[Renna]

HI! Please help, I've run mcafee software suite and numerous other scans and come up with nothing. CPU is constantly around the 100% when there's nothing open. My hour glass is constantly attached to my arrow! I think it might be something to do with this csrss.exe problem that other people are having but I'm just not sure.
Can you please help me! I would be eternally greatful. I need my puter

[Advertisements]

we find this problem is often related to a corrupt index.dat file, which is a pain to delete manually

download crapcleaner and check the setting to clean index.dat (for our purposes, only clean index.dat under Internet Explorer and temporary files under system)

click clean

then reboot.

fix?


http://www.ccleaner.com/

[gerryf]

we find this problem is often related to a corrupt index.dat file, which is a pain to delete manually

download crapcleaner and check the setting to clean index.dat (for our purposes, only clean index.dat under Internet Explorer and temporary files under system)

click clean

then reboot.

fix?


http://www.ccleaner.com/

[Renna]

Hi!

Downloaded crap cleaner. It cleaned the index.dat file, it also cleaned something to do with the csrss.exe file but it's still going nuts with the cpu usage!
Is there anything else I can try? The hourglass is still on all the time. Working it's little heart out for nothing?
Thank you sooo much for all your help.

Ren

[emery]

How many running processes show up in taskmanager?

[Renna]

Quite a lot! And it's fluctuating as I look at it.... rouhgly about 45-50? I am completely clue-less when it comes to computer viruses and all that jazz so sorry if I come across as a complete bimbo!

[Renna]

But the CPU usage that comes up along side hem on task master is mostly 00. there are a handful that are running between 01 and 12. There are 2 that stand out as higher, file types are mghtml.exe at beween 12 and 22 (which I'm assuming is the web?? I use firefox) and that csrss.exe which is always changing between 60 and 78.

[happyrock]

This file is actually a Client/Server Runtime Server Subsystem ... This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment. The csrss.exe which is from Microsoft is located in the c:\windows\System32 folder. It has been noted that one virus had been found that runs as csrss to hide from you.



Csrss.exe uses 100% of the CPU When you Right-Click an item in Explorer
Author:Brian Desmond MVP

SYMPTOMS
Csrss.exe uses 100% of the CPU When you Right-Click an item in Windows Explorer or on the desktop

CAUSE
Your user profile is corrupt.

RESOLUTION
Before continuing, make sure you have backed up the contents of your My Documents folder, and any other important data stored in your profile such as application settings. Once your profile is deleted, you will not be able to recover data stored inside of it.

In order to delete your profile, you must be logged in with an account which has administrative privileges which is also not yours. Once you are logged in, open the user profiles list. To locate the list of local user profiles, right-click My Computer, click Properties, and then on the Advanced tab, click Settings under User Profile. Select your profile from the list, and then click Delete.

Logoff, and then log back on as yourself. A new profile will be created when you log on.

for the complete text go here...

http://support.micro...om/?kbid=555021

[Renna]

Ok, deleted my user profile. CPU useage is still going mental (the csrss.exe process). I have a "guest" profile on my computer but it never gets used. Do I have to delete that one as well?
I've seen others using Hijack This and sending you the report, will that help?

Thank you so much for all your help though. I'm so lost when it comes to this!

[Fenor]

Lets take a look at what is starting up when your computer does. Please download HiJackThis (from the link in my signature) Install it, and double-click on the HiJackThis.exe icon. On the first screen click on Open the Misc Tools Section...On the next screen, click on the Generate StartupList log button and post a copy of the log here. You need not check either of the boxes next to this button.

Fenor

[Renna]

Here's what I got....




StartupList report, 7/16/2006, 1:35:54 PM
StartupList version: 1.52.2
Started from : C:\DOCUMENTS AND SETTINGS\SERENITY HARBOUR\DESKTOP\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\PROGRA~1\MOZILL~1\firefox.exe
C:\DOCUMENTS AND SETTINGS\SERENITY HARBOUR\DESKTOP\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

IgfxTray = C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds = C:\WINDOWS\system32\hkcmd.exe
UpdateManager = "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
HPHUPD05 = c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
HP Software Update = "c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
HPHmon05 = C:\WINDOWS\system32\hphmon05.exe
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe
eabconfg.cpl = C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
NeroCheck = C:\WINDOWS\system32\NeroCheck.exe
IMJPMIG8.1 = "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
MSPY2002 = C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
PHIME2002ASync = C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A = C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
Workflow = D:\Workflow.exe
VSOCheckTask = "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
VirusScan Online = C:\Program Files\McAfee.com\VSO\mcvsshld.exe
OASClnt = C:\Program Files\McAfee.com\VSO\oasclnt.exe
MCAgentExe = c:\PROGRA~1\mcafee.com\agent\mcagent.exe
MCUpdateExe = C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
MPFExe = C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
MPSExe = c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
MSKAGENTEXE = C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
MSKDetectorExe = C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

AVG7_Run = C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E}
McAfee PopupKiller - c:\program files\mcafee.com\mps\popupkiller.dll - {3EC8255F-E043-4cae-8B3B-B191550C2A22}
(no name) - c:\program files\mcafee\spamkiller\mcapfbho.dll - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000}
(no name) - (no file) - {549B5CA7-4A86-11D7-A4DF-000874180BB3}
(no name) - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll - {9394EDE7-C8B5-483E-8773-474BF36AF6E4}
(no name) - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
(no name) - (no file) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}

--------------------------------------------------

Enumerating Task Scheduler jobs:

McAfee.com Scan for Viruses - My Computer (SERENITY-Serenity Harbour).job

--------------------------------------------------

Enumerating Download Program Files:

[MSN Photo Upload Tool]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll
CODEBASE = http://by103fd.bay10...es/MsnPUpld.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll

--------------------------------------------------
End of report, 7,535 bytes
Report generated in 0.016 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

[Fenor]

Wow, you must have the entire McAfee Security suite installed.... what I suggest you do is uninstall everything to do with McAfee from ADD/REMOVE PROGRAMS int he Control Panel, rebooting when needed. Once you are done, do not surf anywhere else on the net, but come back directly here and I will tell you good Antivirus and Antispyware programs that you should install that will cause way less havoc on your machine.

Fenor

[Renna]

Well we got the McAfee suite because of the problem we are having now....we thought it would be able to find the problem but it doesn't? Is there anything else I can check before uninstaling the suite? Only coz after downloading a heap of anti virus stuff from the internet (that caused even more trouble....most likely coz I have NO idea!) I decided to fork out for a security suite.

[Renna]

I only ask if there is something else that I can do because I hope I haven't wasted money on buying a security suite and that we had this prob before we installed it. Sorry to be sounding fussy but every pound counts these days and I would hate to think that I've spent 50pounds for nothing (

[computerwiz12890]

Please download filemon. After downloading, unzip it to your desktop.

Before we get started, I want you to be familiar with the Capture button so you can find it quickly when we do this. Open Filemon. Note the button at the top that looks like a magnifying glass. Pressing that button will stop Filemon from recording (capturing) the activity of your computer. That is the button you will be pressing when I say to.

Now exit out of Filemon. Exit all non-essential programs (the ones in the taskbar next to the clock. Do this by right-clicking on them and selecting exit or close.) Now we will use Filemon.

We are going to do this fairly fast: Open Filemon and then immediately open one of the programs that are giving you the 100% usage problem (unless it is occurning all the time, then you won't have to open a program). Let the computer sit for about 30 seconds. Return to Filemon (if it is not visible) and click on the magnifying glass button at the top. Now click on File > Save as... and save the log to your desktop. Attach that log to your reply to me.

NOTE: The log will be EXTREMELY long. So please attach it rather than post it out. If necessary, you may even have to compress it by putting it a zipped (compressed) folder.

[Renna]

I clicked on the link on your post....and at the risk of sounding like a omplete retard....!!!!! I get a screen that pops up that has a nember of icons along the top. the first one is "add" then "Extract to" I'm just scared of doing the wrong thing is all! The only one that looks like a magnifying glass is the one that says "view"....and it give me a bunch of jargon rubbish when I click it. I'm not sure if it will help at all but there are items that come up in the larger screen. And when I double click on Filemon.exe it gives me a MASSIVE log of info!!!! Is that what you are after? Sorry if I'm sounding like a numpty but I'm so unsure when it comes to these things!