Is csrss.exe a trojan?

Hi Emerogork,

Go to C:\Windows\System32\csrss.exe, right click and choose copy.

Next, go to your desktop, right click and choose paste.

Now, go to VirusTotal and click on the Choose File button and navigate to the file on the desktop to upload.

Post the link when scan has completed.

I believe the reason that the file can not be found when searching within the system32 folder from VirusTotal is because it is a protected system file. I'd love to hear what others have to say about my thoughts on this concept.

I believe the reason that the file can not be found when searching within the system32 folder from VirusTotal is because it is a protected system file. I'd love to hear what others have to say about my thoughts on this concept.

I would say you are correct in your assumption. I looked through virustotal's faqs and documentation, but couldn't find anything on the subject.

A system file is in use when the OS is up and running and to remove or open it while it's in use would crash the system. Oh, you could open it, but you would have to jump through hoops resetting the permissions to do it.

There are other system files that need to be looked at, most notably is the .cbs file when checking for update errors, but if you try to open it you will see an Access Denied popup, what you have to do then is copy it to your desktop, open and read it there.
You can make a copy of any system file and send that to virustotal.

I just happened to come across your concept by accident, if you would really want to know what the other members think you should post it as a separate thread here in the System Security Forum, it would garner more attention that way. :)


Emerogork, as long as you only found one instance of csrss and it is located in C:\Windows\System32\csrss.exe you have nothing to worry about.

If your machine is slow there are two other reasons its that way, 1.) Malware, you need to do scans of a third-party tool like mbam or SAS; 2.) You have a corrupt profile.

And please, you need to create your own thread, it is impolite to hijack another thread, and for the same reason I told Donna, you will get more visibility and responses if you have a separate thread.

Hi mrick36,

Welcome to Windows Seven Forums! :)

I am finding csrss.exe in the task manager with no User Name or Description listed.

That is normal. That same file is located in my Task Manager as well, without information for User Name nor Description.

What issues are you experiencing that you feel the need to download and install FRST?

You can learn more about csrss.exe in the link below:

What is the Client/Server Run-time Subsystem?

That's too funny! I guess that since your heart can't take the ADD meds you fit right in with the best of us.

I found your thread here and will follow it.

You can go ahead and follow the instructions in post #11 and upload the file to VirusTotal as I had instructed to make sure it is found to be the original file. You doing so will not interfere with oscer1's instructions. If you do follow the instructions to upload the file, please post the link to the results so I can see.

It is best to focus on one thread at a time to prevent confusion or conflicts. So do no more than what I ask in this post.

Donna :)

Looks like the file is the legit file. :) Make sure to delete the copy of the file from your desktop.