PDA

View Full Version : csrss.exe process in Windows 7



user123
18-01-2011, 05:02 PM
Hi guys
I'm just curious about what the csrss.exe process does, why is it located in %%USERPROFILE%\AppData\Roaming\Microsoft\System\Se rvices\csrss.exe, and why does it lauch at startup? Now when I start up there is a quick cmmand prompt window that starts and closes very quickly. Can someone help me?
Here is my startup list:

HKLM:Run | HDAudDeck | C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
HKLM:Run | Adobe Reader Speed Launcher | "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
HKLM:Run | Adobe ARM | "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM:Run | csrss.exe | C:\Users\Owner\AppData\Roaming\Microsoft\System\Se rvices\csrss.exe
HKLM:Run | IME14 CHT Setup | C:\PROGRA~2\COMMON~1\MICROS~1\IME14\SHARED\IMEKLMG .EXE /SetPreload /CHT /Log
HKLM:Run | IME14 JPN Setup | C:\PROGRA~2\COMMON~1\MICROS~1\IME14\SHARED\IMEKLMG .EXE /SetPreload /JPN /Log
HKLM:Run | IME14 KOR Setup | C:\PROGRA~2\COMMON~1\MICROS~1\IME14\SHARED\IMEKLMG .EXE /SetPreload /KOR /Log
HKLM:Run | IME14 CHS Setup | C:\PROGRA~2\COMMON~1\MICROS~1\IME14\SHARED\IMEKLMG .EXE /SetPreload /CHS /Log
HKLM:Run | BCSSync | "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
HKLM:Run | IgfxTray | C:\Windows\system32\igfxtray.exe
HKLM:Run | HotKeysCmds | C:\Windows\system32\hkcmd.exe
HKLM:Run | Persistence | C:\Windows\system32\igfxpers.exe
Startup User | MagicDisc.lnk | C:\Program Files (x86)\MagicDisc\MagicDisc.exe

Thanks

Speedy Gonzales
18-01-2011, 05:40 PM
It shouldnt be in startup. Delete its entry, with something like ccleaner then reboot

You can delete this entry too

HKLM:Run | Adobe Reader Speed Launcher | "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

wainuitech
18-01-2011, 05:41 PM
Csrss.exe is Client Server Runtime Process -- Its an important part of windows. If you bring up the Task Manager, right click it - open file location it should be in the Windows/ System32 folder. bit more about it (http://www.processlibrary.com/directory/files/csrss/26031/)


Some infections can also mask themselves as the csrss file.

May pay to do a full virus and malware scan -- what security do you have installed?

user123
18-01-2011, 09:55 PM
It shouldnt be in startup. Delete its entry, with something like ccleaner then reboot

You can delete this entry too

HKLM:Run | Adobe Reader Speed Launcher | "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

Thanks Speedy, I have removed both entries.


Csrss.exe is Client Server Runtime Process -- Its an important part of windows. If you bring up the Task Manager, right click it - open file location it should be in the Windows/ System32 folder. bit more about it (http://www.processlibrary.com/directory/files/csrss/26031/)


Some infections can also mask themselves as the csrss file.

May pay to do a full virus and malware scan -- what security do you have installed?

For some reason it's in my AppData\Roaming folder. Is there any reason why?
I use Avast Internet Security 5. Is it good?

The Error Guy
18-01-2011, 10:09 PM
It's because it's hidden. open explorer and press alt, then tools > folder options and check the box that says "show hidden files and folders"