XP Looking for csrss.exe in Wrong Place / Can't Find It

[newsgroup guy]

My stupid Windows dual-boot spits out a weird error message every time I boot into Windows XP. I am dual-booting XP and 7, by the way.

I've had this dual-boot for years without problems, but I don't know what happened and since yesterday I get this error message every time I start XP:
"Windows cannot find 'C:\WINDOWS\Config\csrss.exe'. Make sure you typed the name correctly, and then try again. To search for a file [BLA BLA BLA]."

(Also BTW, System Restore is crap; it fixes nothing. I don't even know why I kept such a useless feature enabled.)

Needless to say, everybody hates such retarded, ugly, annoying pop-up error warnings that seem to mess up the entire computer-use experience right from the start. I want it gone, naturally, no matter what the recourse used.

Oh, and most importantly: THE C: DRIVE IS THE WINDOWS-7 DRIVE AND E: IS THE WINDOWS XP DRIVE. (So why the hell is Windows XP even looking in C:\?????)

There must be a simple universal fix, I'm sure, but with my limited knowledge I just don't see what it is. I tried putting the csrss.exe from E:\WINDOWS\system32 into C:\Windows\Config -- had to create Config in the Win7 Windows folder, of course, because there was none --, and into E:\WINDOWS\Config also, to be sure, but then I got an error message saying csrss.exe "application cannot be run in Win32 mode".

P.S. Hey, could it be that maybe when I installed and then uninstalled a program -- VobBlanker, a disappointing program which I removed almost right after installation a little more than about 24-36 hours ago -- the uninstall procedure of said program was so flawed that it also deleted system files from my system, including csrss.exe? How do I fix it, though? Thanks.

[DB83]

Well I can not help you with csrss.exe but do a Google and it may tell you what program, not necc Windows itself, depends on it.

As for the C: E: drive issue, XP will always report it's boot system drive as 'C' even if Win7 sees that same drive as 'E'. Just look at Disk Management under both systems to see what I mean. XP will probably report your C drive for Win7 as some low letter if indeed it sees it at all.

[newsgroup guy]

I have already did a Google search for the problematic error message, and I could not find anything to help me.

That's why I asked here. (Of course, I'd rather first do a Google search because it takes less time and effort than explaining the problem in as much detail as reasonable, and well enough for other people to read and give their two cents, you know? Not to mention the long wait for a useful response, oftentimes.)


P.S. Oh, DB83, I almost forgot -- and it's not only Windows 7 that sees the Windows-XP root as E: (when booting in 7), but also Windows XP! Yes, XP also sees its root folder as E: (even when booting in XP, as well). Hence my astonishment.

[newsgroup guy]

Should I pop in the Windows XP CD and use its REPAIR feature?

[El Heggunte]

First of all, open regedit and check if the damn .EXE is being called by

HKEY_LOCAL_MACHINE\Software\Microsoft \Windows\CurrentVersion\Run

or by

HKEY_CURRENT_USER\Software\Microsoft \Windows\CurrentVersion\Run

If answer == yes, then simply delete the invalid reference from the Registry.

[newsgroup guy]

Thanks, El Heggunte, for the suggestion.

But I see nothing involving csrss.exe in either HKEY_LOCAL_MACHINE\Software\Microsoft \Windows\CurrentVersion\Run or HKEY_CURRENT_USER\Software\Microsoft \Windows\CurrentVersion\Run.
The regular startup programs are there, such as for example ctfmon.exe (-CURRENT_USER-) and GrooveMonitor.exe, of Microsoft Office 12 (-LOCAL_MACHINE-), among others that are also familiar to me.

[jman98]

csrss.exe is the Client/Server Runtime SubSystem. It's part of all Windows from NT on up through present. I've seen programs like this vanish due to a PC going through a power outage where it wasn't connected to a UPS and it lost power. I can't tell you why this happens, only that this is how I've seen it vanish.

Repair may be able to fix this.

In general my experience is that Windows doesn't handle booting from drives other than C particularly well, so what you are seeing is probably some default behavior it's falling back on when it found the error. It probably needs csrss.exe working correctly to understand that it's not actually in the C drive.

[newsgroup guy]

There's a key (that I just located again using REGEDIT) in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon that says:
Name: Shell -- Type: REG_SZ -- Data: Explorer.exe C:\WINDOWS\Config\csrss.exe

Should I delete this?
Not the whole Winlogon, of course, which has a lot of other stuff in it, seemingly legit, but just the REG_SZ key?

[DB83]

Well as for the drives that is not the impression I got in your OP hence my response.

BTW are these 'drives' partitions of one or entirely separate. That could explain.

