Unravelling CSRSS.exe and the new process architecture of Windows 7

One of the things I first noticed in Windows 7 is how now there are many "hidden" processes not shown in the normal tab of Task Manager, and instead lumped into the "Services" tab yet still somehow connected or underneath the 'umbrella' of other processes. I used to know all the processes that run in Windows, and which I could kill and which I couldn't. After this Services tab I've kinda given up on that due to the sheer number.

I hope to help change that with this thread. Finally deciding to create a whitelist in my head of these Services like I used to have for all Windows processes. The first problem I'm noticing is that if a service is loaded under a critical process (like CSRSS.exe), then there is no obvious way to kill it. What is the way around this?

This seems like a huge security vulnerability, because what if a virus installs to being under the 'umbrella' of CSRSS.exe? There is an anti-cheat program called PunkBuster that is needed to play games like Battlefield 3. I noticed that PnkBstrA is part of the CSRSS.exe

I decided to reinstall this game tonight, as well as Punkbuster and Origin. (both software related to this game only for me) After uninstalling all 3 software, deleting all related folders from my HD, and deleting all leftover registry keys related to them and parent companies I noticed PnkBstrA was somehow STILL running! I hit Stop process, nothing. I hit Go To Process, and it took me to CSRSS.exe ... well darn. I know from experience you can't kill CSRSS.exe and expect Windows to keep running.

I'm amazed at this, I did not think it was possible for anything to survive in Windows after uninstall, file delete, registry key delete...

Anyways, I was already 15 minutes into downloading the game files when I noticed this so I'm going to have to just hope its a "clean" re-installation and overlook this. Mainly posting this out of curiosity and hoping to pick up a couple of pointers that might help me in the future manually remove advanced viruses that take advantage of this vulnerability.

TL;DR: How can you kill a non-windows 7 service that has itself injected into an essential windows 7 service? (other than via taskmgr since that doesn't always work correctly)

I'm downloading/installing the whole package again so I'm not messing with it. If this doesn't fix the issue I'll simply reinstall Windows. That might not even be it, and I could use a new motherboard. Just trying to stop random system crashes that only happen during 1 game. Not sure if heat, driver issue, other software issue, etc.

Mainly just posted this to learn about the Services tab in Task Manager, and learn more about how there are now processes within processes.

It's almost as if the Services are to Processes, as the old DLLs were to Processes.

joe7dust, what you describe is nothing new. NOTHING. Services were always lumped under a process like svchost.exe. The only real difference is task manager has a service tab now so you can see them. Can we get a few screenshots of the issue you are talking about?

Well, remember that you *did* have to provide administrative credentials (and if UAC is enabled, elevate the install) to allow this. It's a security risk, yes, but it's not possible unless the person running the code has administrative access. There's not a whole lot any system can do to prevent a system's administrators from blowing it up, if the user really is to have administrative access and decides to do something stupid.

Hence why running as administrator isn't a good idea on a day-to-day basis, paying attention to what one installs when they do elevate, etc.

Is the below image what you are talking about of PnkBstrA.exe being loaded within CSRSS.exe? If so...its not being loaded within CSRSS.exe nor is it hidden. It just means CSRSS.exe loaded PnkBstrA.exe and is now a parent process. Otherwise I have no idea what you are going on about.