Microsoft Windows Vista Community Forums - Vistaheads
Recommended Download



Welcome to the Microsoft Windows Vista Community Forums - Vistaheads, YOUR Largest Resource for Windows Vista related information.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so , join our community today!

If you have any problems with the registration process or your account login, please contact us.

Driver Scanner

2 instances of csrss.exe?

microsoft.public.windows.vista.general






Speedup My PC
Reply
  #1 (permalink)  
Old 05-15-2007
kilik3000@gmail.com
 

Posts: n/a
2 instances of csrss.exe?
Does anyone else out there have 2 instances of csrss.exe running? I'm
pretty sure it's not spy ware... is it a configuration issue?

It it by design for Vista?

-Thx

Reply With Quote
Sponsored Links
  #2 (permalink)  
Old 05-15-2007
Julian
 

Posts: n/a
Re: 2 instances of csrss.exe?
<kilik3000@gmail.com> wrote in message
news:1179226131.004448.177830@e65g2000hsc.googlegr oups.com...
> Does anyone else out there have 2 instances of csrss.exe running? I'm
> pretty sure it's not spy ware... is it a configuration issue?
>
> It it by design for Vista?


You may have a Trojan...
http://www.liutilities.com/products/...library/csrss/

Reply With Quote
  #3 (permalink)  
Old 05-15-2007
Julian
 

Posts: n/a
Re: 2 instances of csrss.exe?
"Julian" <Julianlzb87@gmail.com> wrote in message
news:OLKHo8tlHHA.3484@TK2MSFTNGP02.phx.gbl...
> <kilik3000@gmail.com> wrote in message
> news:1179226131.004448.177830@e65g2000hsc.googlegr oups.com...
>> Does anyone else out there have 2 instances of csrss.exe running? I'm
>> pretty sure it's not spy ware... is it a configuration issue?
>>
>> It it by design for Vista?

>
> You may have a Trojan...
> http://www.liutilities.com/products/...library/csrss/


You might need to purchase their tools to get much joy from that site.

Try a full search on your drive(s) for csrss.exe

It's likely you'll find at least two examples which you can then compare
for details such as date and time created/modified etc. and the
folder in which they are located.
That should give you a clue about which is the genuine article.

Also, or altertnatively, you could run regdit and search for csrss.exe
and glean information to help you identify the imposter.

Then you can, probably, fix it quite easily by deleting the *******.



Reply With Quote
  #4 (permalink)  
Old 05-15-2007
kilik3000@gmail.com
 

Posts: n/a
Re: 2 instances of csrss.exe?
Their both from C:\WINDOWS\system32. I think they are the legit exe
files from MS. Thoughts?




Reply With Quote
  #5 (permalink)  
Old 05-15-2007
Julian
 

Posts: n/a
Re: 2 instances of csrss.exe?
<kilik3000@gmail.com> wrote in message
news:1179231499.630070.303340@y80g2000hsf.googlegr oups.com...
> Their both from C:\WINDOWS\system32. I think they are the legit exe
> files from MS. Thoughts?


I'm not sure how a folder can show two identically names entries but...

If they are identical in ALL respects....

(Carefully and recheck the details or each copy of csrss.exe
by right clicking on csrss.exe then take options
> properties > General and details )


Rename one csrss.exe to csrss1.exe

Reboot and see what happens.

If you still have two occurrences you are going to have
to check with something like Autoruns (google it)
to see if it is being initiated twice.

Reply With Quote
  #6 (permalink)  
Old 05-15-2007
Richard Urban
 

Posts: n/a
Re: 2 instances of csrss.exe?
Try showing processes from all users. Now you will see two copies of
csrss.exe running.

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User
(For email, remove the obvious from my address)

Quote from George Ankner:
If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

"Julian" <Julianlzb87@gmail.com> wrote in message
news:OLKHo8tlHHA.3484@TK2MSFTNGP02.phx.gbl...
> <kilik3000@gmail.com> wrote in message
> news:1179226131.004448.177830@e65g2000hsc.googlegr oups.com...
>> Does anyone else out there have 2 instances of csrss.exe running? I'm
>> pretty sure it's not spy ware... is it a configuration issue?
>>
>> It it by design for Vista?

