2 files called csrss

[Guest]

Yesterday I noticed in my windows task manager that csrss.exe was
particularly active. I found out that a second file with this name is
sometimes created by hackers to hide spyware and keyloggers. I did a search
and found two files called csrss - one in widows 32 and one in c:\i386. Each
was about 1.5 Kb. Today I searched again and only one copy of csrss was
turned up - in c:\i386 and this time the file size was 6kb. Can anyone tell
me what is going on please.

 

[shawn]

The file in c:\windows32 folder is usually legit. The other ones are
spyware, virus, trojan or whatever.

I got the information from here:

http://www.neuber.com/taskmanager/process/csrss.exe.html

I regularly run Spybot Search & Destroy latest version. Maybe you should. I
also run Hijack This. You should try their forums. They allow you to post
your Hijack This logs and they can guide you through what could be bad items
to get rid of.

 

[Jim]

Yesterday I noticed in my windows task manager that csrss.exe was
particularly active. I found out that a second file with this name is
sometimes created by hackers to hide spyware and keyloggers. I did a
search
and found two files called csrss - one in widows 32 and one in c:\i386.
Each
was about 1.5 Kb. Today I searched again and only one copy of csrss was
turned up - in c:\i386 and this time the file size was 6kb. Can anyone
tell
me what is going on please.

XP should only be running the version in windows32. The one in i386 is a
backup copy for use when the one in windows32 needs to be replaced.

Nevertheless, as you cannot find csrss in windows32, and as the file size
has changed, you need determine if there is malware on your system.

Jim