What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

crss.exe problem - hijackthislog

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
ive got strange problems with a crss.exe process that takes up almost full cpu..

ran a couple of tools that said they would help, but they didnt.. help would be reaaaaaaally appreciated!

cheers,
thijs


Logfile of HijackThis v1.99.1
Scan saved at 12:59:01 AM, on 11/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Sitecom\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NETGEAR\SC101 Manager Utility\ZeteraService.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Elaborate Bytes\DVD Region Killer\RegKillTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\CleanMyPC\Registry Cleaner\RCScheduler.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TerraTec\DMX 6fire\DMX6Fire.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\Documents and Settings\Thijs.THIJS-INTERNET-\Desktop\HijackThis\HijackThis.exe
C:\Program Files\Samsung\Samsung PC Studio 3\Update\LiveUpdate.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://mijn.postbank.nl/internetbankieren/SesamLoginServlet
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [RegKillElbyCheck] "C:\Program Files\Elaborate Bytes\DVD Region Killer\ElbyCheck.exe" /L RegKill
O4 - HKLM\..\Run: [RegKillTray] "C:\Program Files\Elaborate Bytes\DVD Region Killer\RegKillTray.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LiveUpdate] "C:\Program Files\Samsung\Samsung PC Studio 3\\Update\Copyer.exe" -R
O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Program Files\CleanMyPC\Registry Cleaner\RCScheduler.exe" /startup
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE" -turbo
O4 - Global Startup: DMX 6fire 2496 ControlPanel.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Sitecom\Bluetooth Software\btsendto_ie_ctx.htm
O10 - Broken Internet access because of LSP provider 'xfire_lsp.dll' missing
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{20235617-89E2-4BFF-96BD-31BBA0E64725}: NameServer = 195.194.9.210
O17 - HKLM\System\CCS\Services\Tcpip\..\{9419B4BA-CD42-4F43-B4F1-8AD7F2B0A64F}: NameServer = 195.194.9.210
O17 - HKLM\System\CCS\Services\Tcpip\..\{A162E460-B4AA-4C09-834A-C9A6C7D0E420}: NameServer = 68.102.1.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0CFDA35-FEA2-475D-BBFF-E62FF9BD6E1F}: NameServer = 62.108.1.66
O17 - HKLM\System\CCS\Services\Tcpip\..\{BEF844D8-B081-4AEB-91D0-FD75BA877A6D}: NameServer = 195.194.9.210
O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Sitecom\Bluetooth Software\bin\btwdins.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Zetera - Zetera Corporation - C:\Program Files\NETGEAR\SC101 Manager Utility\ZeteraService.exe
Post #2
hi thijsnoisia,

http://www.processlibrary.com/directory/files/crss/
http://www.bleepingcomputer.com/startups/crss.exe-8777.html
——————————————————————————————————————————-
you antivirus is up to date? please do a online scan or two at one of these:

panda:Perform an online scan with Internet Explorer at Panda ActiveScan http://www.pandasoftware.com/products/activescan.htm

* Click on 'Scan your PC' button. There should be a popup - if you have a pop-up blocker, make sure it's not blocking it.
* Click 'Check Now' & a pop-up window will appear.
* Enter your Country, State and E-mail Address & click 'Scan Now' - begin downloading Panda's ActiveX controls (8 MB size).
* Begin the scan by selecting My Computer.
* If it finds any malware, it will offer you a report. Ignore any entry it finds (since it wants you to buy the program for removal) as we will address this later.
* Click on see report. Then click Save report.

Housecall at TrendMicro
http://housecall.trendmicro.com/housecall/start_corp.asp
check Auto Clean.

shelf life
Post #3 last edited
hi shelf life, thanks for the suggestions…

i ran housecall and after that i ran panda's scan and saved the log:


Incident Status Location

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt[.go.com/]
Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt[stat.onestat.com/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt[.cs.sexcounter.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Profiles\default\5qq0rkcx.slt\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Profiles\default\5qq0rkcx.slt\cookies.txt[statse.webtrendslive.com/]
Possible Virus. Not disinfected C:\Program Files\Logitech\SetPoint\Quicktour\fscommand\m_advanced.exe
Possible Virus. Not disinfected C:\Program Files\Logitech\SetPoint\Quicktour\fscommand\m_gaming.exe
Possible Virus. Not disinfected C:\Program Files\Logitech\SetPoint\Quicktour\fscommand\m_moves.exe


looks like i got a lot of trouble :(

here's my new HJT log (after the panda and housecall scans)