>
> You may have a Trojan...
> http://www.liutilities.com/products/...library/csrss/


Reply With Quote
  #7 (permalink)  
Old 05-15-2007
kilik3000@gmail.com
 

Posts: n/a
Re: 2 instances of csrss.exe?
I'm probably not being clear.

1) Run process explorer
2) Sort by process name
3) Note that there are two instances of csrss.exe running side by side
4) View the properties of each and note that they were both launched
from C:\Windows\System32
5) Note that both are running under the NT AUTHORITY\SYSTEM account.

I should also mention that I've seen this on another vista
installation (both are Ultimate BTW). Check yours for yourself.

Task Manager should also work for this.

Any ideas on why this is?

-Thx


Reply With Quote
  #8 (permalink)  
Old 05-15-2007
Julian
 

Posts: n/a
Re: 2 instances of csrss.exe?
<kilik3000@gmail.com> wrote in message
news:1179235826.570825.259780@k79g2000hse.googlegr oups.com...
> I'm probably not being clear.
>
> 1) Run process explorer
> 2) Sort by process name
> 3) Note that there are two instances of csrss.exe running side by side
> 4) View the properties of each and note that they were both launched
> from C:\Windows\System32
> 5) Note that both are running under the NT AUTHORITY\SYSTEM account.
>
> I should also mention that I've seen this on another vista
> installation (both are Ultimate BTW). Check yours for yourself.
>
> Task Manager should also work for this.
>
> Any ideas on why this is?


You have a virus, such as the Trojan.Gutta or W32.Netsky.AB@mm or
W32.Buchon.A@mm or Backdoor.Botnachala virus, or some other virus, if
you have Windows 95/98/ME or if the full path to this program is either
C:\Windows\csrss.exe or C:\WinNT\csrss.exe.

Reply With Quote
  #9 (permalink)  
Old 05-15-2007
kilik3000@gmail.com
 

Posts: n/a
Re: 2 instances of csrss.exe?
Okay it's turns out there is a reason for this and it is by design for
Vista. It is *not* a virus.

Apparently the Windows startup process has changed significantly
between Vista and XP.

Check out the "Startup Processes" section of the following article for
a better explanation:

http://www.microsoft.com/technet/tec...3/VistaKernel/

-Thx

Reply With Quote
  #10 (permalink)  
Old 05-15-2007
Jon
 

Posts: n/a
Re: 2 instances of csrss.exe?
<kilik3000@gmail.com> wrote in message
news:1179226131.004448.177830@e65g2000hsc.googlegr oups.com...
> Does anyone else out there have 2 instances of csrss.exe running? I'm
> pretty sure it's not spy ware... is it a configuration issue?
>
> It it by design for Vista?
>
> -Thx
>



For "user-mode" (as opposed to 'kernel-mode') processes. Probably one for
each "session" - ie one for session 0, and one for session 1.

User-mode = accesses hardware indirectly via Windows API
Kernel-mode = direct hardware access

--
Jon

Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Killing CSRSS.exe kills vista! theinvisibleGhost microsoft.public.windows.vista.general 8 04-30-2007 19:26
Missing digital signatures for hkcmde.exe igfxtray.exe igfxpers.exe Michael Chare microsoft.public.windows.vista.general 5 03-25-2007 21:11
csrss.exe and winlogon.exe is this a Window Vista process? =?Utf-8?B?R1Q=?= microsoft.public.windows.vista.general 5 03-01-2007 14:21
Multiple instances =?Utf-8?B?RnJ1c3RyYXRlZA==?= microsoft.public.windows.vista.music pictures video 1 02-09-2007 06:17
Re: svchosts.exe multiple instances Fat Bastard microsoft.public.windows.vista.performance maintenance 0 12-09-2006 20:10




All times are GMT +1. The time now is 11:56.




Driver Scanner - Free Scan Now

Vistaheads.com is part of the Heads Network. See also XPHeads.com , Win7Heads.com and Win8Heads.com.


Design by Vjacheslav Trushkin for phpBBStyles.com.
Powered by vBulletin® Version 3.6.7
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.6.0 RC 2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120