Hello FolksToday, in selecting programs for FSAS to shutdown, the first one on the display list (alphabetical order) of running programs is "csrss.exe" (client server runtime process, Microsoft Corp. File v. 5.1.2600.2180 created 1/18/2006 6KB). The path is not shown. The path is shown for all other programs. It's icon is a folder, the only program with that icon. I did not select csrss.exe to shutdown when FSAS starts FS2004. I left csrss.exe running. Then, in starting up FSAS, the log shows a red warning message (all others are grey showing programs and services as they are shut down by FSAS). Red message says (paraphrase) can not find path for csrss.exe. This is interesting because I have not told FSAS to shut down csrss.exe so it doesn't need to shut it down or do anything to it. FSAS continues to shutdown everything I specified, all the way to starting FS9 (fs9.cfg.exe). Then nothing happens. And nothing works. The mouse, keyboard commands, nothing works, the desktop with the FSAS window showing fs9.cfg.exe is starting up is all I get, but it never starts. I have to shutdown everything. Not even task manager works for shutdown. The FSAS settings are the same as before when it worked great every time. The csrss.exe file is in i386. Date of csrss.exe creation corresponds to the date I bought the computer, i.e., when it was built. Csrss.exe show up in i386 as a file with a generic file icon, not a folder as it shown in FSAS. Googling csrss.exe says it can be a masked virus and should be in the system folder, anywhere else is suspicious. Although I checked a couple other files the guide said should be in system folder and they were also in i386 and no other symptoms of a virus are evident in comp. functions. I ran McAfee, Spybot, Ewido, windows defender, spy sweeper, ->nothing. I use CCleaner judiciously; however, I do think I have unknowingly "cleaned" out some stuff in the past that I needed, e.g., index.dat files. I have dropped a few "unnecessary" startup programs and services recently. But FSAS has worked fine after that. Also, FS2004 works fine when started on its own, without FSAS. But of course without as much free RAM as when using FSAS.I don't know if this info is sufficient to point me in a direction to solve this problem, but if someone has an idea, let me know.Rob

csrss.exe is a service and should NOT be displayed under Programs. So, I'm not sure what is going on there.

Curiouser and Curiouser....Just returned from errands. Now a couple hours after my first post about csrss.exe. I am typing this message on one screen while checking on the other screen to see if csrss is still fouling up the works in FSAS .... it IS still there in PROGRAMS just like before (interesting comment from Ken Salter above...) It shows no path and it still has a folder icon. Just checked windows services, csrss is NOT there. And I am fairly certain I have never seen csrss before either in programs or services and I'm quite sure I have never seen it in the processes list in task manager. Yes, I confess, I actually study that stuff. Sad, I know. So now let me look in task manager.... AH-HA, csrss IS there! Honestly, I am certain csrss was not there yesterday. It was ClientSideProxy (MSN accelerator) and next alphabetically was ctfmon.exe, no csrss.exe. So now I'm going to click "running" programs in FSAS. Woah! I clicked the "running" button and csrss stayed on the list for about 2 seconds (after the non-running programs went away), then it disappeared. Gone. It stayed there on running list earlier today when I clicked the "running" button. Hmmmm.... This is very interesting. OK, now I'm going to start up FSAS, see what happens.... Yes, it works, fs9, shoot, everything works. The Cesna 172 is on the tarmac! 8 frames/sec, but hey, I'm not complaining. Just a minute. Let me check something. Minimize fs9... OK, csrss.exe is still on processes list in task manager, was at 4600K mem usage, now 2900K. click explore, go to i386 folder. I just clicked to open csrss.exe in i386 and it says can't open it on win32 system(????) yes, mine is XP Pro sp2, 32 bit. I don't get that at all. If anyone understands this, let me know. right now, however, it's all workin' and I'm flyin'...Rob

I have the same issue. I configured FSAS a couple weeks ago and I notice this issue. Some of the websites said it was a virus, others said it was something important for Windows operation. I am not too keen on the inner workings of Windows so I left it alone. I use NOD32 and I did a full scan and everything checked out OK. I have not been having any problems either.

