[Help] csrss.exe

[Finest]

I have an old computer, it's a 2005 Dell Dimension 5100 w/ an i3 processor. So naturally I try to close out as many programs using any CPU that would cause my game (RuneScape) to lag. In this case, I noticed csrss.exe. I did a quick Google search (which actually led me to these forums) & it can potentially be a trojan or just the actual Windows program. Now, when I try to right-click it and 'open file location' it does nothing. I ended the process & my screen went blue with some errors, then rebooted. I would imagine that's either a good thing, implying it was in fact the Windows program, or it could be bad not letting me end the program as the virus intended. I also saw 2 of them listed when I do 'Perform Administrative Tasks'.

 

[Layback Bear]

Please read this thread. It should be helpful.

http://www.sevenforums.com/system-security/289062-csrss-exe-trojan.html

 

[Tookeri]

Here's a tip if you want to check all running processes with more than 50 antivirus products:
http://www.sevenforums.com/tutorial...r-virustotal-check-all-processes-50-av-s.html
One thing not mentioned in the Tutorial: Go to menu Options and select "Verify Image Signatures". That's nice to have too.

 

[Finest]

Please read this thread. It should be helpful.

http://www.sevenforums.com/system-security/289062-csrss-exe-trojan.html

I did dir /csrss.exe on both my laptop (what I'm using now) & my desktop.

They both say the exact same thing.

Directory of C:\Windows\system32

01/20/2008 10:24 PM 6,144 csrss.exe
1 File(s) 6,144 bytes

Total Files Listed:
1 File(s) 6,144 bytes
0 Dir(s) 181,839,425,536 bytes free

C:\Windows\system32>

 

[Layback Bear]

If Norton says your clean. I would run other scans to be sure if you are still worried.
Malwarebytes and Eset online scan work well.

 

[LMiller7]

csrss.exe is one of the most critical processes in the system. The system cannot function without it. But almost any process by any name could also be potentially malicious. Many Internet sources emphasize this while scarcely mentioning that they are also critical system processes. Which they are depends on where they are located. You need to add the "command line" column to Task manager to see this. Most system processes are in the system32 folder.

In Vista and later there will normally be 2 instances of csrss.exe running, more if there are other users logged in with fast user switching. If no one is logged in there will only be one instance, but of course in that case you would not be able to see it.

The big problem with malicious software isn't in what you see, but what you don't. Modern malware is VERY good at hiding itself.

 

[Layback Bear]

If you security scan come up clean just leave csrss.exe alone.

Here is more information if you so desire to read a lot.

Is csrss.exe safe? How to remove a csrss error?