up to 1000 csrss.exe process', under different session ID's, spanwing

[irishdrunk]

This started happening recently, although I cannot pinpoint an action that could have caused it.

I was messing around with

GPRESULT and GPUPDATE, and added a custom event with EVENTCREATE in cmd around the time it started doing a project for class.

I have scanned with Avira and Malwarebytes and its all clean. The separate csrss.exe process's each start up under their own Session ID (and are the only process' belonging to that session ID) They have gotten as high as 1000.

Does anyone know what is going on and how I can fix this?? I don't have any restore points available to use, and my one and only recent complete backup was a few days after this started...

If I had to try and narrow it down to something, it would be maybe running GPUPDATE from the CLI...that's the closest thing timeframe-wise to when it started

 

[Sub Zero55]

Try http://www.sevenforums.com/tutorials/700-system-restore.html?ltr=S

Then try http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html?ltr=S

Still not fixed, try http://www.sevenforums.com/tutorials/3413-repair-install.html?ltr=R

 

[Jacee]

download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1

Download Mirror #2

•Copy the content of the following box into the main textfield:

::filefind
csrss.exe

Right click on SystemLook.exe, click Run As Administrator

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan

The log can also be found on your Desktop entitled SystemLook.txt

 

[irishdrunk]

download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1

Download Mirror #2

•Copy the content of the following box into the main textfield:

::filefind
csrss.exe

Right click on SystemLook.exe, click Run As Administrator

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan

The log can also be found on your Desktop entitled SystemLook.txt

Ran it, nothing, "No Context"
All instances of csrss.exe are always legit in System32, its the spanwing of separate Session ID's that is puzzling me...


System File Checker came back fine as well...

I already stated before I had no usable Restore Points available from before this started.
Thanks for the help so far guys, keep it coming

 

[karlsnooks]

Only if you disabled system restore do you not have system restore points.
Win 7 creates system restore points without you even asking.

RESTORE TO A PREVIOUS SYSTEM RESTORE POINT
1) WIN | type SYSTEM RESTORE | ENTER | NEXT
|Choose a different restore point radio button
| NEXT


2) Show more restore points checkbox (lower left)


3) Highlight the desired restore point


4) Scan for affected programs (lower right)make a note of affected programs
5) CLOSE | NEXT | FINISH


WIN = key with the wavy Microsoft flag on top.

 

[irishdrunk]

Only if you disabled system restore do you not have system restore points.
Win 7 creates system restore points without you even asking.

RESTORE TO A PREVIOUS SYSTEM RESTORE POINT
1) WIN | type SYSTEM RESTORE | ENTER | NEXT
|Choose a different restore point radio button
| NEXT


2) Show more restore points checkbox (lower left)


3) Highlight the desired restore point


4) Scan for affected programs (lower right)make a note of affected programs
5) CLOSE | NEXT | FINISH


WIN = key with the wavy Microsoft flag on top.

Maybe I should have listed my technical skill level in my original post. I am A+, N+, CCNA certified

I only have 5 points, 1 point from a full system image from October of last year, and 4 restore points, oldest being April 6 which is after this started.

I have protection on for C (Raid Volume) but not E: (Data Volume). I may have cleaned out older restore points at some point...I did run CCleaner not to long ago...

I want to repair install as a last resort. Thank you for your reply though...if you have any idea's you can be more technical with me

 

[karlsnooks]

did you follow the procedure given?

 

[Jacee]

I was messing around with

GPRESULT and GPUPDATE, and added a custom event with EVENTCREATE in cmd around the time it started doing a project for class.

If you didn't write down what you did so as to reverse your actions (or backup the registry), then you may need to do a repair install.

Edit: http://www.sevenforums.com/tutorials/4230-registry-backup-restore.html

 

[irishdrunk]

did you follow the procedure given?

Yes

 

[karlsnooks]

and how many choices were given?

 

[karlsnooks]

What I mean is: How many restore points are listed?

 

[cyclic]

As you will know, wery often the last thing you did before a problem starts, is the thing that caused it.
I was wondering from your OP you say you added a custom event with EVENTCREATE .
What event and what was the syntax used, and if any the resulting output.

 

[irishdrunk]

and how many choices were given?

It has changed since I uninstalled some stuff, but only a few recent, plus the last system image from october

 

[irishdrunk]

As you will know, wery often the last thing you did before a problem starts, is the thing that caused it.
I was wondering from your OP you say you added a custom event with EVENTCREATE .
What event and what was the syntax used, and if any the resulting output.

Yep, that's why I was hoping to track it down to running a GPUpdate (don't see exactly how that caused it) or the EventCreate (don't see there either... )


It was to System log, a Warning, EventID 999, Source= EventCreate, Level 3 Event.


These instances of csrss.exe don't seem to happen when not on the network either. I am completely baffled on this, been searching and searching for days. Bug? Hacked? guh....lol

 

[Jacee]

Your images are too small to read in photobucket!

