I see that you understand that an infected file can have the same name as a legitimate MS file. It is unclear to me how looking up the file's name on a website can assure a user that the file on their computer is not infected. I would suggest using the free tool named Process Explorer that I mention in this post earlier in this thread. There is nothing to install, just download and run the tool.
Hi! this question has always been bouncing back and forth.IMHO, from experience when csrss.exe is acting up (being used by Windows Update to update the Windows 7 and any malware already downloaded and running on your system). Masqueraded csrss.exe can be a real problem.
Main problem:csrss.exe taking up a lot of RAM during surfing of the WWW.
If your system is clean and the RAM memory is small (ie your system has only 2GB RAM or less ).Windows Update scheduled to update the Windows 7 using csrss.exe as the command will jammed up or slowed your system to halt just to download all the updates.
If you are browsing the WWW everything is slow.Add more RAM to speed up. Once the updating is over, the speed is up again.
Try and see if stopping updates will help.
Look out for multiples csrss.exe running as some are malware in disguise.
TQ
I have this same problem. I right click it, click properties, and nothing happens. Please help!
Hi Sparky and Chip welcome to 7F! :)
Have either of you perused the previous 70 some posts in this thread, especially the first 15? It does sound like both of you have some degree of malware infection.
The basics are:
- Use malware scans like mbam, sas, adwcleaner, and any or all online malware scanners, to make sure without a doubt that your machines are clean.
- csrss.exe is a hidden, protected file; To show protected operating system files:
Hidden Files and Folders - Show or Hide
- Then do a start menu search for csrss.exe, if you find it anywhere other than in the C:\Windows\System32 Folder you will then need further help with better tools to eradicate the offending file.
Oh, and Chip; The appuals.com site has some good points, like scanning for malware and farbar is a legitimate tool but have you searched for reviews on Reimage Plus Software? It's up to you if you really want to try reimage, and trying the new user account is a last resort if malware scans don't help.
Last edited by Anak; 02 Sep 2016 at 04:56.
What will happen if if end the proses and it is the legit process, because when I went to select "Open file location", nothing happened.
Hi Samuelogan987, welcome to 7F! :)
A couple of things:
- Did you un-hide system files and folders? That may have caused what you saw.
- And do a search for csrss.exe if it shows up anywhere, but, the system32, syswow, winsxs, folders, then you have a problem. This is not to say you have a problem, but check there first.
- Did you read any of the previous postings like my #74?
I followed your instruction and here's the result:
"Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\Asus>dir /s csrss.exe
Volume in drive C is OS
Volume Serial Number is 24AF-7AFF
File Not Found
C:\Users\Asus>"
Does it mean malware because it connot be found in C:Windows\Systems32?
I found in the other website that it is normal when you check the Show processes from all users and find the file (csrss) you can find its user name and description and can click Properties or Open File Location and there it is located in C:\Windows\System32
But what about winlogon.exe? Are their conditions the same? Thanks!
Quote