Is csrss.exe a trojan?

[thesainted]

https://www.virustotal.com/en/file/...cb42197216e8265578713786/analysis/1417817410/

thank you for this thread my PC recently has been taking forever to log off and shut down so while troubleshooting I found this file and was leery

thanks to the site you recommend I didn't delete and give myself more problems.

I will be creating a thread addressing my own problem but I wanted to thank all who helped.

http://www.sevenforums.com/general-...ng-forever-shut-down-log-off.html#post2952608

 

[cottonball]

This is one old thread! What are we doing here?

DonnaB mentioned csrss.exe is a Protected Operating System File, and that is correct.

To Show Protected Operating System Files:
http://www.sevenforums.com/tutorials/394-hidden-files-folders-show-hide.html

If you wish to view the csrss.exe file using the Command Prompt (CP), right-click the CP, and select: Run as Administrator

Then use:
dir /s csrss.exe

 

[mrick36]

Those of us who aren't quite as knowledgeable about these things, and are new to this forum, do not know which of the responses to our requests for help can be trusted. If you read back on this thread, you will see that there are posts that indicate that the "csrss.exe" that we find in our task manager may not be the Protected Operating System File that DonnaB mentioned. In order for us, the less knowledgeable, to find out which it is, we must inquire. NOW, if we inquire about this malicious file in an old thread, that might be because we have been CHEWED OUT by rude members of forums for repeating the same question that is addressed in an existing thread. It seems that the same problem occurs when we try to avoid that problem here. It would be nice to have some experts help the less knowledgeable without thumbing their noses at us. RULE #1--- Rudeness, insults, racial/hate slander, flaming, attacks, stalking, and trolling will not be tolerated. So far, I have found that this rule is ignore by some on here.

Cottonball, I am not saying that your response here was rude. What I am saying is that without the idea in you mind that this thread should no longer be used, you cannot come up with the question "What are we doing here?" It just all goes back to being patient with those of us that aren't sure what is going on. And yes, I do have a difficult time putting my thoughts down without seeming rude or judgmental to others. That is another issue that I don't fully understand.

 

[mrick36]

When I right click on csrss in task manager and click on "Open File Location", absolutely nothing happens. This is a suggestion in #5 in this thread. This type of non-result is part of the reason that we, the less knowledgeable, remain in the dark on such issues. The Norton issue I had resulted in not being able to do what you request earlier in this thread. We are looking for answers and sometimes even your honest polite help results in nothing. Thus, we will continue to search for the answers, and sometimes that takes us back to old posts, like this one. And now that I responded to Anak's rudeness and impatience with me, I am getting ZERO responses to these issues. So, where is one to go to find reliable help on our computer problems? I suggest some patience to those who think they are above the rest of us. And to those of you who put up with their impatience and rudeness, I suggest you let them know that they hurting your forum by acting that way. I have found some that truly are here in kindness, but I can't say that about all of you!

BTW, Thank you DonnaB for your help!

 

[DonnaB]

Hi mrick36,

I am going to ask you to go HERE and start your own thread by clicking on the orange New Thread button in the upper left hand corner. Give your thread a title and post the problem you are having.

This way we can isolate your problems into it's own thread since, even though this concerns the csrss.exe file your issue may not be the same as the guys who started this thread.

I'll be watching for your thread to be posted.

Thank you,
Donna

 

[tsahim3]

Thanks for the replies.

When I click properties on csrss.exe it doesn't show me anything, my PC goes really 'laggy' and I have a desktop gadget of my cpu performance and that goes crazy the graph shows really high volumes. I'm gathering this is something sinister afterall

Manged to find it in C:\Windows\System32, although when trying to upload to virustotal it disappears from the folder after I click 'Browse'. I'm really confused I can see it in the folder but not after clicking browse

Also in Task manager its the only process without a 'User' or 'Description'

I have this problem too. This is an old thread.
My Task Manager shows csrss.exe activity yet I cannot find it on the system.
(cmd) dir /s csrss.exe shows "file not found"


Updated thoughts appreciated.
I am using Win7

Is there any solution for this?

