High Utilization Caused by CSRSS.EXE

[JD]

Has anyone seen a high server utilization caused by the
system process CSRSS.EXE? I have a Windows 2000 server SP4
installed. The server has been running fine for the last
six months or so. Just about 3 weeks ago, i noticed that
the server's utilization was being tied up by the
CSRSS.EXE process. The utilization remains above 95% until
the server is rebooted. During the high utilization
period, no other process can be run or started. After the
reboot, the CSRSS.EXE utilization returns to normal (0% -
1% utilization). It seems to have occurred regularly
every 6 days or so. I ran the virus scan on the server
everyday with no virus detected. There is only one copy of
the CSRSS.EXE in the system32 folder. I checked the
version, date, and size of it against a known good copy on
a different server, and they matched exactly. I don't know
what causes this problem and why it occurs regularly. Has
anyone seen this problem? Any help or reference is greatly
appreciated. Thanks.

JD

 

[Steve Nielsen]

What antivirus program are you using to scan and is it up to date? A
search on Symantec for CSRSS.EXE yields 7 hits. At least one of them
(Love Spy) Symantec says can only be detected by their a/v products with
"expanded threats" capabilities.

http://search.symantec.com/custom/us/query.html

Steve