why got \??\ in the path ?

  • Thread starter Thread starter Polaris
  • Start date Start date
P

Polaris

Hi Experts:

Wrote a small program on XP to get a list of running processes. I used the
GetModuleFileNameEx, EnumProcessModules to go through each process and get
the process path, most of the returned path is ok, but noticed strange one
below:

\??\C:\WINDOWS\system32\csrss.exe (0x4A680000)

Anyone knows why there is \??\ at the front of the path? Does that mean the
csrss.exe is a virus? In task manager, the csrss.exe is running and cannot
be stopped.

Any thought is appriciated.

Thanks In Advance!

Polaris
 
I don't know offhand the reason but I would download Process Explorer from
SysInternals to see what it shows in the process properties as the path.
Also on my computer XP SP2 Process Explorer shows in the image page of the
process properties that csrss.exe is "verified" from Microsoft Corp. which
means that it is digitally signed and authentic though not all MS files
related to processes are verified/signed. It certainly would not hurt to run
an antivirus program being sure to have the latest virus definitions before
scanning and maybe try the RootkitRevealer from SysInternals. --- Steve

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml
http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml
http://www.liutilities.com/products/wintaskspro/processlibrary/csrss/ ---
info about csrss.exe
 
On Fri, 22 Apr 2005 23:30:35 -0700, "Polaris" <[email protected]>
wrote in [microsoft.public.windowsxp.security_admin,
microsoft.public.security, microsoft.public.security.virus,
microsoft.public.windows.server.security] and
microsoft.public.win2000.security,:
Hi Experts:

Wrote a small program on XP to get a list of running processes. I used the
GetModuleFileNameEx, EnumProcessModules to go through each process and get
the process path, most of the returned path is ok, but noticed strange one
below:

\??\C:\WINDOWS\system32\csrss.exe (0x4A680000)
Click to expand...
Anyone knows why there is \??\ at the front of the path? Does that mean the
csrss.exe is a virus? In task manager, the csrss.exe is running and cannot
be stopped.
Click to expand...

If you really meant "\\?\C:\WINDOWS\ ..." (two backslashes, one queston
mark): that is NT's way of expressing a Unicode string for a filename.
 
Polaris said:
Anyone knows why there is \??\ at the front of the path?
Click to expand...

It's the full path, as used by the NT kernel. Win32 objects "live" under the
\?? directory in the object manager namespace.

The reason why you're getting an NT path for this particular process is that
csrss.exe is started directly using NtCreateProcess, before the Win32 API
could be used.
Does that mean the csrss.exe is a virus?
Click to expand...

No. Actually, csrss.exe is the Win32 subsystem server, and is a vital part
of an NT system. It's used to implement several parts of the Win32 API,
including console windows and part of the windowing system.

However, several malicious programs try (very hard) to look like csrss.exe,
so you're right to be wary.
In task manager, the csrss.exe is running and cannot be stopped.
Click to expand...

That's normal. If you could stop csrss.exe, your system would become
unusable (no Win32 API...). So, Windows prevents you from shooting yourself
in the foot. (Actually, it goes farther than that. The NT kernel is keeping
a watch on the csrss process, and will go immediately into a blue screen if
csrss.exe stops).
 
Back
Top