I have the exact same problem.
This is the response I got when I typed in dir /s csrss.exe in cmd

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\*****>dir /s csrss.exe
Volume in drive C has no label.
Volume Serial Number is 90DF-0529
File Not Found

C:\Users\*****>

 

[Anak]

Go back and re-read post #22 very carefully.

You need to either:

• Unhide protected system Folders and Files: http://www.sevenforums.com/tutorials/56005-file-folder-hide-unhide.html

Or

• Use an elevated cmd prompt then type in dir /s csrss.exe

There is a third way, type csrss.exe into the Start/Search box it should be listed at the top under Programs, right click on it and then click on open file location.

csrss.exe is a valid component of the operating system and as such resides in C:\Windows\System32 If it is found anywhere other than C:\Windows\System32 then you might, have a problem.


Related Links:

A system file is in use when the OS is up and running and to remove or open it while it's in use would crash the system. Oh, you could open it, but you would have to jump through hoops resetting the permissions to do it.

There are other system files that need to be looked at, most notably is the .cbs file when checking for update errors, but if you try to open it you will see an Access Denied popup, what you have to do then is copy it to your desktop, open and read it there or send it to Virustotal.

You can make a copy of any system file and send that to virustotal.

As long as you only found one instance of csrss and it is located in C:\Windows\System32\csrss.exe you have nothing to worry about.

If your machine is slow there are two other reasons it is that way, 1.) Malware, you need to do scans of a third-party tool like mbam or SAS; 2.) You have a corrupt profile.

https://social.technet.microsoft.co...6c-dc438af72d31/csrssexe?forum=w7itprogeneral

What is the Windows csrss.exe file / process?

 

[stealthsub2win7]

Task Manager - Show processes from all users

Hi mrick36,

Welcome to Windows Seven Forums!

I am finding csrss.exe in the task manager with no User Name or Description listed.

That is normal. That same file is located in my Task Manager as well, without information for User Name nor Description.

What issues are you experiencing that you feel the need to download and install FRST?

You can learn more about csrss.exe in the link below:

What is the Client/Server Run-time Subsystem?

I also saw the same "... no User Name or Description listed" for csrss.exe.
At the bottom of the Task Manager Processes tab click on "Show processes from all users".
NOW csrss.exe shows "SYSTEM" as a user and "Client Server Runtime Process" shows in the Description field, and a right click on Properties shows the location in "C:\Windows\System32".

 

[Anak]

Hi stealthsub2win7, welcome to 7F!

Have you performed a through search for csrss as noted in my post above yours and post #22?

csrss.exe is a valid component of the operating system and as such resides in C:\Windows\System32 If it is found anywhere other than C:\Windows\System32 then you might, have a problem.

If you find csrss only in C:\Windows\System32 you are okay.

 

[stealthsub2win7]

Hi stealthsub2win7, welcome to 7F!

Have you performed a through search for csrss as noted in my post above yours and post #22?

csrss.exe is a valid component of the operating system and as such resides in C:\Windows\System32 If it is found anywhere other than C:\Windows\System32 then you might, have a problem.

If you find csrss only in C:\Windows\System32 you are okay.

Anak,
Yes, I have done multiple searches for csrss.exe (see attachments). I also find this file in
C:\Windows\winsxs\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3 (attachments 1 & 3)
but the file dates are EXACTLY the same as the System32 location (attachment 1).

So, based on attachment 1, I conclude my system is clean.
- Barry

 

[Anak]

I concur.

You're good, I have the exact same file in mine;

C:\Windows\winsxs\amd64_microsoft-windows csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3

 

[Snostar]

hi new to the forum, was wondering if having 2 of the csrss.exe was normal?? I've looked at the where they were and they both say c:\windows\system 32. they both say the user is the system so just wondering. anyone might know? thanks

 

[RoasterMen]

Having multiple instances of csrss.exe in the task manager is normal. There should be one instance of csrss.exe for system processes and another instance for interactive logons. If you have multiple users logged in, you can have even more instances of crss.exe in the Task Manager.

