System Idle Process constantly at 0, csrss.exe spiking every so often

[Kyo]

I'm using Windows XP Pro, on a 2.7ghz, 256mb RAM machine. I haven't had
problems with it before but since a restart yesterday the System Idle
Process is constantly 0 on the task manager, and all the CPU is being
shared out between programs. Also, csrss.exe spikes to 25-50% every so
often, causing applications to lock up for a few seconds.

I've run a number of virus scanners including Trend Micro, NAV, AVG and
also Microsoft Anti Spyware beta 1 and SpyBot S&D which haven't picked
up anything so I'm at a loss.

I installed Visual Basic 6 SP 6 recently, as well as uninstalled Cygwin
completely but I'm not sure if or how those could relate at all.

Does anyone have any ideas or such as to what could be causing the
problem? Thank you.

 

[Gerry Cornell]

csrss.exe is an important Windows system file. It also can be a virus,
spyware, trojan or worm.

Will you please use Windows Explorer to search your hard disk for all
copies of csrss.exe and post a list of all the file paths to each.

Are you running Norton and AVG at the same time?

How RAM do you have and what is your CPU speed? Try Ctrl+Alt+Delete to
bring Task Manager and select the Performance Tab. What is the Total,
the Commit Charge and the Peak? Try switching to the Applications tab
when crsse.exe spikes. What applications are shown as running.

Download Process Explorer so that you can see the tree leading to
csrss.exe.

For further information about Process Explorer see here:

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

To ascertain which service is causing the problem select the svchost
producing the high CPU usage, right click,
select Properties, Services. Note there are the full names and
some explanation of what each service does.

You will find further information on Services here:
http://majorgeeks.com/page.php?id=12

To trace the particular Service involved you need to turn off each
service in turn and then restore it noting what effect it has on CPU
usage. However, you need to take care and watch what other Services are
dependent on that service. When you click on the Dependencies tab allow
it a little time to display the information.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Kyo]

I checked for multiple copies of csrss.exe, and only found the one.
However, I downloaded and tried out Process Explorer afterwards, and
found that mstc.exe was the one causing the problem. It was under the
explorer.exe tree and once I killed it, the 100% CPU usage stopped and
went back to normal, and free CPU went back to Idle System Process.

I tried searching for information on mstc.exe but haven't found
anything so far, only information on mstsc.exe which is as far as I
know, a legitimate process. I've deleted the mstc.exe for the time
being which was located in 'c:/windows/system32/'. After deleting it, I
restarted and it hasn't come back, nor has Windows complained about
it's absence. I'm hoping that it is all fixed now.

Thank you very much for your help, I really appreciate it.

 

[Gerry Cornell]

Kyo

How did you delete the file? Is it in your Recycle bin? If it is right
click on the file and select restore. Then right click on the file,
select rename and change the file extension exe to old. That will put it
on hold until I can advise how to deal with it.

My own searches found no information on the file but it is mentioned in
Google. I have contacted a more knowledgeable friend to see what he
knows. In the meantime watch your system for ill effects and watch this
space <g>.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Wesley Vogel]

mstsc.exe is the Remote Desktop Connection.

mstsc.exe lives here
C:\WINDOWS\system32
and
C:\WINDOWS\system32\dllcache

Mstsc help
Start | Run | Paste this in the box and click OK...

hh ntcmds.chm::/ts_cmd_mstsc.htm

Using Remote Desktop Connection help
Start | Run | Paste this in the box and click OK...

hh mstsc.chm::/mstsc_topnode.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Kyo]

Sorry, let me clarify - It's definitely separate to mstsc.exe. I was
only able to find information on mstsc.exe when I searched for mstc.exe
though. I had a fair idea of what mstsc.exe was before.

I already deleted the file completely.. My apologies, I was a bit hasty
in getting rid of it. The computer is running completely normally now
however with no slowdown, and csrss.exe isn't spiking anymore.

 

[Wesley Vogel]

I totally misread your post. I did not notice the difference between
mstc.exe and mstsc.exe. Let *me* apologize.

You were not hasty in getting rid of mstc.exe. It was most certainly some
kind of malware.


--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In