csrss.exe hogging system

Hi

I am trying to sort my Thinkpad R50e laptop out before selling it. The laptop only has 756k of ram so I understand that it is quite slow. However it also freezes randomly and one of the reasons is csrss.exe suddenly taking up a lot of CPU resources. I have checked for malware via the other forum and done all the tests and the computer is clean so I wondered if there was something else I could do?

Many thanks

Matthew

 

Hi my friend , sometimes there is a trojan behind csrss.exe

http://www.processlibrary.com/directory/files/csrss/26031/

running this cd will be ensure if some crazy trojan is existed in your machine , you could check your computer with this antivirus cd

http://forum.avira.com/wbb/index.php...threadID=82163

burning with ( from clean computer )

http://www.majorgeeks.com/ImgBurn_d4870.html :wave

 

Hello falconattack/mastermiaow

To supplement falconattack's comment, here is some information:

http://www.2-spyware.com/file-csrss-exe.html

In task manager processes tab, have you noticed multiple/several instances of CSSRS.exe? Could be as falconattack said a sign of undetected malware...

 

Thanks for this. I don't think it is malware because I have just run a comprehensive test through the malware removal forum. Also it is just one csrss.exe process that is running.
I did try the link from Falconattack but it is not working:
http://forum.avira.com/wbb/index.php...threadID=82163

When I search for csrss.exe, it comes up in four locations:
C:\windows\$NtServicePackUninstall$
C:|windows\system32
C:\windows\servicepackfiles\i386\
C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356

Maybe the problem is just old computer? (I have defragged and run CC cleaner etc..)

 

You can try this link my friend

http://forum.avira.com/wbb/index.php?page=Thread&threadID=82163

sometimes ccleaner is creating a lot of problem :wave

 

Mastermiaow: If this is XP I think I might have some information. Is your thinkpad running a version of XP?

 

mastermiaow

If you are running XP, could your system need to be updated with Windows updates? Do you have SP2 or SP3?

Asking as my XP machine doesn't have CSRSS.exe in C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356.

With all searches on my XP machine for this post set to search hidden files and all hidden and system files visible, I do not find e9500597a78495f397efb821e37bf356 anywhere.

I do like you have a 4 instances of the CSRSS.exe, but the 4th is in C:\Windows\System32\dllcache

Lots of mentions of this file and SERVICES.exe and SMSS.exe in C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356 being mentioned in association with viruses. Apparently, there was a e9500597a78495f397efb821e37bf356 folder in the location you mentioned CSRSS.exe is in on your machine back several years. Since my architecture is different, I am just guessing that maybe SP2 or SP3 updated changed the architecture of XP when it comes to that folder. I have added both SPs.

IDK...maybe it was a security response to many problems like the ones FalconAttack has mentioned...

 

Hi Altbo

I have Windows XP with service pack 3 which I update when asked

Hi Falcon Attack

I ran the Avira CD last night and it found a trojan, so I was wrong thinking all the Malware removal steps I had taken was the end of things
Instruction 9 of the Rescue CD Tutorial states:
9) Boot on Windows normally. Run a full system scan with AntiVir to quarantine all the renamed files (.XXX extension).
thought I would do a search for .xxx extension files to see if I could just scan for the folder where the .xxx files are but the search didn't find anything. So I am now doing a scan with the avast free antivirus programme that I have. However as I did a system scan as part of the malware removal steps I am not sure why it should find something this time...?

 

If you have Service Pack 3, I don't understand how your XP architecture could be different than mine. I don't have CSRSS.EXE in the C:\WINDOWS\SoftwareDistribution\Download folder...:confused

If it interests you, you could check to see if you have this folder, which you did not list as a location of CSRSS.EXE: C:\WINDOWS\system32\dllcache. This contains CSRSS.exe on my PC...

Perhaps falconattack can help you with the virus issue better than I, or perhaps you could revisit the malware board...

 

Don't worry Avira is a deeply/strongly scanner , you have to look at AtlBo's suggestions :wave

 

Thanks

As I suspected the Avast anti virus scanner didn't find anything despite a full system scan so now I am going to download and install avira and see if that finds the Trojan and will let you know

Matthew

 

Also I checked to see if I have a folder dllcache in C:\WINDOWS\system32\ and I don't - just lots of dll files...

 

My mistake mastermiaow, C:\WINDOWS\system32\dllcache is a hidden folder. If you didn't know this, you will only be able to see hidden folders if you open a folder and then do this:

Click on the folder menu header "Tools"->"Folder Options"->"View" tab

Where it shows a folder icon and you see a choice button titled "Show hidden files and folders", select that option. Then look down about 2 check boxes and unselect "Hide protected operating system files (Recommended)". Click "Apply" and then "Yes" to approve the change.

When you get done looking for the folder in its location, just undo the above, so that all OS and system files will go back to hidden...

 

Hi

The good news is that Avira found the TR/Trash.Gen Trojan! :-D I am attaching the log. I also followed Altbo's advice and found the dllcache folder although there were no csrss.exe files in it. Too be honest I am not that bothered about this as I think the Trojan was probably responsible for all sort of strange things going on..
The bad news is that the sound is still not working despite downloading new drivers and uninstalling and reinstalling the soundmax thing...:cry

Thanks again for all your help anyway buddies!

Mastermiaow

 

Since you found something there is a chance it may re-spawn, some of these nasties do that.

So....

If I were you I'd head over to http://forums.majorgeeks.com/forumdisplay.php?f=35
and read http://forums.majorgeeks.com/showthread.php?t=35407
and then ask the malware jedis to have a look at it.

 

You have to look at this topic :wave

http://forums.majorgeeks.com/showthread.php?t=159453

 

Hi

The good news is that the computer is working a lot better No more sudden freezes... I toggled system restore so hopefully that is the end of the Trojan problem.
Sound is still not working so have gone to Hardware forum to see if I can resolve that.
Thanks again guys - I have learned a lot from you :wave

Mastermiaow