I have a Lenovo W520 Win7 machine which in the past few weeks has twice displayed this message shortly after turning off the wireless.

enter image description here

It's not an Asian language version of Windows so I'm particularly worried about that window caption (which I'd love for somebody to translate for me please).

I've used procexp.exe to trace the window back to the csrss.exe process. Antivirus gives the system a clean bill of health but I'm not convinced. Anyone seen this before or can translate that caption for me?

  • Does it stop if you do a System Restore to a point before it started? – Ƭᴇcʜιᴇ007 Jun 1 '13 at 15:22
  • I haven't tried. At this stage I'm just trying to establish what it is. – LachlanG Jun 1 '13 at 15:24
  • Sounds like a virus. Why would CSRSS be looking for a server? – Tanner Faulkner Jun 2 '13 at 16:43
  • Turns out that caption is just in the wrong encoding. Convert it from UTF-16 and it reads NUMBER_OF_PROCESSORS=8. So... what now? – LachlanG Jun 6 '13 at 12:03

Real CSRSS is an important system process. Some viruses might pretend to be CSRSS, but it's also possible that it's just a buggy driver causing that popup.

Run Task Manager with administrative privileges (open Start menu, type taskmgr, right-click it and choose Run as Administrator) and check how many csrss.exe processes are listed on the Processes tab. You should see two instances of it. If there are more of them, it may be a virus - you should perform a scan using an up-to-date LiveCD scanner, for example Dr. Web CureIt! LiveCD.

If there are only two csrsses, then it's probably just a crappy driver. Laptop manufacturers often include some poor-quality software that's poorly translated and happens to crash quite often.

If you want to get rid of that message, then you should try something like PC Decrapifier to guide you through removing of the Lenovo bloatware.

  • There's just the two instances of csrss.exe in TaskMgr. I'd be surprised if it's Lenovo software producing the message as the machine is nearly 2 years old and the messages only started in the past few weeks. – LachlanG Jun 1 '13 at 15:03
  • @LachlanG Perhaps the server it's failing to connect to had just gone down recently (a few weeks ago). – Ƭᴇcʜιᴇ007 Jun 1 '13 at 15:17
  • @techie007 I don't think that's it. The message appears when I turn off my wireless, never when I'm connected to a network. – LachlanG Jun 1 '13 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.