Logging off and on again causes 1000 instances of csrss.exe

By milkshade
Mar 20, 2012
Post New Reply
  1. Extremely odd weirdness just developed recently. This was working fine just a few weeks ago.

    I rarely log off and on but it's always worked fine. Tried it the other day and when I logged back in to the same profile, csrss.exe has opened almost 1000 separate instances, each one with a new session ID, as reported by process explorer

    Note that on a cold boot , I don't see any of this, only the log off/log on sequence. I tried with a clean new profile, and got the same bug.

    I don't believe there's a virus of any kind here. Scans show nothing, and csrss.exe is running from the system32 folder. I've scanned with malwarebytes and MS Windows Defender offline scan and come up clean.

    This is the command line that is being called repeatedly on a relog in

    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

    I was able to correct the problem by fooling with some of my startup programs , but I haven't nailed down the exact cause and the issue is back again.

    Has anyone here ever seen this particular issue? My google searches have turned up nothing like it.

    Windows 7 Ultimate X64
  2. Tmagic650

    Tmagic650 TS Ambassador Posts: 17,244   +234

  3. milkshade

    milkshade TS Rookie Topic Starter

    Nope, though this is the first thing one would suspect, it doesnt even match the profile.

    I've run multiple malware scans and rootkit detectors, and as usual , my machine is 100% clean.

    I was able to get this buggy pattern to STOP last night (loff/on was fine) , but its back again, on my main install as of this morning , but is still GONE from a backup image on another drive I worked on at the same time. Can't quite get a handle on what is blocking the logoff / logon process and causing a loop .

    I do notice, that when logging OFF, some of the time, the screen does not even come back to the LOGON screen, it goes to black and theres disk i/o, but I have to hard reset.

    Nothing in the logs that tells me anything about why. though its poss Im not seeing something.
  4. Tmagic650

    Tmagic650 TS Ambassador Posts: 17,244   +234

    Something is corrupting the registry. Maybe a program conflict...

    "The Microsoft Client Server Runtime Server subsystem utilizes the process csrss.exe for managing the majority of the graphical instruction sets under the Microsoft Windows operating system"... And some Trojans are hard to detect
  5. milkshade

    milkshade TS Rookie Topic Starter

    After some detailed forensics, I seem to have nailed this down to a very odd conflict with a recent install of Vmware Workstation 8.

    I see nothing on the net about this , but after disabling the loading of vmwares services, the problem vanishes.
  6. Tmagic650

    Tmagic650 TS Ambassador Posts: 17,244   +234

    So everything is good now?
  7. milkshade

    milkshade TS Rookie Topic Starter

    Hope so. Would like to figure out why vmware is causing that mayhem though. posted something on their boards, so we'll see

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...