Logfile of HijackThis v1.99.1
Scan saved at 4:58:21 AM, on 11/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Sitecom\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NETGEAR\SC101 Manager Utility\ZeteraService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Elaborate Bytes\DVD Region Killer\RegKillTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\CleanMyPC\Registry Cleaner\RCScheduler.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TerraTec\DMX 6fire\DMX6Fire.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\WINDOWS\SYSTEM32\taskmgr.exe
C:\Documents and Settings\Thijs.THIJS-INTERNET-\Desktop\HijackThis\HijackThis.exe
C:\Program Files\mozilla.org\Mozilla\mozilla.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://mijn.postbank.nl/internetbankieren/SesamLoginServlet
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [RegKillElbyCheck] "C:\Program Files\Elaborate Bytes\DVD Region Killer\ElbyCheck.exe" /L RegKill
O4 - HKLM\..\Run: [RegKillTray] "C:\Program Files\Elaborate Bytes\DVD Region Killer\RegKillTray.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LiveUpdate] "C:\Program Files\Samsung\Samsung PC Studio 3\\Update\Copyer.exe" -R
O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Program Files\CleanMyPC\Registry Cleaner\RCScheduler.exe" /startup
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE" -turbo
O4 - Global Startup: DMX 6fire 2496 ControlPanel.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Sitecom\Bluetooth Software\btsendto_ie_ctx.htm
O10 - Broken Internet access because of LSP provider 'xfire_lsp.dll' missing
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{20235617-89E2-4BFF-96BD-31BBA0E64725}: NameServer = 195.194.9.210
O17 - HKLM\System\CCS\Services\Tcpip\..\{9419B4BA-CD42-4F43-B4F1-8AD7F2B0A64F}: NameServer = 195.194.9.210
O17 - HKLM\System\CCS\Services\Tcpip\..\{A162E460-B4AA-4C09-834A-C9A6C7D0E420}: NameServer = 68.102.1.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0CFDA35-FEA2-475D-BBFF-E62FF9BD6E1F}: NameServer = 62.108.1.66
O17 - HKLM\System\CCS\Services\Tcpip\..\{BEF844D8-B081-4AEB-91D0-FD75BA877A6D}: NameServer = 195.194.9.210
O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Sitecom\Bluetooth Software\bin\btwdins.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Zetera - Zetera Corporation - C:\Program Files\NETGEAR\SC101 Manager Utility\ZeteraService.exe


any further help would be really appreciated!! it's still the crss.exe process that's causing the slowness..

thanks a lot,
thijs
Post #4
hi thijsnoisia,

looks like i got a lot of trouble

no, not at all. while crss.exe can be a worm, its also a legit operating system file. dont see any signs of a worm in the hjt and your antivirus and online scan are clean. cookies arent much to worry about.
one more thing to do: make sure you have only one (crss.exe) and that its located here:
C:\Windows\System32


shelf life
Post #5

hi thijsnoisia,

looks like i got a lot of trouble

no, not at all. while crss.exe can be a worm, its also a legit operating system file. dont see any signs of a worm in the hjt and your antivirus and online scan are clean. cookies arent much to worry about.
one more thing to do: make sure you have only one (crss.exe) and that its located here:
C:\Windows\System32


shelf life


hi shelf life. thanks for getting back so quickly :)

well, i don't think this crss.exe process is supposed to be constantly taking 75-85% of my cpu, is it?

i'm quite sure something's wrong with my pc because it's SO much slower than it used to be with just about everything!!

if i search this pc's harddrive from another pc on the network, the search goes faster than when i do it on the infected pc it self!!

i have only one instance of the process running, how do i find out where it's located?

i searched the C: drive and it found no crss.exe on there :(

thanks again,
thijs
Post #6
hi thijsnoisia,

well, i don't think this crss.exe process is supposed to be constantly taking 75-85% of my cpu, is it?

no

i have only one instance of the process running, how do i find out where it's located

we can come back to that if needed

i'm quite sure something's wrong with my pc because it's SO much slower than it used to be with just about everything

i dont see any antimalware software on your computer. we ran antivirus which looks ok. so lets run a antimalware app.

