Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: up to 1000 csrss.exe process', under different session ID's, spanwing

11 Apr 2012   #1
irishdrunk

Windows 7 Professional 64-bit
 
 
up to 1000 csrss.exe process', under different session ID's, spanwing

This started happening recently, although I cannot pinpoint an action that could have caused it.

I was messing around with

GPRESULT and GPUPDATE, and added a custom event with EVENTCREATE in cmd around the time it started doing a project for class.

I have scanned with Avira and Malwarebytes and its all clean. The separate csrss.exe process's each start up under their own Session ID (and are the only process' belonging to that session ID) They have gotten as high as 1000.

Does anyone know what is going on and how I can fix this?? I don't have any restore points available to use, and my one and only recent complete backup was a few days after this started...

If I had to try and narrow it down to something, it would be maybe running GPUPDATE from the CLI...that's the closest thing timeframe-wise to when it started


My System SpecsSystem Spec
11 Apr 2012   #2
Sub Zero55

windows Home Premium 64 bit
 
 

My System SpecsSystem Spec
11 Apr 2012   #3
Jacee
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1

Download Mirror #2

•Copy the content of the following box into the main textfield:

Code:
::filefind
csrss.exe
Right click on SystemLook.exe, click Run As Administrator
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan
The log can also be found on your Desktop entitled SystemLook.txt
My System SpecsSystem Spec
11 Apr 2012   #4
irishdrunk

Windows 7 Professional 64-bit
 
 

Quote   Quote: Originally Posted by Jacee View Post
download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1

Download Mirror #2

•Copy the content of the following box into the main textfield:

Code:
::filefind
csrss.exe
Right click on SystemLook.exe, click Run As Administrator
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan
The log can also be found on your Desktop entitled SystemLook.txt

Ran it, nothing, "No Context"
All instances of csrss.exe are always legit in System32, its the spanwing of separate Session ID's that is puzzling me...


System File Checker came back fine as well...

I already stated before I had no usable Restore Points available from before this started.
Thanks for the help so far guys, keep it coming
My System SpecsSystem Spec
11 Apr 2012   #5
karlsnooks

MS Windows 7 Ultimate SP1 64-bit
 
 

Only if you disabled system restore do you not have system restore points.
Win 7 creates system restore points without you even asking.

RESTORE TO A PREVIOUS SYSTEM RESTORE POINT
1) WIN | type SYSTEM RESTORE | ENTER | NEXT
|Choose a different restore point radio button
| NEXT


2) Show more restore pointscheckbox (lower left)


3) Highlight the desired restore point


4) Scan for affected programs(lower right)make a note of affected programs
5) CLOSE | NEXT | FINISH


WIN = key with the wavy Microsoft flag on top.
My System SpecsSystem Spec
11 Apr 2012   #6
irishdrunk

Windows 7 Professional 64-bit
 
 

Quote   Quote: Originally Posted by karlsnooks View Post
Only if you disabled system restore do you not have system restore points.
Win 7 creates system restore points without you even asking.

RESTORE TO A PREVIOUS SYSTEM RESTORE POINT
1) WIN | type SYSTEM RESTORE | ENTER | NEXT
|Choose a different restore point radio button
| NEXT


2) Show more restore pointscheckbox (lower left)


3) Highlight the desired restore point


4) Scan for affected programs(lower right)make a note of affected programs
5) CLOSE | NEXT | FINISH


WIN = key with the wavy Microsoft flag on top.
Maybe I should have listed my technical skill level in my original post. I am A+, N+, CCNA certified

I only have 5 points, 1 point from a full system image from October of last year, and 4 restore points, oldest being April 6 which is after this started.

I have protection on for C (Raid Volume) but not E: (Data Volume). I may have cleaned out older restore points at some point...I did run CCleaner not to long ago...

I want to repair install as a last resort. Thank you for your reply though...if you have any idea's you can be more technical with me
My System SpecsSystem Spec
11 Apr 2012   #7
karlsnooks

MS Windows 7 Ultimate SP1 64-bit
 
 

did you follow the procedure given?
My System SpecsSystem Spec
11 Apr 2012   #8
Jacee
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

Quote:
I was messing around with

GPRESULT and GPUPDATE, and added a custom event with EVENTCREATE in cmd around the time it started doing a project for class.
If you didn't write down what you did so as to reverse your actions (or backup the registry), then you may need to do a repair install.

Edit: Registry - Backup and Restore
My System SpecsSystem Spec
12 Apr 2012   #9
irishdrunk

Windows 7 Professional 64-bit
 
 

Quote   Quote: Originally Posted by karlsnooks View Post
did you follow the procedure given?
Yes
My System SpecsSystem Spec
12 Apr 2012   #10
karlsnooks

MS Windows 7 Ultimate SP1 64-bit
 
 

and how many choices were given?
My System SpecsSystem Spec
Reply

 up to 1000 csrss.exe process', under different session ID's, spanwing




Thread Tools





Similar help and support threads
Thread Forum
intel pro/1000 ct gigabit ethernet never can connect at 1000 only 100
This is a builtin device to motherboard, Intel server S875WP1-e I tried different cables, and moved switch next to PC. I also tried Ubuntu. The cables do work at gigabit speeds. So does anyone know why? It is enabled in the bios. And latest bios p18 is installed. I tried installing the...
Hardware & Devices
session manager initialization system process terminated unexpectedly
BSOD: The session manager initialization system process terminated unexpectedly with a status of 0xc000003a (0x00000000, 0x00000000) I'm getting this on a shop system running Win 7 Home Premium 32 bit. The last thing I did was shutdown before going home and I believe it installed an update then...
General Discussion
BSOD win32k.sys debug references csrss.exe process
Hi All, I have a brand new build that worked fine, stress testing and all, until the IT company for the business I built it for got it attached to the network and installed a bunch of printers, etc. (the computer is at a printing company). I went in shortly after they left and received a blue...
BSOD Help and Support
Unravelling CSRSS.exe and the new process architecture of Windows 7
One of the things I first noticed in Windows 7 is how now there are many "hidden" processes not shown in the normal tab of Task Manager, and instead lumped into the "Services" tab yet still somehow connected or underneath the 'umbrella' of other processes. I used to know all the processes that run...
General Discussion
Internet explorer last browsing session opens up many session points!
In internet explorer when i open it up and restore my last session it opens up many windows, including my last session, a session i may have had 2 weeks ago and other sessions?
Browsers & Mail

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 07:01.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App