csrss.exe - Virus?

SideWinder · 31 May 2012 at 22:06

So i think i have a virus....this is the process name. I don't recognise it and Google seems to indicate it is however all the results are from a few years ago and aren't very clear.

One suggestion is that this process is key to Windows and if this file is infected, i will need to reformat?

Any ideas on how to remove it? Spybot doesn't seem to be much help, which is odd.

quackers · 31 May 2012 at 22:17

have you tried malwarebytes or mse?

j6m · 31 May 2012 at 22:18

It's a normal Windows process.

SideWinder · 31 May 2012 at 22:18

Downloading those now.

I am aware there is a trojan that hides in this process...

Specifically...

http://support.microsoft.com/kb/555021

Diggsy · 31 May 2012 at 22:19

I think it's a perfectly legit system file, in fact I have it on my system in the Windows\System32 folder and scanning it with Kaspersky shows it as clean and a Windows System file

EDIT - you can always upload your file here to test it and be certain... https://www.virustotal.com/

Dano · 31 May 2012 at 22:20

It's a critical windows file, check it's located in system32 and only running one instance before getting antsy, why do you think it's an infection? Have you run any scans?

SideWinder · 31 May 2012 at 22:29

Basically i was downloading a music file from a server sharing website and all of the sudden the file stopped 6mb short and my laptop froze.

I saw the csrss.exe process appear on my process manager thingy and wondered what it was. I had been keeping an eye on my processes as i have been tidying everything up and so on.

Laptop froze and has now become painfully slow. Hence the thread.

Mr.Fantastic · 31 May 2012 at 22:35

I have 2 of them running according to task manager, just right click on them and click on open file location, if both it opens the directory location to windows/system32 then it's fine.

Azuse05 · 31 May 2012 at 22:59

Mr.Fantastic said:
I have 2 of them running according to task manager, just right click on them and click on open file location, if both it opens the directory location to windows/system32 then it's fine.

You'll find every bad thing pretending to be something good is sitting somewhere in the windows folder

In fact there's one that started going around this week past that is being constantly repackaged and re-released to change it's hash.

If any doubt malwarebytes// tdsskiller (http://support.kaspersky.com/faq/?qid=208283363).

SideWinder · 31 May 2012 at 23:06

I have 2 of these processes...they come up as being a SYSTEM process but when i click opem file location..nothing happens. Leaving malware on over night...will update tomorrow.

Diggsy · 31 May 2012 at 23:26

^ I have only one running, but right clicking on it doesn't take me to the file location either. I wonder is this because it is a critical system file?

If you search from the start button it should find it for you and you can right click it there and go to the location.

Orcvader · 31 May 2012 at 23:33

You only see one in the normal task manager, but if you click "Show processes from all users", you can see two of them. Also it's only after clicking this you can go to the file location. It's normal... unless it really is a virus diguised as it.

Emphacy · 1 Jun 2012 at 00:19

It's a client/server runtime process and it's perfectly genuine. You will often have more than one process running at any one time for several users - Although there may only be you (the Administrator) there are also hidden users such as default, public etc.

Although the file has the possibility to become infected it is highly unlikely if you're running an antivirus program - It would detect the file process change and alert you.

More information here...
http://en.wikipedia.org/wiki/Client/Server_Runtime_Subsystem