In addition to all the other cool stuff FSAS does, I think Ken Salter can now claim (with better evidence than many antivirus programs) that FSAS finds and stops cloaked viruses IN THEIR TRACKS. How would I have found csrss.exe without it? Maybe after stuff started messing up, but not so soon. I decided to get rid of csrss.exe late last night, been pushing my comp. hard since to finish a big presentation. No problems. We are both happy campers now. Once in a while things just go right... Think I'll go fly.Rob

Guys,If you want to see EXACTLY where things are loading from as well as more information than you ever wanted to know about the file itself, grab copies of "Autoruns" and "Process Explorer" from www.sysinternals.com - these guys rule, they have access to the Windows source and know every possible place crap can load from... I've cleaned tons of malware infections from system's with just these two tools alone...

From what I have read, it depends on the directory that csrss.exe is located in. It is supposed to be in system32. If it is, it is a critical part of Windows. If it is not, it is may be a virusDoes anybody have a definitive answer on this?NOD32 does NOT pick this up as a virus.

Hello again,To clarify my last post above, when the Red warning in FSAS startup occurred, FSAS showed csrss.exe as a folder in the programs list. FSAS showed no file path for the csrss.exe folder/program. Windows search found a csrss.exe file or something called that in i386, but not in the Windows/system folder, where it is supposed to be. Task manager showed it in active processes list. When I clicked on "running" in FSAS, csrss.exe stayed on the list, so it appeared to be running at that moment. Turned off FSAS. In i386, clicking on csrss.exe gave a "can not open in win32 system" message. Windows/system folder still showed no csrss.exe file. I deleted csrss.exe from i386 to recycler. I started up FSAS, crss.exe still there, no path, I clicked on running programs, csrss.exe disappeared, but not immediately as others did, maybe 2 seconds later. Task manager still showed csrss.exe in active processes list. It was still gone from i386; however, csrss.exe then show up in the Windows/system folder (openned the folder and saw it), where it is supposed to be. Note: It was not previously in the Windows/system folder (based on windows search, didn't check directly) before I deleted csrss.exe from i386. Since my last post, csrss.exe does show up as an active process in task manager (using 2480K as I type), never saw it there before all this started. Csrss.exe has not reappeared on the FSAS running programs list, where it is not supposed to be, or the services list either. It is a service, as was pointed out above. The bottom line is that FSAS has done its thing and started up FS9 flawlessly 4-5 times since. So it's a bit of mystery but I'm flyin' so no worries.Rob

InterestingI have had this problem with crss.exe ever since one of the early updates to FSAS. I assumed it was some form of bug as the system on which I run FS9 had never been used for the internet. To date I have not been able to get rid of it in FSAS - however, in view of Ken's comment, I will try Rob's approach.John R

I have now tried several versions of FS Autostart on 2 different systems:Build 1.0 All versions - CSRSS shows in the Programmes list but does not give an error message when Autostart is initiated.Build 1.1 Both versions - CSRSS shows in the Programmes list and always gives the red error message on start up.Note I have only one CSRSS.exe - in the systems 32 folder - others which were left in odd places by the SP1 and SP2 update programmes have been deleted.Have noty been able to find anything to date in the FAQ or support forum so will keep trying as it appears to be restricted to certain systems?John Rooum

csrss.execsrss.exe - Here is the scoop on Ahlem.A Worm. The big question: what is csrss.exe and is it spyware, a trojan and if so, how do I get rid of Ahlem.A Worm?csrss.exe (Ahlem.A Worm) - DetailsIf a process named csrss.exe is running on your computer, you may have been infected with a strain of the Ahlem.A worm.csrss.exe is considered to be a security risk, not only because antivirus programs flag Ahlem.A Worm as a virus, but also because a number of users have complained about its performance.Ahlem.A Worm is likely a virus and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of csrss.exe may cause serious harm to your system and will likely cause a number of problems, such as slow performance, loss of data or leaking private information to websites.CSRSS.EXE - ConfusionCsrss.exe is the Microsoft client server runtime which generates worker threads for client requests. The confusion over csrss.exe comes from Trojans or viruses that use the same executable name (.exe) as that of csrss.Many spyware/malware programs use filenames of usual, non-malware programs.The legitimate csrss.exe is part of the Microsoft client server software and is a very important part of the system which should not be removed.One way to determine if csrss.exe is a legitimate file besides looking at the date modified is to right click on csrss.exe inside Task Manager and attempt to end process. Because csrss is a critical file, Microsoft should inform you with a message that csrss.exe is a critical system process and end it is not possible.If you do not receive this message when attempting to end the csrss.exe process, then it may indeed be a virus. If you decide to terminate the csrss.exe process, make sure any applications are shutdown (such as word, etc) and that you have a backup of your data.Any vulnerability should be removed immediately. If your have not already done so, you should visit our free spyware removal page to make sure your system does not have other programs like csrss.exe.CSRSS.EXE - DisclaimerEvery attempt has been made to provide you with the correct information for csrss.exe or AHLEM.A WORM. If we missed the mark, we would greatly appreciate your help by dropping us a comment and we'll promptly correct it.You should verify the accuracy of information we provided about csrss.exe. Ahlem.A Worm may have had a status change since this page was published. JohanA LITTLE LESS CONVERSATION, AND A LITTLE MORE ACTION PLEASE!HELP:http://support.microsoft.com/?kbid=238882

That is what I read. The csrss.exe that is showing up in running programs in FSAS is located in system32. Even though it appears to be a legit files, it is showing up as a red warning. Is this normal?

Following are two relevant posts I found in Wilders Security Forum at http://www.wilderssecurity.com/showthread.php?t=87980. BTW, I didn't memtion it before, but csrss.exe and winlogon.exe also show the "/??/" at the beginning of their file paths in my system, as discussed below. I think this is the reason for the "missing file path" message -> system freeze up. Why csrss.exe shows up as a program in FSAS, no clue yet. "Hi,I dont no why these two files running on my computer have the question marks. Can any one help with identification?/??/C:/Windows/System32/csrss.exe /??/C:Windows/system32/winlogon.exeIs there a virus or something?Thanks,Blinko" (7/06/05)Response from Alec (7/08/05):"The processes csrss.exe and winlogon.exe are definitely both legit processes that will exist on all Windows NT/2000/XP systems. The formal name for CSRSS is the Client Server Runtime SubSystem, but really it is the Win32 SubSystem... it is a core piece of what makes the Win32 API work. The original design of Windows NT envisioned multiple subsystems, or at least replaceable subsystems, in case Windows didn't take off and another user interface API did take off. However, Microsoft really only wrote the Win32 one, the POSIX one, and a very basic OS/2 one. Winlogon, of course, is fairly self-explanatory, or at least somewhat descriptive of its role. I suppose it might be possible for malware to somehow compromise those two files, but it would probably be unlikely since those two processes start very early in the initialization of Windows since they are so essential and therefore they probably lock access to the files on disk.The reason for the two '??' is sort of a longer story. Basically, there is a whole set of specialized code that runs in ring 0, or "kernel mode" that is collectively referred to as "Executive Services". These executive services range from things like memory management to I/O management to something called the "Object Manager". The object manager is the kernel's method of unifying and organizing the various low-level resources and objects that the kernel needs in order to do its job (ie, things like processes, threads, files, devices, mutexes aka mutants, etc.) Anyway, the object manager can be sort of thought of as imposing some structure on these objects kind of like the filesystem on a drive. There is a "directory" in the object manager called "DosDevices" that ennumerates devices as they were known in DOS (eg, LPT:, COM1:, C:, D: ). That is, the "C:" referrence to the first harddrive that we are all familiar with comes from DOS convention, but isn't necessarily how NT/2000/XP has to refer to the first harddrive. Anyway, the "C:" reference is defined in the object manager under the DosDevices "directory". It turns out that the DosDevices directory is used so much internally, that Microsoft eventually just cryptically renamed it "??" so that it would be first in the search path apparently. It saved a few microseconds per access, I guess.The reason those two executables in particular show up with the "??" reference in front of them is likely because they are both what's called "Native" API applications. CSRSS and Winlogon aren't written based upon the Win32 API, since they are in fact each partly responsible for, and run prior to, that API. Rather they are written to a lower-level core Windows NT API. Because of this, they probably somehow make reference to the actual "??" DosDevices object manager entity that causes them to show up in process listings with that on there. You can learn much more on all of this by reading Mark Russinovich (of Sysinternals' fame) & David Solomon's "Windows Internals" book. I'm just sort of reciting what I recall." I think this means that what I'm seeing with csrss.exe is normal, perhaps someone here understands better than I. I do know I am still getting the red warning about csrss.exe not having a file path at FSAS startup. I know my system freezes at that point and I have to reboot. This makes FSAS unusable.And from other responses here, this is happening to others as well.RegardsRob