The "one csrss.exe only" rule applies to XP and earlier.

csrss.exe (Client/Server Runtime Subsystem) is legitimate windows file; and yes it is located in c:\windows\system32; however; if you try to run the original file csrss.exe (in win7 x64) file on a dos prompt it wont run telling you it can not run in win32 mode.

My csrss.exe is only taking 944 K of memory in Task Manager.

 

[LMiller7]

Starting with Vista there will be one instance of csrss.exe for the system session plus one for each logged on user. This was done to enhance security. It is also normal to have multiple instances of svchost.exe. I currently have 12 but it can be more or less. There may also be multiple instances of other processes.

The memory usage of processes can vary greatly. The 944 K quoted by RoasterMen is only an example. It can be much higher or lower and be completely normal.

 

[Rynnec]

Hello. Bumping this topic because I noticed the crss.exe process while troubleshooting issues in Google Chrome. Is it normal for it to not list a user-name or description in the task manager? I tried opening the file location and clicking on properties, but nothing pops up (as in, it doesn't even open up explorer), yet when I try to do the same for other processes, it works just fine. I opened up the System32 file and found the crss there, but I just want to know if I have anything to worry about.

 

[Anak]

Hi Rynnec, welcome to 7F!

Unless you find crss.exe anywhere other than C:\Windows\System32; Then no, you have nothing to worry about.

crss.exe is a system core file, as such it has special privileges. See the button below the list of processes that says "show processes from all users" ? Click on that and you should see the blank user area fill in with SYSTEM and all the other blank areas should fill in to.

 

[DWN13]

My listing in Task Manager also has blanks under User Name and Description.

If I do a search through Windows Exploxer it shows two copies of csrss.exe in System32 and amd64, but it also shows 4 versions of csrss.exe.mui two in the same locations as the csrss.exe file, but the other two in x86_microsoft-windows-csrss.resources and C:\Wndows/WOW64

If I do dir /s csrss.exe in CMD it finds just one file in windows\system32

 

[Anak]

Hi DWN13, welcome to 7F!

My listing in Task Manager also has blanks under User Name and Description.

Did you

"show processes from all users" ?

as in my last post to reveal those users?

If I do a search through Windows Exploxer it shows two copies of csrss.exe in System32 and amd64, but it also shows 4 versions of csrss.exe.mui two in the same locations as the csrss.exe file, but the other two in x86_microsoft-windows-csrss.resources and C:\Wndows/WOW64

If I do dir /s csrss.exe in CMD it finds just one file in windows\system32

All these locations sounds suspicious, when was the last time you ran any malware scans, and what are you using to do those scans? I ask because your system specs don't list any anti-virus/malware programs.

You can try any or all of these, use their free versions:
Hitmanpro: Unlimited thirty day free trial.
Malwarebytes; Watch for the check-mark during the install to try the pro version, it's up to you if you want to try it or not.
Superantispyware;

 

[Snostar]

Having multiple instances of csrss.exe in the task manager is normal. There should be one instance of csrss.exe for system processes and another instance for interactive logons. If you have multiple users logged in, you can have even more instances of crss.exe in the Task Manager.

The "one csrss.exe only" rule applies to XP and earlier.

csrss.exe (Client/Server Runtime Subsystem) is legitimate windows file; and yes it is located in c:\windows\system32; however; if you try to run the original file csrss.exe (in win7 x64) file on a dos prompt it wont run telling you it can not run in win32 mode.

My csrss.exe is only taking 944 K of memory in Task Manager.

thank u for the help, mine is higher but long as its normal im ok with it, thanks again

 

[kacperrools]

When i try to do properties it does not do any thing ... please help . is it a virus ?