I’m afraid I have deleted csrss system file, and everytime that I try to put on the pc the screen turns black and I just can’t do nothing. I’ve also tried to boot in safe mode but the same thing hapened.
HELP PLEASE
(soz for the english)
22-Dec-2008
there are 2 other csrss.exe that can be found on your computer once you are infected by this virus. One is on C:\Documents and Settings\user\csrss.exe and the other is on C:\Program files\Microsoft Fronpage\csrss.exe and together with is is a .reg file (18something) and a time.dat. These too are also products of the virus
csrss.exe is not always a virus… it can be normal to have it running multiple times. if your not sure open up do this
1. hit windows key+r
2. type in cmd
3. hit enter
4. type in tasklist
5. find and write down the PID of both processes
6. now type in tasklist /v
7. find both csrss.exe and see who authorised it. If it is a virus one of the two is not authorised by “NT AUTHORITY\SYSTEM”
8. remember the PID of the virus and type in tasklist /fi “pid eq (your virus pid)”
9. Now you should see just one process. remember the mem usage (at me 4.652 K) and hit ctrl+shift+esc
10. find your virus and kill the processnow find it and delete it :D
I have a pop up window on my desktop: Windos – No Disk Exception Processing Messag c0000013 Parametes 75b6bf9c 4 75b6bf9c 75b6bf9c. Could this be a problem with the crss.exe file?
So, I have a huge problem with csrss.exe eating my CPU up to 99%, and I don’t have the virus, I only have csrss.exe in the right place (SYSTEM). I started a new profile on my computer and intended to erase the previous one to check if that could help, but before I had the chance to do this, csrss.exe took over the new profile too, which is why I sincerely doubt it will do any good to erase the first profile. I also installed a “hotfix” that would fix a problem with csrss.exe that starts when right-clicking something, when I was unsure that it might be the problem (since the description of my problem was exactly the same: 100% CPU). HEEELP! :-/ Thanx!
Looking at another page I found the help I needed, and I post it here so that it might help someone else. I updated the graphics. As simple as that. All problems gone!
hi!
to remove RP09.exe
1. run command prompt
2. type cd\
3. type ATTRIB -H -S -R /S /D..it would few minutes if your drive have many files and folders..
4. manually delete autorun.inf, syste~1, niaw folder.. just type “del autorun.inf” etc…
5. run regedit.exe using command prompt or RUN command.
6. Press Ctrl + F.
7. Find syste~1\_resto~1\RP09.exe
8. delete it.
6.
thats it..
I’ve seen this virus/worm/malware… I’ve infected my gf’s anti-virus-less internet-less computer by accidentally clicking a file that looks like a folder. I searched the registry but I couldn’t find the source…
I went to this website for advice and I figured out how this virus works…
1. It creates a file csrss.exe in Documents and Settings folder
2. The main executable and registry file are located at Program Files\microsoft frontpage
3. Just like any other malware, it creates duplicates on USB flash drives with autorun.inf
I think it creates a registry entry in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer and creates a subdirectory “run”. You can find the directory path of the virus through there so you can delete it manually. Delete the whole “Run” subdirectory
Correct me if i’m wrong.
Make sure before attempting to delete the malware, start your computer in safe mode (Press F8 after the BIOS but before Windows loads)
I’d think the creator of this malware is very crafty that he wants the virus not to be detected even by experienced computer users. He didn’t put those in the commonly used HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run as this would be too obvious for experienced users
You’ve got some great solutions here for the csrss.exe error, here is another solution that I found.
http://www.improve-pc-tools.com/index.php/dealing-with-the-csrss-exe-error/
you can get more info on csrss.exe at www.http://csrss-exe.com
apparently their doing blogs on everything today