Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Is csrss.exe a trojan?


06 May 2013   #1

Windows 7
 
 
Is csrss.exe a trojan?

This process has been running on my PC (I've just found it now) not sure what it is, I done a google search and it turned out it is a necessary windows system file I read, but also to contradict that I read it was a trojan?

Can anyone shine a light on this for me.

Thank you

My System SpecsSystem Spec
.

06 May 2013   #2

Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
 
 

When you open up task Manager , by right clicking on the task bar and choose Start Task Manager . On the Processes tab if you right click on the csrss and choose Properties the location should be C:\Windows\System32 .

csrss - Client Server Runtime Process
My System SpecsSystem Spec
06 May 2013   #3

Windows 7 Home Premium 32 bit
 
 

csrss.exe is the name of a critical system process but it is also the name of malware. Which it is depends on where it is found. The legitimate location will be in system32, elsewhere it is probably malware. The same applies for most, but not all, system processes. You also have to be very careful with the spelling of processes. Malware often uses names that are very similar to legitimate processes in the hopes that they will be overlooked. As an example, svchost.exe is a critical system process while scvhost.exe is malware.
My System SpecsSystem Spec
.


06 May 2013   #4

Windows 7 Home Premium
 
 

MichaelMarr,

Although csrss.exe is a legitimate Windows file, there are viruses that masquerade with the same name.



For peace of mind, please upload the file for a scan at VirusTotal:
http://www.virustotal.com/



If the file is listed as already analyzed, click on: Reanalyse file



Once the file is scanned, and you see the full results page on your screen, go up to the address bar at the top of the browser, and copy the http:\\... address there.


Then, provide the http:\\ address to the results page in your reply. <<---

You can also go here http://www.sevenforums.com/tutorials/277740-online-scanners-scan-suspicious-files-your-pc.html
Select Jotti, or VirScan...or both, if you wish.
Then post the results.
My System SpecsSystem Spec
06 May 2013   #5
Microsoft MVP

Windows 7 Ultimate X64 SP1
 
 

If csrss.exe is anywhere other that C:\Windows\System32 it is probably some sort of malware.
Right click it in Task Manager/Go to File Location.
My System SpecsSystem Spec
07 May 2013   #6

Windows 7
 
 

Thanks for the replies.

When I click properties on csrss.exe it doesn't show me anything, my PC goes really 'laggy' and I have a desktop gadget of my cpu performance and that goes crazy the graph shows really high volumes. I'm gathering this is something sinister afterall

Manged to find it in C:\Windows\System32, although when trying to upload to virustotal it disappears from the folder after I click 'Browse'. I'm really confused I can see it in the folder but not after clicking browse

Also in Task manager its the only process without a 'User' or 'Description'
My System SpecsSystem Spec
07 May 2013   #7

Windows 7 Home Premium
 
 

MichaelMarr,

Quote:
Also in Task manager its the only process without a 'User' or 'Description'
Same here!


Click Start, and in the Search Programs and Files box, type in: cmd

In Programs (1) above, right-click the cmd icon and select: Run as Administrator

At the Command Prompt blinking cursor, paste the following info inside the quote box:

Quote:
dir /s csrss.exe
Obtain the results by going to the small commmand icon on the left of the prompt, and select:
Edit > Select all
Edit > Copy

Please post the results in your reply. They should be very short...
My System SpecsSystem Spec
07 May 2013   #8

Windows 7
 
 

14/07/2009 02:39 7,680 csrss.exe
1 file(s) 7,680 bytes

Total files listed:
1 File(s) 7,680 bytes
0 dir(s) 168,918,683,648 bytes free

I'm guessing that says when the file was made - 2009? That is around when I first got this PC.

If this file turns out to be safe, do you think something else could be going on to cause my cpu to randomly go crazy? I defrag and do a general cleanup every few weeks so I dont see how it is being affected lol
My System SpecsSystem Spec
07 May 2013   #9

Windows 7 Home Premium
 
 

Mine:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>dir /s csrss.exe
Volume in drive C is eMachines
Volume Serial Number is 98D2-B205
Directory of C:\Windows\system32
07/13/2009 08:39 PM 7,680 csrss.exe
1 File(s) 7,680 bytes
Total Files Listed:
1 File(s) 7,680 bytes
0 Dir(s) 434,395,111,424 bytes free
C:\Windows\system32>


Also, please download the Farbar Recovery Scan Tool
Select the version that applies to your system, 32-bit, or, 64-bit. (See Note)



Save it to your Desktop.
  • Double-click the downloaded file to run it.
  • When the tool opens click Yes to disclaimer.
  • Press the Scan button.
  • FRST64 makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).
Please provide the FRST.txt in your reply. <<---

The first time the tool is run, it also makes another log: Addition.txt
Also post the Addition.txt in your reply. <<---

Note:
You need to know if the computer is running a 32-bit or 64-bit system.
To find out, click: Start
Type System in the Start Search box
Click System in the Programs list.

The Operating System is displayed as follows under System > System type:
64-bit Operating System
32-bit Operating System
My System SpecsSystem Spec
Reply

 Is csrss.exe a trojan?




Thread Tools



Similar help and support threads for2: Is csrss.exe a trojan?
Thread Forum
Two csrss.exe processes System Security
Csrss.exe BSOD Help and Support
double csrss.exe please help :'( General Discussion
csrss and winlogon System Security
Csrss.exe? System Security
CSRSS Installation & Setup

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 05:13 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33