Running process question
Results 1 to 10 of 10

Thread: Running process question

  1. #1
    Junior Member
    Join Date
    May 2004
    Posts
    11

    Running process question

    First off my OS is XP Home,

    I have kept my running processes to 24....27 when connected to net via modem. I have every update available set to manual, and after I went in looking for critical window updates the MS update page forced a download for their new page changes. Within this downlaod it added 2 new processes to my system: 1. wuauclt.exe 2. csrss.exe.......after a little google search this is what I found,

    WinTasks Process Library

    wuauclt - wuauclt.exe - Process Information

    Process File: wuauclt or wuauclt.exe
    Process Name: AutoUpdate for WindowsME
    Description: Background process responsible for updates to Windows ME. Whenever you connect to the Internet, Wuauclt checks the Microsoft web site for updates to Windows ME.
    Company: Microsoft Corp.
    System Process: Yes
    Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
    Common Errors: N/A

    _____________________________________________________________________


    WinTasks Process Library

    csrss - csrss.exe - Process Information

    Process File: csrss or csrss.exe
    Process Name: Client/Server Runtime Server Subsystem
    Description: Windows client server run-time subsystem handles Windows and graphics functions for all subsystems.
    Company: Microsoft Corp
    System Process: Yes
    Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
    Common Errors: N/A


    The first one wuauclt.exe is for autoupdate for Win ME, this confused me because like I said I run XP.....Can I kill this one without negative results???

    The second csrss.exe, same thing....Can I kill this one also without negative results???

    It just dawned on me about half way into this post that I should have went to Black Viper and researched further, but I will continue with post for the easy way out......please forgive my lazy self.

  2. #2
    albn
    Guest
    Here's a thread that might help you in regard to wuauclt:

    http://www.windowsbbs.com/showthread.php?t=34098&page=1

    and for csrss:

    http://support.microsoft.com/?kbid=314056

    Hope this helps

  3. #3
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,178
    Hi,

    I have just fired up a WinME and an XP Pro box (SP1). Neither of them are running wuauclt, so you should be safe to turn that one off. Like yourself, I don't do auto-updates, preferring to run them manually on my own machines.

    csrss.exe IS running on my XP box, and I must admit that I had never given it much thought. I suspect that it may be used by more than the Windows update?

    My suggestion is to do a search and get the free version of WinPatrol from BillP Studios. There is a facility to disable startup programs so you could disable it, see what happens, and if things go belly up, just boot into safe mode, run WinPatrol and re-enable it.

    I know, I am a lazy bugger but I have found it a useful tool when fixing machines that people's kids have filled with junk so they don't work properly anymore, or where there is some sort of "deadly embrace" going on.

    As I said, you should be safe getting rid of wuauclt.exe, as my machines run fine without it. I have not installed the latest WinME autoupdate on this machine as I don't use it. This could explain why the program is not present.

    Hope that helps
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  4. #4
    King Arana: Super Moderator
    Join Date
    Oct 2002
    Posts
    4,055
    I don't do auto-updates, preferring to run them manually on my own machines.
    Smart man, this is much safer.

    I have not installed the latest WinME autoupdate on this machine as I don't use it. This could explain why the program is not present.
    It does explain it, although I tend to get more updates available for Win98 than I do for WinMe.
    Space For Rent.. =]

  5. #5
    Senior Member
    Join Date
    Jan 2002
    Posts
    1,207
    It is naive to assume that you can tell what something is from the name of its .exe file.

    It is also naive to assume that malware needs to run in a separate process from anything else.

    Therefore I find these "Windows .exe file identification DBs" pointless.

    Slarty

  6. #6
    King Arana: Super Moderator
    Join Date
    Oct 2002
    Posts
    4,055
    slarty: Correct and it's ignorance IMHO. If anything, malware/spyware would run in a seperate process to avoid detection among other things.
    Space For Rent.. =]

  7. #7
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,178
    Mr. Slarty,

    You make two good points there, but this seems to be more a "computer efficiency" kind of question, than computer security.

    I find those databases reasonably useful, if used with caution...........at least they tell you if the proggy is a valid Microsoft name.............you have then got to check if it is in the right place, if there is a known "spoof" and so on................

    Spyder............

    As I load a lot of test/beta whatever stuff, I am used to problems, and do not like things running unless I say so...............in a commercial environment we load updates onto a "reference" machine/machines and test before we do the roll out, which you are obviously aware of After all, autoupdate is never turned on for users.

    In a SOHO (small office/home office/domestic) environment, I will tend to set up a stable system and allow autoupdate, telling the owner to let it happen BEFORE they try to use the machine. It is a sort of compromise solution, but seems to work.

    It has ocurred to me that I have a number of test boxes running various versions of Windows (98/98SE/ME/2K/XP) so if anyone wants something testing, please let me know. As these are non-critical boxes, I don't mind what happens, I will just re-instate

    Cheers
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  8. #8
    King Arana: Super Moderator
    Join Date
    Oct 2002
    Posts
    4,055
    Heh, I really like that.. a SOHO. That's something similiar to what I have here at home. Anyways:

    That's a pretty good solution to tell a new owner to "get them on their feet" so to speak. And in that sense, they wouldn't be compromised or have to worry about being hacked due to something not patched/updated.

    It has ocurred to me that I have a number of test boxes running various versions of Windows (98/98SE/ME/2K/XP) so if anyone wants something testing, please let me know.
    Ehh, PICK ME! Damn, I've needed another test box for a LONG time but that's aside the point. PM me the details or whatever nihil. If they are non-critical, I'm sure you don't mind helping a lost and broke buddy

    EDIT: Oh, and I'll remember that. Any windows testing, consult nihil.
    Space For Rent.. =]

  9. #9
    Senior Member
    Join Date
    Jul 2002
    Posts
    339
    Therefore I find these "Windows .exe file identification DBs" pointless.
    To be useful, I think they should include ALL possible versions (SP/hotfix) along with their MD5sum.

    Peace always,
    <jdenny>
    Always listen to experts. They\'ll tell you what can\'t be done and why. Then go and do it. -- Robert Heinlein
    I\'m basically a very lazy person who likes to get credit for things other people actually do. -- Linus Torvalds


  10. #10
    Junior Member
    Join Date
    May 2004
    Posts
    11
    nihil, I did get rid of the wuauclt.exe and everything works fine. I guess I will be waiting for sp2 on disc because I refuse to allow for auto update.

    thanks........

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides