0

I just booted up my Samsung N120 netbook (with Windows XP Home SP3) and a dialog box came up with a command prompt window behind it. The dialog box is titled 16 bit MS-DOS Subsystem and the message is as follows:

C:\DOCUME~1\SAMSUNG\csrss.exe The NTVDM CPU has encountered an illegal instruction. CS:0544 IP:0117 OP:63 00 64 00 34 Choose 'Close' to terminate the application.

This only started on my most recent boot-up. One thing to note is that when I downloaded the Dropbox installer and opened it up, Panda Cloud Antivirus detected a suspicious file, which was csrss.exe and "neutralized it." However, an actual virus or trojan was not detected immediately before the file was detected and neutralized.

Just under two weeks ago, a trojan and two viruses were detected for some odd reason. (I only went to website I knew and I do not torrent or browse adult sites.) Anyhow, the two viruses came up in temporary files and the trojan was "neutralized."

Anyways, the main question is: How can I repair the csrss.exe file such that Windows XP starts up properly?

A screenshot could be posted upon request. Thanks in advance!

EDIT 1: Well... it appears that Panda Cloud actually took the beating. AVG detected it and Panda has got to go.

EDIT2: After doing a search for "csrss" the only entry that came up was the one in C:\WINDOWS\system32. I've run sfc /scannow but my XP disc doesn't work with it -- UPDATE: I just realized that I'm using an XP Pro SP3 disc when my netbook was preinstalled with XP Home SP3... and I don't have the original installation disc, clearly -- so I can't get the extra DLLs for the scan...

EDIT3: I just used Google to search up anything I could about this issue and this link suggests that I do some registry modifications... does this actually fix csrss.exe or does it just prevent it from starting in the first place?

EDIT4: I read the page which is linked above and have seemed to find an entry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. There is a String in there called Taskman whose value is C:\Documents and Settings\SAMSUNG\csrss.exe. I am going to see what the actual value is supposed to be. UPDATE: I referenced a clean machine to see what the proper value of Taskman is supposed to be. It turns out Taskman has the same value on another machine. I'm somewhat stumped.

SOLUTION POSTED IN MY ANSWER!

Wesley
  • 1,278

3 Answers3

2

From the message I see that the csrss.exe mentioned is under c:\docume~1\samsung. This file should not be there, but under c:\windows\system32.

Check to see if there's still a (hopefully untouched) version of that file in your system32 folder. If that is the case, you can just delete the one under you documents folder.

You might have to boot with a bootable CD and delete the file from there as it will probably be in use.

fretje
  • 10,732
1

csrss.exe is a vital component of a Windows installation. The best thing to do would be to open a cmd prompt (start -> run, type cmd and press enter) and type sfc /scannow. This will invoke the Windows System File Checker, which will scan and ensure all files are present and working. When it hits csrss.exe, it should restore it from its cache, or prompt you to insert your Windows disc (being a netbook, if it doesn't have a CD drive, you can use an external USB one, or a Windows installer USB drive). That should restore csrss.exe in the proper place for you.

squircle
  • 6,773
0

So, this was the solution:

Firstly, there were the basic antivirus software scans to determine any remaining threats on the computer. Using two different AV softwares was useful as my original AV software was infected.

Secondly, Most answers thought that the vital Windows application csrss.exe was not supposed to exist anywhere else but in C:\WINDOWS\system32\. However, csrss.exe actually exists as a completely hidden file under the user's folder in C:\Documents and Settings\USER\.

The system32 version of the file was unharmed, but it was the file in the user folder that was causing a dialog box to pop up on startup. The simple solution was to copy a clean copy from another machine and to copy and paste it into the user folder, even though it is not actually visible.

Thanks to others for their help!

Wesley
  • 1,278