This process has been running on my PC (I've just found it now) not sure what it is, I done a google search and it turned out it is a necessary windows system file I read, but also to contradict that I read it was a trojan?
Can anyone shine a light on this for me.
Thank you
When you open up task Manager , by right clicking on the task bar and choose Start Task Manager . On the Processes tab if you right click on the csrss and choose Properties the location should be C:\Windows\System32 .
csrss - Client Server Runtime Process
csrss.exe is the name of a critical system process but it is also the name of malware. Which it is depends on where it is found. The legitimate location will be in system32, elsewhere it is probably malware. The same applies for most, but not all, system processes. You also have to be very careful with the spelling of processes. Malware often uses names that are very similar to legitimate processes in the hopes that they will be overlooked. As an example, svchost.exe is a critical system process while scvhost.exe is malware.
MichaelMarr,
Although csrss.exe is a legitimate Windows file, there are viruses that masquerade with the same name.
For peace of mind, please upload the file for a scan at VirusTotal:
http://www.virustotal.com/
If the file is listed as already analyzed, click on: Reanalyse file
Once the file is scanned, and you see the full results page on your screen, go up to the address bar at the top of the browser, and copy the http:\\... address there.
Then, provide the http:\\ address to the results page in your reply. <<---
You can also go here https://www.sevenforums.com/tutorials/277740-online-scanners-scan-suspicious-files-your-pc.html
Select Jotti, or VirScan...or both, if you wish.
Then post the results.
If csrss.exe is anywhere other that C:\Windows\System32 it is probably some sort of malware.
Right click it in Task Manager/Go to File Location.
Thanks for the replies.
When I click properties on csrss.exe it doesn't show me anything, my PC goes really 'laggy' and I have a desktop gadget of my cpu performance and that goes crazy the graph shows really high volumes. I'm gathering this is something sinister afterall
Manged to find it in C:\Windows\System32, although when trying to upload to virustotal it disappears from the folder after I click 'Browse'. I'm really confused I can see it in the folder but not after clicking browse
Also in Task manager its the only process without a 'User' or 'Description'
MichaelMarr,
Same here! :)Also in Task manager its the only process without a 'User' or 'Description'
Click Start, and in the Search Programs and Files box, type in: cmd
In Programs (1) above, right-click the cmd icon and select: Run as Administrator
At the Command Prompt blinking cursor, paste the following info inside the quote box:
Obtain the results by going to the small commmand icon on the left of the prompt, and select:dir /s csrss.exe
Edit > Select all
Edit > Copy
Please post the results in your reply. They should be very short...
14/07/2009 02:39 7,680 csrss.exe
1 file(s) 7,680 bytes
Total files listed:
1 File(s) 7,680 bytes
0 dir(s) 168,918,683,648 bytes free
I'm guessing that says when the file was made - 2009? That is around when I first got this PC.
If this file turns out to be safe, do you think something else could be going on to cause my cpu to randomly go crazy? I defrag and do a general cleanup every few weeks so I dont see how it is being affected lol
Mine:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>dir /s csrss.exe
Volume in drive C is eMachines
Volume Serial Number is 98D2-B205
Directory of C:\Windows\system32
07/13/2009 08:39 PM 7,680 csrss.exe
1 File(s) 7,680 bytes
Total Files Listed:
1 File(s) 7,680 bytes
0 Dir(s) 434,395,111,424 bytes free
C:\Windows\system32>
Also, please download the Farbar Recovery Scan Tool
Select the version that applies to your system, 32-bit, or, 64-bit. (See Note)
Save it to your Desktop.
Please provide the FRST.txt in your reply. <<---
- Double-click the downloaded file to run it.
- When the tool opens click Yes to disclaimer.
- Press the Scan button.
- FRST64 makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).
The first time the tool is run, it also makes another log: Addition.txt
Also post the Addition.txt in your reply. <<---
Note:
You need to know if the computer is running a 32-bit or 64-bit system.
To find out, click: Start
Type System in the Start Search box
Click System in the Programs list.
The Operating System is displayed as follows under System > System type:
64-bit Operating System
32-bit Operating System
Thanks for the replies.
When I click properties on csrss.exe it doesn't show me anything, my PC goes really 'laggy' and I have a desktop gadget of my cpu performance and that goes crazy the graph shows really high volumes. I'm gathering this is something sinister afterall
Manged to find it in C:\Windows\System32, although when trying to upload to virustotal it disappears from the folder after I click 'Browse'. I'm really confused I can see it in the folder but not after clicking browse
Also in Task manager its the only process without a 'User' or 'Description'
I have this problem too. This is an old thread.
My Task Manager shows csrss.exe activity yet I cannot find it on the system.
(cmd) dir /s csrss.exe shows "file not found"
Updated thoughts appreciated.
I am using Win7
Is there any solution for this?
Quote