 

[Sub Zero55]

and how many choices were given?

It has changed since I uninstalled some stuff, but only a few recent, plus the last system image from october

http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html?ltr=S

 

[irishdrunk]

There we go. That's it for restore points.

 

[karlsnooks]

Click on that button for Affected Programs so that you have an idea of you will need to reinstall.

Choose the most recent restore point and see if problem is gone. If not choose the other restore point and do the same thing.

You will need to then perform a full and complete update of your Win 7.

UPDATING YOUR WIN 7
ASSURE THAT YOU RECEIVE ALL UPDATES
WIN | type WINDOWS UPDATE | ENTER |
Change settings (left-hand column) |
checkmark all four of the boxes | OK button

Approve any dialog boxes presented. Let Windows install any update features.

WIN is the key with the Microsoft flag on top.

INSTALL CRITICAL UPDATES
Check for Updates (left-hand column)
Install ALL critical updates.
Restart your computer (even if not prompted)

Repeat this procedure until there are no more critical updates.

DO NOT TRUST the “Windows is up to date” in center of dialog. until you see that TWICE IN A ROW!

INSTALL IMPORTANT UPDATES
Use the “critical update” procedure until all important updates are installed.

INSTALL OPTIONAL UPDATES
Use the “critical update” procedure until all optional updates are installed.

Under Optional updates you will be presented with a list of about 34 language updates.
You can hide those updates so that aren't continually notified of those updates. When you click on 34 optional updates are available, then you
a) highlight all of the language updates,
b) right-click anywhere in the highlighted list.
c) click on Hide Updates,
d) OK button.


UPDATE GOLDEN RULES
Install ALL, yes, ALL updates.
This is Win 7 and not Vista or XP (eXPired).

UPDATE IS HUNG –TAKING FOREVER
Hung is very doubtful unless you interrupted updates.

CTRL + SHIFT + ESC key combo will pop-up the Task Manager.
Lo and behold, Windows Update is still running!

You hold down the CTRL and SHIFT keys.
While holding them down, tap the ESC key once.

 

[irishdrunk]

Click on that button for Affected Programs so that you have an idea of you will need to reinstall.

Choose the most recent restore point and see if problem is gone. If not choose the other restore point and do the same thing.

You will need to then perform a full and complete update of your Win 7.

UPDATING YOUR WIN 7
ASSURE THAT YOU RECEIVE ALL UPDATES
WIN | type WINDOWS UPDATE | ENTER |
Change settings (left-hand column) |
checkmark all four of the boxes | OK button

Approve any dialog boxes presented. Let Windows install any update features.

WIN is the key with the Microsoft flag on top.

INSTALL CRITICAL UPDATES
Check for Updates (left-hand column)
Install ALL critical updates.
Restart your computer (even if not prompted)

Repeat this procedure until there are no more critical updates.

DO NOT TRUST the “Windows is up to date” in center of dialog. until you see that TWICE IN A ROW!

INSTALL IMPORTANT UPDATES
Use the “critical update” procedure until all important updates are installed.

INSTALL OPTIONAL UPDATES
Use the “critical update” procedure until all optional updates are installed.

Under Optional updates you will be presented with a list of about 34 language updates.
You can hide those updates so that aren't continually notified of those updates. When you click on 34 optional updates are available, then you
a) highlight all of the language updates,
b) right-click anywhere in the highlighted list.
c) click on Hide Updates,
d) OK button.


UPDATE GOLDEN RULES
Install ALL, yes, ALL updates.
This is Win 7 and not Vista or XP (eXPired).

UPDATE IS HUNG –TAKING FOREVER
Hung is very doubtful unless you interrupted updates.

CTRL + SHIFT + ESC key combo will pop-up the Task Manager.
Lo and behold, Windows Update is still running!

You hold down the CTRL and SHIFT keys.
While holding them down, tap the ESC key once.

I have been fully updated this whole time, although I appreciate the help.

I think maybe this isn't the right place to discuss this issue, as I was looking for insight into a deeper understanding of how Windows works, as to what could be causing this issue, not so much just restore/repair. I'm a couple days into basically proving how many restore points I have. I tried to lay it down that I'm educated a bit more than average and that I knew what I was talking about...it think most of the posts I'm going to get here are going to be basic troubleshooting tips that I'm already aware of...

Basically I was looking for help with solving the problem outside of the recovery environment, knowing there are no issues with system files or permissions...

If anyone would like to help, or can, without talking about restore options, feel free to chime in. Does this thread belong in a different sub-forum?
Thanks

 

[carwiz]

I haven't read through the entire thread but it's clear you have chosen to limit the number of restore points. Windows Update will usually create a restore point so you should have at least one per month.

Have you tried deleting your profile and making a new one? A corrupt profile will sometimes cause multiple Csrss.exe programs to start.