But on my multi-boot, I have Win7 on one drive which boots as C:. XP on another independent drive appears as D: under Win7 (although I can not run it direct). Yet when I do boot into XP, that drive D: now shows up in Win Explorer as C: with the Win7 drive as J: (since I have a lot of drives and partitions)

But if these are on the same drive I also wonder if your boot sector has been screwed up somewhat.

A quick Google did find this:

"csrss.exe is a standard file, which runs in Windows systems. This process is necessary to help Windows operate properly. Users should never stop or terminate this process using Windows Task Manager, because this may cause very serious Windows operational errors, such as Black Screen of Death and similar issues. csrss.exe file is usually located in C:\Windows\System32 folder and takes about 4,000 - 7,000 bytes of disc space. This file is also known as a Windows Client Server Runtime Process and is responsible for managing the majority of the graphical instruction sets under the Microsoft Windows operating system.

DANGER!

Sometimes viruses and other cyber threats may be named just like legitimate Windows processes. csrss.exe is a legitimate and essential file of Windows, therefore, hackers often use this name for naming their own viruses. If you noticed that there are more than two csrss.exe processes running on your Windows system, there are huge chances that your computer was affected by W32.Backdoor.Sokacaps, Spy Software 4 Parents, KidWatcher, Key Logger Buddy Pro, ICE Remote Spy and many other viruses. You should waste no time and check the file with some reliable security tools in order to make sure that computer is safe."

[newsgroup guy]

Yeah, I think I found and read that same page, through Google, too, DB83. But that barely helps me at all, ain't that the truth?

Also, yes, it's the same HDD, a Western Digital, and I know that Western Digital drives are crappier than most, but it was the cheapest available in that range when the computer was built. But maybe we shouldn't even talk about it failing yet. -- The boot sector would be on the Win7 partition, and 7 works fine. (So I don't think I should think about that possibility yet.)

Besides, I WAS NEVER CONSIDERING DELETING CSRSS.EXE (which seems to be only in legitimate places) but to get rid of the damn pop-up error warning!


CURRENTLY, THOUGH, I COULD REALLY USE AN EDUCATED ANSWER TO THIS:

There's a key (that I just located again using REGEDIT) in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon that says:
Name: Shell -- Type: REG_SZ -- Data: Explorer.exe C:\WINDOWS\Config\csrss.exe

Should I delete this?
Not the whole Winlogon, of course, which has a lot of other stuff in it, seemingly legit, but just the REG_SZ key?

Should that stop the annoying message: "Windows cannot find 'C:\WINDOWS\Config\csrss.exe'. Make sure you typed the name correctly, and then try again."? It should, right?


Thanks.

[DB83]

Delete that key ?

I doubt it given its critical use within Windows.

Did you check E:\Windows\System32 to see if that file exists in the folder ?

[newsgroup guy]

Again, I DON'T MEAN DELETING WINLOGON!!!

I MEAN DELETING THE SHELL REG_SZ inside that folder THAT SAYS "Explorer.exe C:\WINDOWS\Config\csrss.exe"!!

You understand what I was/am saying, right?

That particular REG_SZ (inside the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon REGEDIT folder) seems to be linked exactly with the message I am getting.
Removing that key, therefore, would not remove the message?????!!???

P.S. And, again, I am NOT talking about deleting or relocating any csrss.exe files (anymore). I did it, and it solved nothing, so I'm back to just having one csrss.exe (in Windows XP) in E:\WINDOWS\system32. That's it! It exists only there (on E:\), yes!

[El Heggunte]

On my XP machine,

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = says Explorer.exe

On your machine, somehow some stupidware did what it should have never done, granted.

AFAIR, %WinDir%\Config is used as a temporary folder by some MSI packages.

And csrss.exe has always lived inside %WinDir%\system32.

[DB83]

I'm not going to suggest you delete that entry since it is there for a purpose.

And I perfectly understand what you are saying. But if you start 'shouting' at those who take the time out to try and help then they will soon lose interest in you and remember the next time you need that help.

Now if you can have just a modicum of patience I will check my XP registry. Win7 just says 'explorer.exe' as above. But not tonight. Got more important things to do than be shouted at.

Or

You can take the risk and edit that key to remove the 'C:\WINDOWS\Config\csrss.exe' bit just leaving 'explorer.exe'

But it's your risk.

[newsgroup guy]

How was I shouting at you, DB83???!?

EDIT: Oh, I get it, because of the caps?!... No, honestly, I put those words in caps for emphasis! Not to yell at you. I'm really sorry if you got the wrong impression. Granted, I was a bit frustrated, and I felt I should re-emphasize certain portions of my previous message that it seemed to me you maybe glossed over quickly, but I never yelled at anyone. And I hope you believe me. (There was a time when making things larger for someone to see only meant that it was done for emphasis. I'm more old-fashioned than you think. To give you another for instance, look, I am telling you I had to look up "AFAIR", from El Heggunte's post, because I didn't know for sure what he meant by that word. So, it's cool, I hope?)


El Heggunte, thank you very much, I'll modify it to say just "Explorer.exe" -- if I can -- and see if that fixes the issue.


And thank you very much, DB83, too, for all your help as well.

[DB83]

Apology accepted. In my book, there is no harm intended to emphasise a single WORD. I often do that myself. But netiquette usually dictates that a whole sentence in upper-case is a form of shouting.

I hope you come back and say if the above suggestion worked.

But what is equally important is how that rouge entry got there in the first place. I would guess it was some sort of 'alien' who wanted to point to that .exe for its own evil purposes. Since you, unknowingly, somehow deleted the file the classic Windows error popped up.

[newsgroup guy]

Hurray, no more annoying message!
Man, I was really worried that my best computer was infected by virus(es) and/or malware. Maybe it still is, but hopefully not.
'Cause, you see, I only installed two programs 2 days ago that could have caused this:
-> NeroVision Express -- the very old, stand-alone version -- but which couldn't possibly have caused this, I believe, because 1) it is a reputable program and 2) I've installed it on another computer in the past and it hasn't produced this error on that one
&
-> VobBlanker -- but it was the portable version, which could be deleted by just deleting the folder -- and I'm afraid that maybe this was it, because the program itself was quite a bad one, seemingly very-rashly-thrown-together. (I think I mentioned this above, previously.) It's very possible that this program, if not malware/ad-aware, was just really unprofessional in dealing with the registry.
Don't you think that's possibly the case?


And DB83, please also allow me to say, again in my defense, that I did not even write an entire sentence in its entirety in caps. Both those structures that seemed like shouts were fragments of sentences. And just for emphasis.
But you're right, nevertheless. I should pay more attention to netiquette. I should have underlined them, or something different than caps. I wasn't thinking of that aspect at all. From now on, I'll be more careful.
Very glad we're all straightened out now.


Thanks again, to both of you.

[DB83]

Let's not argue if the word 'again,' in lower-case before the rest in upper-case does not constitute a complete line

I did not think that a portable version of anything could 'install' anything unless that version itself was a fake.

You would be wise to run a malwarebytes scan on your drives. If there is an infection it is pretty good in finding it. Certainly saved me from some grief.

[newsgroup guy]

Okay.

Yeah, I'm surprised, too; that's why I'm not saying with absolute conviction that it was VobBlanker. (But, unless I did something that never crossed my mind to take into account, what else could it have been, other than VobBlanker? I did nothing else out of the ordinary, that I don't do regularly in that OS, to my knowledge.)

I ran a Quick Scan with Avira -- an older main program (not released in 2014) but up-to-date on definitions. It found nothing wrong. Should that be okay? That's the (active) security software that I have/had installed.
I'll run a long scan now, actually, on the E drive. Why not, right? To be even more sure.
(I don't have Malwarebytes on that system. I used to have it on another system, and I was quite happy with it, because it had support for Windows 2000 - which I am crazy about - still, but then all of the sudden the engine wouldn't load anymore. It kept saying it can't start, upon restart. So, it became useless. And I uninstalled it. Maybe they decided to lose support for Windows 2000, I don't know, but if that was the case that was a very lousy way to stop working on people's older OSs. Since then, I'm kind of soured regarding Malwarebytes.)

P.S. On an unrelated note, I'm a big fan of Rowan Atkinson / Mr. Bean, too. He sure is a great legend of comedy.

[jman98]

Okay.

Yeah, I'm surprised, too; that's why I'm not saying with absolute conviction that it was VobBlanker. (But, unless I did something that never crossed my mind to take into account, what else could it have been, other than VobBlanker? I did nothing else out of the ordinary, that I don't do regularly in that OS, to my knowledge.)

Windows is still an absolute POS operating system riddled with bad design decisions from years ago, like the truly horrible Windows Registry, that have to be supported to this day for compatibility reasons. These MANY MANY very bad and ill conceived design decisions sometimes result in inexplicable behavior, like programs vanishing or simply ceasing to work for no known reason. It's very possible that nothing you installed is responsible for what happened and that nobody will ever know what really happened to cause your problem.

[newsgroup guy]

Yes, Jman98, I agree with you, and you're right, but the need for Windows now is almost something like the need for one's/my human body: One is so sick of its problems, that one always has to work on, but the alternatives are far more daunting than continuing to work on the annoying problems that have plagued one since one got this, let's call it, shell of existence/use.
(...And Linux or Mac OS, etc., would be, at least for me, like trying to pay for and learn to use a robot interface, if you see what I'm trying to say. Not everybody can afford to get it, or even attempt to use the much-stranger, more alien and cumbersome alternative.)

So, I'm kind of stuck.