Csrss.exe says "...you can go offline now" <-- what??

[BrownChiLD]

Hi Guys

here's something weird

i got a dialogue box w/ title "Click To Run"
and it prompted me:
"Updates have been successfully applied, you can go offline now."

and i was like wtf? lolz who says i wanted to go offline?

I wasn't doin anything on my laptop when this happened, apart from just installing ProShow Producer software w/c i've done numerous times already before..

using systemexplorer(tm) i was able to see the process that owns this weird window and it's the csrss.exe ... i did checks on this and that csrss.exe seems legit...

so why does a LEGIT windows file csrss.exe prompt me this message out of nowhere, and even suggesting that i can go offline already.. got me scratching my head...

here's a screen shot.. legit csrss.exe file, verified via virusTotal.com

Droplr • Screenshot on 11.4.2012 at 1.45.45 PM.png


any ideas?


Tj

 

[Golden]

Hi,

Lets check something:

1. Click Start

2. In the search box, type cmd
3. In the list that appears, right-click on cmd.exe and choose Run as administrator
4. In the command window that opens, type sfc /scannow and hit enter.

Report the output once it finishes.

Regards,
Golden

 

[Sir George]

Hi Guys

here's something weird

i got a dialogue box w/ title "Click To Run"
and it prompted me:
"Updates have been successfully applied, you can go offline now."

and i was like wtf? lolz who says i wanted to go offline?

I wasn't doin anything on my laptop when this happened, apart from just installing ProShow Producer software w/c i've done numerous times already before..

using systemexplorer(tm) i was able to see the process that owns this weird window and it's the csrss.exe ... i did checks on this and that csrss.exe seems legit...

so why does a LEGIT windows file csrss.exe prompt me this message out of nowhere, and even suggesting that i can go offline already.. got me scratching my head...

here's a screen shot.. legit csrss.exe file, verified via virusTotal.com

Droplr • Screenshot on 11.4.2012 at 1.45.45 PM.png


any ideas?


Tj

Have you run a virus scan? Even if you have, you could run an on line scan as an additional precaution, sort of like using both a belt and suspenders. Eset would be my choice;

Free Online Virus Scanner | ESET

HTH

 

[BrownChiLD]

Hi Golden and George,

well i ran the file through virustotal, w/ MD5 verification and all that and virustotal verified that this csrss file is untouched/original.. so although it's redundant i did do a full sfc scan on my system, and it passed w/ flying colors..

I also ran full system virus scan (comodo) and nothing flagged .. all clean..

.. so im baffled as to where the hell this prompt came from lolz

 

[Sir George]

Hi Golden and George,

well i ran the file through virustotal, w/ MD5 verification and all that and virustotal verified that this csrss file is untouched/original.. so although it's redundant i did do a full sfc scan on my system, and it passed w/ flying colors..

I also ran full system virus scan (comodo) and nothing flagged .. all clean..

.. so im baffled as to where the hell this prompt came from lolz

Good news then, it appears the file is legit.

I haven't used the automatic update in Windows 7 for quite awhile, but as I dig back into those memory cells, I seem to recall that a message with the wording "Updates have been successfully applied" would display. I don't recall if the "you can go offline now" part was there or not. So, it could be just a standard Windows update that was ocurring.

HTH

 

[BrownChiLD]

Hi Guys


well i redid my system from scratch anyway, and that's how paranoid i am lolz

i did discover something.. that same Click to Run blank-ish window appeared again this time it's for a Microsoft Office update ..

 

[logicearth]

It wasn't csrss.exe, it was what ever conhost.exe was running. conhost.exe is the command prompt.