Logging off and on again causes 1000 instances of csrss.exe

[milkshade]

Extremely odd weirdness just developed recently. This was working fine just a few weeks ago.

I rarely log off and on but it's always worked fine. Tried it the other day and when I logged back in to the same profile, csrss.exe has opened almost 1000 separate instances, each one with a new session ID, as reported by process explorer

Note that on a cold boot , I don't see any of this, only the log off/log on sequence. I tried with a clean new profile, and got the same bug.


I don't believe there's a virus of any kind here. Scans show nothing, and csrss.exe is running from the system32 folder. I've scanned with malwarebytes and MS Windows Defender offline scan and come up clean.

This is the command line that is being called repeatedly on a relog in

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

I was able to correct the problem by fooling with some of my startup programs , but I haven't nailed down the exact cause and the issue is back again.

Has anyone here ever seen this particular issue? My google searches have turned up nothing like it.

========================
Windows 7 Ultimate X64

 

[Tmagic650]

I'm not sure this isn't a virus, or other malware. Maybe you should post this here:
https://www.techspot.com/vb/menu28.html

... and at the very least, perform the 5-Steps

 

[milkshade]

Nope, though this is the first thing one would suspect, it doesnt even match the profile.

I've run multiple malware scans and rootkit detectors, and as usual , my machine is 100% clean.

I was able to get this buggy pattern to STOP last night (loff/on was fine) , but its back again, on my main install as of this morning , but is still GONE from a backup image on another drive I worked on at the same time. Can't quite get a handle on what is blocking the logoff / logon process and causing a loop .

I do notice, that when logging OFF, some of the time, the screen does not even come back to the LOGON screen, it goes to black and theres disk i/o, but I have to hard reset.

Nothing in the logs that tells me anything about why. though its poss Im not seeing something.

 

[Tmagic650]

Something is corrupting the registry. Maybe a program conflict...

"The Microsoft Client Server Runtime Server subsystem utilizes the process csrss.exe for managing the majority of the graphical instruction sets under the Microsoft Windows operating system"... And some Trojans are hard to detect

 

[milkshade]

After some detailed forensics, I seem to have nailed this down to a very odd conflict with a recent install of Vmware Workstation 8.

I see nothing on the net about this , but after disabling the loading of vmwares services, the problem vanishes.

 

[Tmagic650]

So everything is good now?

 

[milkshade]

Hope so. Would like to figure out why vmware is causing that mayhem though. posted something on their boards, so we'll see