1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Deleted csrss.exe file

Discussion in 'Windows XP' started by tactless, Feb 17, 2005.

Thread Status:
Not open for further replies.
Advertisement
  1. tactless

    tactless Thread Starter

    Joined:
    Feb 17, 2005
    Messages:
    2
    I deleted all copies of csrss.exe on my Windows NT 4.0 Server system. I understood the file to be part of a virus, not having read carefully enough to understand that it was a necessary system file but just infected. Of course now I can't boot my system.

    I was hoping I could get a clean copy of the csrss.exe executable, copy it onto my Emergency Repair Disk (setup disk 2 under the system32 folder), modify the setup.log file to load it (setup disk 1) and be good to go.

    1) Is it possible to get a good csrss.exe file somewhere? I don't have the installation disks for NT; I found a place to get the NT setup disks and that's basically all I have for setup and installation.

    2) If my approach works (I read about modifying the setup disks on a Microsoft site) and I'm able to copy csrss.exe to the system32, will I then be able to boot up my system? I removed all references to csrss.exe from the registry, so I'm not sure if that will be my next problem.

    Thanks in advance for any help or suggestions you have to offer!
     
  2. eddie5659

    eddie5659 Moderator Malware Specialist

    Joined:
    Mar 19, 2001
    Messages:
    34,062
    Hiya and welcome

    Not sure if it will work, but I've uploaded a copy of my csrss.exe here. Its in a zip, so you'll have to extract it. I'm using Windows 2000, so it should be okay.

    I've looked through my Registry, and apart from MRU keys, here are the ones that show up:

    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SubSystems

    Name: Windows
    Type: REG_EXPAND_SZ
    data: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager\SubSystems

    Same as above

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems

    same as above

    So, see if adding the file works first of all, and if not, try editing the above keys. Of course, this is for Win2000, not too sure if NT is different in this respect.

    Regards

    eddie
     

    Attached Files:

  3. tactless

    tactless Thread Starter

    Joined:
    Feb 17, 2005
    Messages:
    2
    Eddie,

    Thanks so much for your reply. I was able to get a csrss.exe file and after much trial and error was able to get the file installed using modifications to the Emergency Repair Disk. However, I'm still seeing the same error.

    I can't see the disk from Dos, since my NT drive is NTFS, so I can't edit or look at the disk's files, including modifying the registry.

    I'm not sure what to do next ... It looks like I'm going to have to go out and buy a new system and then I may possibly be able to look at the disk and transfer the files I want to keep. Heck, if I have another system, I could also try to repair the old one and keep it around as a backup.

    Again, I appreciate your effort and information ... it makes me feel better anyway!

    Tactless
     
  4. eddie5659

    eddie5659 Moderator Malware Specialist

    Joined:
    Mar 19, 2001
    Messages:
    34,062
    *edit*

    had to edit this out, as I need to doublecheck some things first. I was asking you to go back on the Registry, but need to look at some things first. Bear with me :)

    eddie
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - Deleted csrss file
  1. SilverSurf
    Replies:
    1
    Views:
    353
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/331571

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice