CSRSS.EX_ possible virus

MoRT489 · 25 Sep 2009 at 12:05

Hi Guys

Last couple of days i've been getting an error message at startup on my work PC saying that CSRSS.EX_ failed to run. Just as well cos a little internet searching tells me it is a Trojan!!!

csrss.exe in the sytem32 folder is a legit service and runs in task manager fine, however the CSRSS.EX_ instance is found in the C:\I386 folder and fortunately fails to initialise.

What should i do to get rid of it or should i just tell IT to sort it out? Running a McAfee scan now.

Hoping it's just spyware

Coldzero · 25 Sep 2009 at 12:13

If the scan doesn't work, phone IT.

Guest2 · 25 Sep 2009 at 12:23

IT should already know if they have a decent virus system. You shouldnt have had any warning though as the virus/exe should have been blocked/deleted.

Ring IT

MoRT489 · 25 Sep 2009 at 12:35

No hits on virus scanner - right o, better hide msn, skype, chrome and opera then :rolleyes:

Or i could install Ad-aware and run that first?

paradigm · 25 Sep 2009 at 13:32

creed said:
No hits on virus scanner - right o, better hide msn, skype, chrome and opera then

Or i could install Ad-aware and run that first?

Sounds like your IT department actually need to sort out their user restriction policies.

Allowing end-users to download/install/run what they like?

Moronic IT department deserves all the Virii it gets.

Guest2 · 25 Sep 2009 at 13:53

paradigm said:
Sounds like your IT department actually need to sort out their user restriction policies.

Allowing end-users to download/install/run what they like?

Moronic IT department deserves all the Virii it gets.

this. if your users so much as go on a site with dodgy temp files they get blocked/deleted and we get warnings. Thats if the site manages to get through the strict category filer

MoRT489 · 25 Sep 2009 at 14:46

Not sure why it's so open, but i've seen them using the above so...i even asked about msn on the last laptop.

MoRT489 · 30 Sep 2009 at 14:55

Is this def a virus cos it doesnt give me the error message anymore and Adaware, SuperAntiSpyware and McAfee dont pick it up?

Guest2 · 30 Sep 2009 at 16:46

creed said:
Is this def a virus cos it doesnt give me the error message anymore and Adaware, SuperAntiSpyware and McAfee dont pick it up?

McAfee is ****. It might not be adware. Just a virus. When i switched from McAfee to NOD32 it found about 3 viruses on my machine. (that was luckily a few years ago now)

bledd · 1 Oct 2009 at 09:18

http://www.spywareremove.com/removeWinSpy.html

install mbam and scan with that

mcafee is cack

MoRT489 · 1 Oct 2009 at 15:36

Thanks will give it a whirl. What's WinSpy got to do with it?

Ysmalari · 1 Oct 2009 at 15:55

When my work network got hit by a virus we would get the same 'failed to run...' message on boot up but only because IT had already removed the virus but for some reason the startup links were still there.

Don't know a huge amount about the subject but it certainly sounds like a similar situation, feel free to ignore if I'm talking poo

MoRT489 · 7 Oct 2009 at 15:29

Just to update, MBAM found one suspicious file in the registry which it claims is a trojan but is actually the logon scripts using wkix32 (kixtart.org).