For Loop High CSRSS CPU - windows

Question

I have a batch file that takes an input file (in this case the file is a flat text file comprised of a file listing from a specified set of Windows XP system directories).
Then through a combination of a for loop to iterate through each file listed in the text file), setting a variable, using several call commands (in this case 9), and the find command to search the text file for files that appear in the output of other flat files.
The problem I am running into is that csrss.exe is using quite a bit of CPU processing. In reading some other articles it seems that csrss has a relationship with command line processing.
What I want to know is if there is a better way to do this that will:
Reduce overall script time.
Reduce CPU load.
Below is a sample of the script:
:: ------------------------------------------------------
:: Running Multiple Commands
:: ------------------------------------------------------
for /f "delims=?" %%A in (dir-selected_tmp.txt) do (
set filepath=%%A
call :filepathparse
call :md5hashchk
call :versionchk
call :densitychk
call :processchk
call :mutexchk
call :networkchk
call :injectedchk
call :persistservicechk
call :servicedllchk
call :persistrunchk
call :persistothchk
call :unsigneddllchk
call :filesysag
)
goto :comparison
:: ####################################################################
:filepathparse
for %%B in ("%filepath%") do (
set filename=%%~nxB
)
goto :eof
:: ####################################################################
:md5hashchk
for /f "delims= " %%b in ('md5deep.exe "%filepath%"') do set hashvalue=%%b
goto :eof
:: ####################################################################
:versionchk
for /f "delims= " %%e in ('sigcheck.exe /accepteula -q -n "%filepath%"') do set versionvalue=%%e
goto :eof
:: ####################################################################
:densitychk
for /f "delims= " %%d in ('densityscout.exe -p 0.1 "%filepath%"') do set densityvalue=%%d
goto :eof
:: ####################################################################
:processchk
find.exe /I "%filepath%" %temp_outpath%\wmic-processes.txt > nul 2>&1 && goto processexist
set isprocess=NoActiveProc
goto :eof
:processexist
set isprocess=ActiveProc
goto :eof
:: ####################################################################
:mutexchk
if "%startup_chk%"=="-b" (
goto :mutexbl
)
find.exe /I "%filepath%" %temp_outpath%\filesystem-handles_compared.txt > nul 2>&1 && goto mutexexist
set ismutex=NoNewActiveMutex
goto :eof
:mutexexist
set ismutex=NewActiveMutex
goto :eof
:mutexbl
find.exe /I "%filepath%" %parsed_outpath%\filesystem-handles.txt > nul 2>&1 && goto mutexexist
set ismutex=NoNewActiveMutex
goto :eof
:mutexexist
set ismutex=NewActiveMutex
goto :eof
:: ####################################################################
:networkchk
find.exe /I "%filename%" %temp_outpath%\tcpvcon_tmp.txt > nul 2>&1 && goto networkexist
set isnetwork=NoActiveNetwork
goto :eof
:networkexist
set isnetwork=ActiveNetwork
goto :eof
:: ####################################################################
:injectedchk
find.exe /I "%filepath%" %temp_outpath%\injecteddll_tmp.txt > nul 2>&1 && goto injectedexist
set isinjected=NoActiveInject
goto :eof
:injectedexist
set isinjected=ActiveInject
goto :eof
:: ####################################################################
:persistservicechk
find.exe /I "%filepath%" %temp_outpath%\autoruns-services_tmp.txt > nul 2>&1 && goto serviceexist
set isservice=NoInstalledService
goto :eof
:serviceexist
set isservice=InstalledService
goto :eof
:: ####################################################################
:servicedllchk
find.exe /I "%filepath%" %temp_outpath%\registry_hklm_installed_service_dlls_final.txt > nul 2>&1 && goto servicedllexist
set isservicedll=NoInstalledServiceDLL
goto :eof
:servicedllexist
set isservicedll=InstalledServiceDLL
goto :eof
:: ####################################################################
:persistrunchk
find.exe /I "%filepath%" %temp_outpath%\autoruns-run_tmp.txt > nul 2>&1 && goto runpersistexist
set isrunpersist=NoRunPersist
goto :eof
:runpersistexist
set isrunpersist=RunPersist
goto :eof
:: ####################################################################
:persistothchk
find.exe /I "%filepath%" %temp_outpath%\autoruns-oth_tmp5.txt > nul 2>&1 && goto persistothexist
set isothpersist=NoOtherPersist
goto :eof
:persistothexist
set ispersist=OtherPersist
goto :eof
:: ####################################################################
:unsigneddllchk
find.exe /I "%filepath%" %temp_outpath%\listdlls_temp2.txt > nul 2>&1 && goto unsigneddllexist
set isunsigneddll=NoUnSignedProcDLL
goto :eof
:unsigneddllexist
set isunsigneddll=UnSignedProcDLL
goto :eof
:: ####################################################################
:filesysag
:: Compiling Into Syslog Format
echo %datestamp%^|%currtime%^|%computername%^|%currip%^|%username%^|%lastlogintime%^|"%filepath%"^|%hashvalue%^|%versionvalue%^|%densityvalue%^|%isprocess%^|%ismutex%^|%isnetwork%^|%isinjected%^|%isservice%^|%isservicedll%^|%isrunpersist%^|%isothpersist%^|%isunsigneddll% >> %syslog_outpath%\%computername%-syslog.txt
:: Compiling Into Parsed Format
echo "%filepath%"^|%hashvalue%^|%versionvalue%^|%densityvalue%^|%isprocess%^|%ismutex%^|%isnetwork%^|%isinjected%^|%isservice%^|%isservicedll%^|%isrunpersist%^|%isothpersist%^|%isunsigneddll% >> %parsed_outpath%\%computername%-filesystem.txt
goto :eof

Answer 1

Sadly, your reluctance to provide further details means we are severely retricted on the amount of help we can offer.
I'd recommend:
First, build a list of the filepaths yu are interested in
(for /f "delims=?" %%A in (dir-selected_tmp.txt) do echo %%A )>paths_of_interest.txt
Then build temporary files containing a subset of the log data
findstr /I /g:paths_of_interest.txt %temp_outpath%\processes.txt >"%temp%\processes.x.txt"
Then re-process according to your original scheme, instead using paths_of_interest.txt and "%temp%\processes.x.txt"
This should reduce the amount of repetition, especially if you have long files.
:: ------------------------------------------------------
:: Running Multiple Commands
:: ------------------------------------------------------
:: Pre-processing
SET /a step=1000
SET /a dirstart=0
SET "dirskip="
:mainloop
SET /a dirsleft=0
SETLOCAL enabledelayedexpansion
(
for /f "%dirskip%delims=?" %%A in (dir-selected_tmp.txt) do (
SET /a dirsleft+=1
IF !dirsleft! leq %step% ECHO %%A
)
)>temp_dirs.txt
endlocal&SET /a dirsleft=%dirsleft%
FINDSTR /i /l /g:temp_dirs.txt "%temp_outpath%\wmic-processes.txt" >temp_filepathparse.txt
if "%startup_chk%"=="-b" (
FINDSTR /i /l /g:temp_dirs.txt "%parsed_outpath%\filesystem-handles.txt" >temp_mutexchk.txt
) ELSE (
FINDSTR /i /l /g:temp_dirs.txt "%temp_outpath%\filesystem-handles_compared.txt" >temp_mutexchk.txt
)
FINDSTR /i /l /g:temp_dirs.txt "%temp_outpath%\tcpvcon_tmp.txt" >temp_networkchk.txt
FINDSTR /i /l /g:temp_dirs.txt "%temp_outpath%\injecteddll_tmp.txt" >temp_injectedchk.txt
FINDSTR /i /l /g:temp_dirs.txt "%temp_outpath%\autoruns-services_tmp.txt" >temp_persistservicechk.txt
FINDSTR /i /l /g:temp_dirs.txt "%temp_outpath%\registry_hklm_installed_service_dlls_final.txt" >temp_servicedllchk.txt
FINDSTR /i /l /g:temp_dirs.txt "%temp_outpath%\autoruns-run_tmp.txt" >temp_persistrunchk.txt
FINDSTR /i /l /g:temp_dirs.txt "%temp_outpath%\autoruns-oth_tmp5.txt" >temp_persistothchk.txt
FINDSTR /i /l /g:temp_dirs.txt "%temp_outpath%\listdlls_temp2.txt" >temp_unsigneddllchk.txt
for /f "delims=" %%A in (temp_dirs.txt) do (
set "filepath=%%A"
call :filepathparse
....
call :filesysag
)
SET /a dirstart=%dirstart%+%step%
SET /a dirsleft=%dirsleft%-%step%
IF dirsleft gtr 0 SET dirskip=SKIP=%dirstart%&GOTO mainloop
goto :comparison
Then simply replace the filename in each of your routines :processchk to :unsigneddllchk with the corresponding temp_whatever.txt file created in the pre-processing. The switch on mutex is already done in the pre-processing.
This should reduce the searching done by the find command and hence the overall run time by selecting only those lines containing the target strings into the temp_* files created.
[Edit in response to further information provided]
Note the preprocessing block before the first findstr has been changed and that there is now a post-processing block between call :filesysag ) and goto :comparison
The object here is to reduce the size of the temp_dirs.txt file. I've arbitrarily chosen 1,000 (the size of step) but have no real idea of how big step should be. The larger it is, the quicker the process will be, but if it's too large, temp_dirs.txt will be too big for findstr to handle.
Note the use of the parsing trick on the line endlocal&SET /a dirsleft=%dirsleft% which uses the parsing system to move the modified value of dirsleft out of the setlocal/endlocal block.