CSRSS.EXE - What is it and why is it taking up all the CPU time?

[Chris B]

Headline says it... what is this process and what does it do?

Should it be taking up 69% of the CPU time?

EDIT: This is an NT machine with service pack 6.

[High_Jumbllama]

http://securityresponse.symantec.com...lbug.worm.html

I'm possibly being paranoid here, but check your %windir% (c:\winnt I believe for the file. The file should not be there though it will be in your system 32 directory.

[Dr Mordrid]

http://www.viruslist.com/eng/viruslist.html?id=51071

Dr. Mordrid

[The PIT]

Ah someone else not updating their virus checkers.
Wouldn't be surprised if you got another virus hiding on there as well.

[Dr Mordrid]

I've had NAV set up for automatic LiveUpdate and it's been downloading new definitions at least twice a day since this latest outbreak started.

As such if anyone out there has LiveUpdate turned off you might want to turn it back ON 'til things calm down.....if ever.

Dr. Mordrid

[Rakido]

It's not necessarily a virus. To answer your first question:

Csrss.exe - You cannot end this process from Task Manager.

This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment.

There are a couple of reasons for csrss.exe slowing down the system, you could check the Microsoft knowledge base if any of this applies to you: http://support.microsoft.com/search/...&srchExtraQry=



Rakido

[The PIT]

Originally posted by Dr Mordrid
I've had NAV set up for automatic LiveUpdate and it's been downloading new definitions at least twice a day since this latest outbreak started.

As such if anyone out there has LiveUpdate turned off you might want to turn it back ON 'til things calm down.....if ever.

Dr. Mordrid

Sadly most users just think installing the software is enougth. They don't even know how to configure autoupdates.

[Technoid]

Originally posted by The PIT
Sadly most users just think installing the software is enougth. They don't even know how to configure autoupdates.

I remember that Nav 2000 required you to check some checkboxes to actualy GET the updates and one of my brighter customer didnt do this because then it took so loong time

Me: Your computer is FULL of viruses.
Customer: But I've got nav!!
M: But you havent upodated it in 10 months.
C: But I run the quick one every day!!
M:quick one?!?!
C: Yeah, I don't tick the boxes and then it don't take 20 min as it did the first times!! (looking really proud of himself)
M: URGH!!!

I then tried in wain for quarter of an hour to make some sence go through his thick skull
In the end it was fortunatley time to upgrade Nav anyway and the new version did not containe the "quick download" to his utter sorrow

[The PIT]

I just wish Msblast deleted hard drives after 20 succesfully infections or X days on a pc. The delete would have to be a ministry defence wipe so data couldn't be retrieved. Users would then remember about backups and updates. It was also force the University too think of a response to virus outbreaks.