Using Windows Task Manager, I have tracked down the processes which are
keeping my boot drive active the whole time. These are Lsass.exe (LSA Shell
(Export Version), csrss.exe (client server runtime process), both located in
Windows System 32. Task Manager cannot end these processes, because they are
"critical system Processes".

Does anybody know what these two processes are actually up to continually
reading/writing to my boot drive, are they really critical, and if not, is
there any way to kill them?

The only other process continually reading is Wacom Tablet service, which I
can end.

regards,

Peter

King.peter wrote:

> Using Windows Task Manager, I have tracked down the processes which
> are
> keeping my boot drive active the whole time. These are Lsass.exe
> (LSA Shell (Export Version), csrss.exe (client server runtime
> process), both located in
> Windows System 32. Task Manager cannot end these processes, because
> they are "critical system Processes".
>
> Does anybody know what these two processes are actually up to
> continually reading/writing to my boot drive, are they really
> critical, and if not, is there any way to kill them?
>
> The only other process continually reading is Wacom Tablet service,
> which I
> can end.

In this case, I would look to the Wacom drivers/software as being the
culprit. Check on their support site and/or user forums for known
issues. As for the Windows processes, those are indeed critical and you
cannot end-task them.

http://www.google.com/search?hl=en&s...ss.exe&spell=1
http://www.google.com/search?hl=en&l...xe&btnG=Search

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

King.peter wrote:
> Using Windows Task Manager, I have tracked down the processes which
> are keeping my boot drive active the whole time. These are
> Lsass.exe (LSA Shell (Export Version),

See here:
http://www.neuber.com/taskmanager/pr...lsass.exe.html

csrss.exe (client server
and here:
http://support.microsoft.com/kb/555021

The above, and many more, links indicate many virus possibilities for both
files.

> runtime process), both located in Windows System 32. Task Manager
> cannot end these processes, because they are "critical system
> Processes".
>
> Does anybody know what these two processes are actually up to
> continually reading/writing to my boot drive, are they really
> critical, and if not, is there any way to kill them?

On my machine, at this moment, both processes are using 0 cpu time.
Both can be a symptom of a virus.
I'd first try removing the Wacom Tablet and see if that makes a difference.
If not, then I'd say next should be running a good, UPDATED anti-virus
program, plus about three spyware scanners and see if everything comes up
clean.

>
> The only other process continually reading is Wacom Tablet service,
> which I can end.

Rather than just ending it, I'd suggest a full removal to see if it's the
culprit. From what I've read, and another post here, I think it's a likely
culprit and the install either failed, or it's infected/corrupted/whatever.
If ending it doesn't stop the 100% cpu and send them to near 0 when no
programs are running, then I'd say chances are real good you've picked up a
virus or malware of some sort. Be certain to update your antivirus before
using it.

HTH
Pop`

>
> regards,
>
> Peter

> On my machine, at this moment, both processes are using 0 cpu time.
> Both can be a symptom of a virus.
> I'd first try removing the Wacom Tablet and see if that makes a difference.
> If not, then I'd say next should be running a good, UPDATED anti-virus
> program, plus about three spyware scanners and see if everything comes up
> clean.
>
> >
> > The only other process continually reading is Wacom Tablet service,
> > which I can end.
>
> Rather than just ending it, I'd suggest a full removal to see if it's the
> culprit. From what I've read, and another post here, I think it's a likely
> culprit and the install either failed, or it's infected/corrupted/whatever.
> If ending it doesn't stop the 100% cpu and send them to near 0 when no
> programs are running, then I'd say chances are real good you've picked up a
> virus or malware of some sort. Be certain to update your antivirus before
> using it.
>
> HTH
> Pop`

I have come back to this problem, because I have tried your suggestions,
with no success. I am hoping that the question will be picked up again
after a delay.

I uninstalled the Wacom tablet driver, ran scans with updated F-Secure 2006
(virus and spyweer sweeps), and spyware sweeps with updated Spy-Bot Search
and Destroy, and updated Webroot Spysweeper. No viruses, rootkits, or other
spyware were found, other than a handful of harmless cookies which have been
deleted.

Furthermore, both lsass.exe and csrss.exe reside in the Windows System32
folder as they should. Finally, the CPU column in Task Manager shows 00 when
they are reading and writing to the boot disk.

crss.exe writes, but does not read, lsass.exe reads and writes continuously
in equal measure. I would dearly love to find the reason for any process tp
demand such a high level of access to a drive, and how can I suspend it?

Peter King