-
August 24th, 2004, 06:25 AM
#1
Junior Member
Running process question
First off my OS is XP Home,
I have kept my running processes to 24....27 when connected to net via modem. I have every update available set to manual, and after I went in looking for critical window updates the MS update page forced a download for their new page changes. Within this downlaod it added 2 new processes to my system: 1. wuauclt.exe 2. csrss.exe.......after a little google search this is what I found,
WinTasks Process Library
wuauclt - wuauclt.exe - Process Information
Process File: wuauclt or wuauclt.exe
Process Name: AutoUpdate for WindowsME
Description: Background process responsible for updates to Windows ME. Whenever you connect to the Internet, Wuauclt checks the Microsoft web site for updates to Windows ME.
Company: Microsoft Corp.
System Process: Yes
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
Common Errors: N/A
_____________________________________________________________________
WinTasks Process Library
csrss - csrss.exe - Process Information
Process File: csrss or csrss.exe
Process Name: Client/Server Runtime Server Subsystem
Description: Windows client server run-time subsystem handles Windows and graphics functions for all subsystems.
Company: Microsoft Corp
System Process: Yes
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
Common Errors: N/A
The first one wuauclt.exe is for autoupdate for Win ME, this confused me because like I said I run XP.....Can I kill this one without negative results???
The second csrss.exe, same thing....Can I kill this one also without negative results???
It just dawned on me about half way into this post that I should have went to Black Viper and researched further, but I will continue with post for the easy way out......please forgive my lazy self.
-
August 24th, 2004, 06:39 AM
#2
-
August 24th, 2004, 08:12 AM
#3
Hi,
I have just fired up a WinME and an XP Pro box (SP1). Neither of them are running wuauclt, so you should be safe to turn that one off. Like yourself, I don't do auto-updates, preferring to run them manually on my own machines.
csrss.exe IS running on my XP box, and I must admit that I had never given it much thought. I suspect that it may be used by more than the Windows update?
My suggestion is to do a search and get the free version of WinPatrol from BillP Studios. There is a facility to disable startup programs so you could disable it, see what happens, and if things go belly up, just boot into safe mode, run WinPatrol and re-enable it.
I know, I am a lazy bugger but I have found it a useful tool when fixing machines that people's kids have filled with junk so they don't work properly anymore, or where there is some sort of "deadly embrace" going on.
As I said, you should be safe getting rid of wuauclt.exe, as my machines run fine without it. I have not installed the latest WinME autoupdate on this machine as I don't use it. This could explain why the program is not present.
Hope that helps
-
August 24th, 2004, 09:08 AM
#4
I don't do auto-updates, preferring to run them manually on my own machines.
Smart man, this is much safer.
I have not installed the latest WinME autoupdate on this machine as I don't use it. This could explain why the program is not present.
It does explain it, although I tend to get more updates available for Win98 than I do for WinMe.
-
August 24th, 2004, 09:23 AM
#5
It is naive to assume that you can tell what something is from the name of its .exe file.
It is also naive to assume that malware needs to run in a separate process from anything else.
Therefore I find these "Windows .exe file identification DBs" pointless.
Slarty
-
August 24th, 2004, 09:45 AM
#6
slarty: Correct and it's ignorance IMHO. If anything, malware/spyware would run in a seperate process to avoid detection among other things.
-
August 24th, 2004, 09:46 AM
#7
Mr. Slarty,
You make two good points there, but this seems to be more a "computer efficiency" kind of question, than computer security.
I find those databases reasonably useful, if used with caution...........at least they tell you if the proggy is a valid Microsoft name.............you have then got to check if it is in the right place, if there is a known "spoof" and so on................
Spyder............
As I load a lot of test/beta whatever stuff, I am used to problems, and do not like things running unless I say so...............in a commercial environment we load updates onto a "reference" machine/machines and test before we do the roll out, which you are obviously aware of After all, autoupdate is never turned on for users.
In a SOHO (small office/home office/domestic) environment, I will tend to set up a stable system and allow autoupdate, telling the owner to let it happen BEFORE they try to use the machine. It is a sort of compromise solution, but seems to work.
It has ocurred to me that I have a number of test boxes running various versions of Windows (98/98SE/ME/2K/XP) so if anyone wants something testing, please let me know. As these are non-critical boxes, I don't mind what happens, I will just re-instate
Cheers
-
August 24th, 2004, 10:37 AM
#8
Heh, I really like that.. a SOHO. That's something similiar to what I have here at home. Anyways:
That's a pretty good solution to tell a new owner to "get them on their feet" so to speak. And in that sense, they wouldn't be compromised or have to worry about being hacked due to something not patched/updated.
It has ocurred to me that I have a number of test boxes running various versions of Windows (98/98SE/ME/2K/XP) so if anyone wants something testing, please let me know.
Ehh, PICK ME! Damn, I've needed another test box for a LONG time but that's aside the point. PM me the details or whatever nihil. If they are non-critical, I'm sure you don't mind helping a lost and broke buddy ![wink](https://antionline.com/images/smilies/wink.png)
EDIT: Oh, and I'll remember that. Any windows testing, consult nihil.
-
August 25th, 2004, 11:46 AM
#9
Therefore I find these "Windows .exe file identification DBs" pointless.
To be useful, I think they should include ALL possible versions (SP/hotfix) along with their MD5sum.
Peace always,
<jdenny>
Always listen to experts. They\'ll tell you what can\'t be done and why. Then go and do it. -- Robert Heinlein
I\'m basically a very lazy person who likes to get credit for things other people actually do. -- Linus Torvalds
-
August 26th, 2004, 01:39 AM
#10
Junior Member
nihil, I did get rid of the wuauclt.exe and everything works fine. I guess I will be waiting for sp2 on disc because I refuse to allow for auto update.
thanks........
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|