Download the trial version of AVG Anti-Spyware 7.5 (formerly ewido anti-spyware 4.0) from here:
http://www.ewido.net/en/download/
Install AVG Anti-Spyware
The program will now go to the main screen.
You will need to update AVG Anti-Spyware to the latest definition files.
On the left-hand side of the main screen click the Update Button.
Click on Start.
The update will start and a progress bar will show the updates being installed.
After the updates are installed:

Click on Scanner
Click on Complete System Scan to start the scan process.
Let the program scan the machine, it may take some time.
AVG Anti-Spyware will list any infections found on the left hand side.
When the scan has finished, it will automatically set the recommended action. Click "Apply all actions" AVG Anti-Spyware will display "All actions have been applied" on the right hand side.
Click OK.

When the scan finishes click on "Save Report", then "Save Report As". This will create a text file.
Save the report to your Desktop.
Close AVG Anti-Spyware

please post the saved report from avg. you can edit out the cookies if there are lots of them.

shelf life
Post #7
strange! all that avg found was cookies! ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 2:01:54 PM 11/23/2006 + Scan result: :mozilla.179:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.169:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.171:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.148:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.149:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.150:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.151:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. C:\Documents and Settings\Thijs.THIJS-INTERNET-\Cookies\[removed][2].txt -> TrackingCookie.Clickhype : Cleaned. C:\Documents and Settings\Thijs.THIJS-INTERNET-\Cookies\[removed][2].txt -> TrackingCookie.Euroclick : Cleaned. C:\Documents and Settings\Thijs.THIJS-INTERNET-\Cookies\thijs@ivwbox[1].txt -> TrackingCookie.Ivwbox : Cleaned. :mozilla.86:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned. :mozilla.72:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Onestat : Cleaned. :mozilla.73:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Onestat : Cleaned. :mozilla.105:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.106:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.107:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.108:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.109:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.119:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.120:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.121:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.122:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.140:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned. :mozilla.141:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned. :mozilla.85:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.87:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.128:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.10:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Profiles\default\5qq0rkcx.slt\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.17:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Profiles\default\5qq0rkcx.slt\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.60:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.61:C:\Documents and Settings\Thijs.THIJS-INTERNET-\Application Data\Mozilla\Firefox\Profiles\1o6xfqrf.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. ::Report end what does this crss.exe process do when it is doing what it should do? maybe i have another problem? thanks, thijs
Post #8
hi thijsnoisia,

crss.exe and csrss.exe. (Client/Server Runtime Server Subsystem) iam assuming these are the same. ive seen references to it being both ways. i checked a copy of xp and didnt see a crss.exe file. i did see csrss.exe. we will assume that the crss.exe on your computer needs to go, so…

see if you can locate the file on your computer. to show all files do this:
Set Windows to show Hidden files and folders
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.
———————————————————-
first do this:
you can terminate the crss.exe process with task manager. hit crtl-alt-delete to bring up task manager click on the crss.exe under the process tab and click end process.

right click on start>explorer. two panes open. on the left hand side find the windows folder and click the plus sign, still on the left find the system32 folder, click on it and it will show all the folders/files in that dir. in the right hand pane. at the top click view>details. clickng on the name tab will sort list by name, folders first.
see if you can locate crss.exe. in the system32 dir. if so delete the file. also look in the windows folder.


do you have a resident antivirus application on your computer? i see panda but i think thats from the online scan. if you dont please download install, update and scan with:

http://free.grisoft.com/freeweb.php/doc/2/

shelf life
Post #9
my apologies, that was a typo on my side, the process is indeed called csrss.exe if i could terminate the process, there would be no real problem.. task manager says: "this is a critical process. task manager can not terminate this process." i located it in the system32 folder, it's a 6 kb file! i will try that virus scanner. i might also have to look into the option that it's not a virus or malware but another problem that causes the csrss.exe to spike my cpu like this :( maybe i've got a corrupt piece of hardware.. i just assumed it was virus because i googled for csrss.exe and it gave me multiple entries on viruses hiding in that process… do you have any idea what else could cause csrss.exe to take 75% cpu load? thanks for everything so far :) you've been a great help thijs
Post #11
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI