csrss.exe virus?

Darg

Darg

Darg

Soldato
Joined
6 Sep 2006
Posts
6,302
Location
London
Hey guys, generally I'm fine with finding viruses and getting rid of them. I rarely get them anyway as I'm pretty careful with what I run. However this ones cropped up lately and I'm a little worried about it. It doesn't seem to be having any detrimental affect but I don't like having anything running that I don't know about. It comes up as csrss.exe in processexplorer and the dll and handles seem to point to the file in the c:windows directory. I can't find any mention of it in msconfig startup files. I'm a bit baffled about this one. I don't want to delete the file in the windows folder but I don't want to have it starting up every time. I can kill process and it doesnt come back but it's just annoying.

What's the best freeware antivirus tool out there? Still AVG?
 
That was the first thing I did. I was just wondering if anyone else has had this specific problem and if there is a simple way to get rid of it (a specific file hidden somewhere like usual etc..) instead of having to do a full virus scan and my second question was what's the best freeware virus scanner out there at the moment.

I suppose we could all try using google to fix our problems but if everyone did that then where would the information for google come from in the first place if not from computer enthusiasts forums designed to help out eachother in whatever way possible.
 
AFAIK, csrss.exe is just a harmless Windows process.
However, it is probably possible that a virus could disguise itself as csrss.exe. To help put your mind at rest, why not do a virus scan?

I have read good things about the Kaspersky online virus scan. It is very slow, but apparently very thorough and good at detecting viruses. I don't think it removes them, but at least you will know if you are infected.

If you want an actual AV program, which I recommend you do, then either AntiVir, AVG or Avast! are currently the best.

AntiVir detects the most viruses, but I think it doesn't scan incoming or outgoing emails and their attachments, which is a huge letdown. It will stop a virus from running if you open an infected attachment, but IMO it should detect a virus the second it comes in.
Also, some people say the updates are very slow. I am not 100% sure about system resources, but I don't think it is a resource hog.

AVG is very light on resources, it updates regularly and very quickly but it doesn't detect as many viruses as AntiVir or Avast.

Avast! is kind of between AVG and AntiVir at detecting viruses, but it does use more resources. I think it has 6 processes. I used it last year and found it did slow down my P4 3.2Ghz PC with 1 Gig of ram, this disappointed me and I uninstalled it.

I haven't used AntiVir yet but it does look pretty good. I currently use AVG and haven't had any problems.
 
I tried using AVG before as a constantly running anti virus but any of those that I've tried annoy me too much. Having to clear every program or game when I want them to connect online is a bit annoying. I would however use them for detecting viruses in a once off (every month or so) virus scan. From what you said Zild I'll go for AntiVir. Thanks a million :)
 
PowerDemon said:
The csrss.exe file is located in the folder C:\Windows\System32. In other cases, csrss.exe is a virus, spyware, trojan or worm!
Click to expand...

Just did a search for it. Found it in C:\Windows\ with the same icon that comes up on process explorer and it weighs in at 160kb. The icon is a black and white vertically striped one. I deleted that file. It appeared in system32 as well as 2 service pack folders which were 4kb,4k and 6kb so I think they were legit and I left them be. Thanks for the advice.

Edit: woah.. I just left the search going for a while longer.. have a look at this.. looks like it came in through an external harddrive I was using.

woah.png


I managed to get rid of all of them off the search but the E:/Recycler and G:/Recycler folders both gave access denied errors. Think I definitely need a virus scan done.
 
Last edited:
Darg said:
I tried using AVG before as a constantly running anti virus but any of those that I've tried annoy me too much. Having to clear every program or game when I want them to connect online is a bit annoying. I would however use them for detecting viruses in a once off (every month or so) virus scan. From what you said Zild I'll go for AntiVir. Thanks a million :)
Click to expand...

Are you sure it wasn't a firewall making you clear every program for online use? AV's don't ask you for permission to allow a program or game to access the internet - only firewall's do this.
Maybe before you had a package with antivirus + firewall?

Anyway, let me know how AntiVir is. I am very tempted to try it myself after looking at the recent AV test results.

Here are some:
http://www.av-comparatives.org/
Click on comparatives in the left column, then choose the newest test results.

AntiVir came 1st in the Retrospective test and 2nd in the On-demand comparative test, not bad for a free AV!
 
Last edited:
Darg said:
Just did a search for it. Found it in C:\Windows\ with the same icon that comes up on process explorer and it weighs in at 160kb. The icon is a black and white vertically striped one. I deleted that file. It appeared in system32 as well as 2 service pack folders which were 4kb,4k and 6kb so I think they were legit and I left them be. Thanks for the advice.

Edit: woah.. I just left the search going for a while longer.. have a look at this.. looks like it came in through an external harddrive I was using.

woah.png


I managed to get rid of all of them off the search but the E:/Recycler and G:/Recycler folders both gave access denied errors. Think I definitely need a virus scan done.
Click to expand...

if you've messed up your windows install as a result of blundering hamfistedness because you've not bothered to configure an AV program i'm going to laugh at you!

<edit> been wanting to use the phrase "blundering hamfistedness" for a week now!
 
Last edited:
I have it in my task manager and on System 32 aswell. Kaspersky says its not a Virus though :confused:

Also does anyone know what smss.exe is?
 
Smss.exe? - There ya go!

This is the session manager subsystem, which is responsible for starting the user session. This process is initiated by the system thread and is responsible for various activities, including launching the Winlogon and Win32 (Csrss.exe) processes and setting system variables. After it has launched these processes, it waits for either Winlogon or Csrss to end. If this happens "normally," the system shuts down; if it happens unexpectedly, Smss.exe causes the system to stop responding (hang).

Note: The smss.exe file is located in the folder C:\Windows\System32. In other cases, smss.exe is a virus, spyware, trojan or worm!


Source: http://www.neuber.com/taskmanager/process/smss.exe.html
 
Liutilities said:
Windows errors related to csrss.exe ?
csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem. This process manages most graphical commands in Windows. This program is important for the stable and secure running of your computer and should not be terminated.
Click to expand...
 
Father Ted said:
Smss.exe? - There ya go!

This is the session manager subsystem, which is responsible for starting the user session. This process is initiated by the system thread and is responsible for various activities, including launching the Winlogon and Win32 (Csrss.exe) processes and setting system variables. After it has launched these processes, it waits for either Winlogon or Csrss to end. If this happens "normally," the system shuts down; if it happens unexpectedly, Smss.exe causes the system to stop responding (hang).

Note: The smss.exe file is located in the folder C:\Windows\System32. In other cases, smss.exe is a virus, spyware, trojan or worm!


Source: http://www.neuber.com/taskmanager/process/smss.exe.html
Click to expand...

So should it be removed or deleted?:confused:
 
lol Aod. No I didn't mess it up. I only deleted the ones that werent in system32. Comp works fine and now I dont have it coming up in process explorer :)
 
You must log in or register to reply here.
Back
Top Bottom