csrss.exe, what is it?

just looking at my task manager i have a couple of tasks going that dont give any discription, and i was wondering what is it? i have heard its a worm is that true? what should i do to get rid of it if it is something dangerous?

 

Try ending the process, and if it is not a worm, you'll get a BSOD. There are a couple of these running in Vista, and ending one of them gives a BSOD.
http://www.neuber.com/taskmanager/process/csrss.exe.html (Read all the User Opinions)

 

but aint BSOD bad?

right it seems legit now, after pressing perform admin tasks i get the descpription of "client server runtime process" but i have two of them now, is that right?

 

If you visit the website linked in Andy's post, it explains where the legitimate version of csrss.exe lives. Any time you have a question about a process, just google for it - you'll get hits from neuber.com and liutilities.com.

The same goes for a potential virus. Google for it, and then follow the cleaning instructions listed.

 

BSOD isn't bad. It doesn't damage the system, etc. But if you don't wanna run it, its fine.

You can go into the System32 folder and search for csrss.exe, and run a vscan on it. (*.exe/*.mui)

 

whats vscan?

 

Virus-scan

 

okay, i cant find it in the system32 folder

 

Haha....if Vista just start searching typing "csr" in the search bar. I got 3-4 instances of it.

 

"no items match your search"

what does that mean, well other then the computer not being able to find it

 

Oh, weird. Well, legit or not. Looks like you won't need to bother about it.

 

i did a avanced search of everywhere and still found nothing.
how did you change your window to that colour, thats cool

 

It's part of Vista, you need it, don't mess with it.

 

im not now, i was just checking as i found it strange that it didnt have a description

 

ProjectX 2

 

The description "Client Server Runtime Process" is there when you look at that process as an administrator.

 

yeah i found that out after attemping to end it when i saw the process description i decided not to

 

thanx. shame you have to do that vistaglazz thing i dont want to risk screwing everything up

 

I just found the old minidump I had. I terminated csrss.exe to check if minidumps were being saved or not.

Code:

...............................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8003c0e040, Terminating object
Arg3: fffffa8003c0e278, Process image file name
Arg4: fffff80001f12370, Explanatory message (ascii)

Debugging Details:
------------------


PROCESS_OBJECT: fffffa8003c0e040

IMAGE_NAME:  csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000

PROCESS_NAME:  taskmgr.exe

BUGCHECK_STR:  0xF4_taskmgr.exe

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80001f743e3 to fffff80001c6e390

STACK_TEXT: 
fffffa60`14944b28 fffff800`01f743e3 : 00000000`000000f4 00000000`00000003 fffffa80`03c0e040 fffffa80`03c0e278 : nt!KeBugCheckEx
fffffa60`14944b30 fffff800`01f19a04 : fffffa80`04f3d060 fffffa80`04f3d060 00000000`000001c4 00000000`000202e8 : nt!PspCatchCriticalBreak+0x93
fffffa60`14944b70 fffff800`01ecddd8 : fffffa80`04f3d060 00000000`00000008 00000000`000001c4 fffff800`00000008 : nt! ?? ::NNGAKEGL::`string'+0x11496
fffffa60`14944bc0 fffff800`01c6de33 : fffffa80`03c0e040 fffffa80`04f3d060 fffffa60`14944ca0 00000000`000001c4 : nt!NtTerminateProcess+0xd8
fffffa60`14944c20 00000000`76eb5d3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0018eda8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76eb5d3a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4_taskmgr.exe_IMAGE_csrss.exe

BUCKET_ID:  X64_0xF4_taskmgr.exe_IMAGE_csrss.exe

I didn't do any Vistaglazz thing....

 

You don't have to do vistaglazz if you have SP1 (according to bob's guide here in NBR!!!) Its for people who have not yet upgraded to SP1 if I remember right... (can't find that guide now.. darn!!)

Edit: ah found it > http://forum.notebookreview.com/showthread.php?t=222947

 

really? i might have a look for it, thanx for the heads up.