Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just booted up my Samsung N120 netbook (with Windows XP Home SP3) and a dialog box came up with a command prompt window behind it. The dialog box is titled 16 bit MS-DOS Subsystem and the message is as follows:

C:\DOCUME~1\SAMSUNG\csrss.exe The NTVDM CPU has encountered an illegal instruction. CS:0544 IP:0117 OP:63 00 64 00 34 Choose 'Close' to terminate the application.

This only started on my most recent boot-up. One thing to note is that when I downloaded the Dropbox installer and opened it up, Panda Cloud Antivirus detected a suspicious file, which was csrss.exe and "neutralized it." However, an actual virus or trojan was not detected immediately before the file was detected and neutralized.

Just under two weeks ago, a trojan and two viruses were detected for some odd reason. (I only went to website I knew and I do not torrent or browse adult sites.) Anyhow, the two viruses came up in temporary files and the trojan was "neutralized."

Anyways, the main question is: How can I repair the csrss.exe file such that Windows XP starts up properly?

A screenshot could be posted upon request. Thanks in advance!

EDIT 1: Well... it appears that Panda Cloud actually took the beating. AVG detected it and Panda has got to go.

EDIT2: After doing a search for "csrss" the only entry that came up was the one in C:\WINDOWS\system32. I've run sfc /scannow but my XP disc doesn't work with it -- UPDATE: I just realized that I'm using an XP Pro SP3 disc when my netbook was preinstalled with XP Home SP3... and I don't have the original installation disc, clearly -- so I can't get the extra DLLs for the scan...

EDIT3: I just used Google to search up anything I could about this issue and this link suggests that I do some registry modifications... does this actually fix csrss.exe or does it just prevent it from starting in the first place?

EDIT4: I read the page which is linked above and have seemed to find an entry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. There is a String in there called Taskman whose value is C:\Documents and Settings\SAMSUNG\csrss.exe. I am going to see what the actual value is supposed to be. UPDATE: I referenced a clean machine to see what the proper value of Taskman is supposed to be. It turns out Taskman has the same value on another machine. I'm somewhat stumped.


share|improve this question

From the message I see that the csrss.exe mentioned is under c:\docume~1\samsung. This file should not be there, but under c:\windows\system32.

Check to see if there's still a (hopefully untouched) version of that file in your system32 folder. If that is the case, you can just delete the one under you documents folder.

You might have to boot with a bootable CD and delete the file from there as it will probably be in use.

share|improve this answer
The copy running from C:\Docume~1\Samsung is most likely some kind of malware. The asker might want to run a good virus scanner from a bootable CD/USB drive to make sure that his system is really clean. – afrazier Apr 20 '10 at 16:52
@afrazier: Thanks. Panda was infected and I'm using Microsoft Security Essentials now. – Wesley Apr 20 '10 at 22:40

csrss.exe is a vital component of a Windows installation. The best thing to do would be to open a cmd prompt (start -> run, type cmd and press enter) and type sfc /scannow. This will invoke the Windows System File Checker, which will scan and ensure all files are present and working. When it hits csrss.exe, it should restore it from its cache, or prompt you to insert your Windows disc (being a netbook, if it doesn't have a CD drive, you can use an external USB one, or a Windows installer USB drive). That should restore csrss.exe in the proper place for you.

share|improve this answer
+1 Didn't think of the sfc /scannow option. Watch out with that one though. I've seen systems where even the cache from the System File Checker was infected, so running that command actually placed the virus back! – fretje Apr 20 '10 at 15:16
It happens sometimes. But I usually tell people who get viruses/trojans/other infections that the only true way to make sure it's gone is to format & reinstall the operating system (maybe too harsh an answer for this question). – squircle Apr 20 '10 at 15:22
@thepurplepixel: That's exactly what I do. – fretje Apr 20 '10 at 15:26
@thepurplepixel: I want to avoid a reformat on this netbook, as the manufacturer has many preset configurations that I don't want to mess with. However I will do it if I can't fix this... – Wesley Apr 20 '10 at 22:40
@Wesley: Exactly, that's why I answered with the sfc option instead of just reformat it. Hope you get a quick & easy solution! – squircle Apr 20 '10 at 23:02
up vote 0 down vote accepted

So, this was the solution:

Firstly, there were the basic antivirus software scans to determine any remaining threats on the computer. Using two different AV softwares was useful as my original AV software was infected.

Secondly, Most answers thought that the vital Windows application csrss.exe was not supposed to exist anywhere else but in C:\WINDOWS\system32\. However, csrss.exe actually exists as a completely hidden file under the user's folder in C:\Documents and Settings\USER\.

The system32 version of the file was unharmed, but it was the file in the user folder that was causing a dialog box to pop up on startup. The simple solution was to copy a clean copy from another machine and to copy and paste it into the user folder, even though it is not actually visible.

Thanks to others for their help!

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .