csrss.exe

[JT]

We receive the following error

c:\windows\config\csrss.exe

Have run various antivirus and regcure and from what we can find it is
related to virus because of where windows is searching.

How do we rid ourselves of this problem?

Help greatly appreciated.

JT

 

[Twayne]

We receive the following error

c:\windows\config\csrss.exe

Have run various antivirus and regcure and from what we can find it is
related to virus because of where windows is searching.

How do we rid ourselves of this problem?

Help greatly appreciated.

JT

Client Server Runtime Process
csrss.exe

Company: Microsoft Corporation
Copyright: © Microsoft Corporation. All rights reserved.
Version: 5.1.2600.2180
Path: csrss.exe
Created
09/03/2002 9:00 AM First Detected
File Size
6,144



Client/Server Run-time Services - CSRSS.EXE

Csrss.exe is a service that installs as part of your Windows
opearting system. It's a critical part of the Win32 subsystem and is
responsible for console windows, creating and/or deleting threads and
some parts of the 16-bit virtual MS-DOS environment.

A description of services that run under svchost in Windows XP can
be found at
http://support.microsoft.com/default.aspx?scid=kb;en-us;314056.

A description of default services running under Winodws can be
found at
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q250320.

Some computer viruses can infect or overwrite this file. These
include W32.Netsky.AB@mm worm, the W32.Webus Trojan, and the
Win32.Ladex.a worm. If you think you have a virus, we'd recommend a full
system scan with an up to date antivirus program.


a.. Service

Microsoft

 

[David H. Lipman]

From: "JT" <[email protected]>

| We receive the following error
|
| c:\windows\config\csrss.exe
|
| Have run various antivirus and regcure and from what we can find it is
| related to virus because of where windows is searching.
|
| How do we rid ourselves of this problem?
|
| Help greatly appreciated.
|
| JT
|

CSRSS.EXE does NOT load from %windir%\config rather; %windir%\system32
Therefore this is suspicious.

You posted "We receive the following error" but you posted NO error. You posted a FQN to a
file.


Please submit a sample to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission will then be tested against many different AV vendor's scanners.
That will give you an idea what it is and who recognizes it. In addition Virus
Total will provide the sample to all participating vendors.

You can also submit a suspect, one at a time, via the following email URL...
mailto:[email protected]?subject=SCAN

When you get the report, please post back the exact results.

 

[Twayne]

CSRSS.EXE does NOT load from %windir%\config rather;
%windir%\system32
Therefore this is suspicious.

You posted "We receive the following error" but you posted NO error.
You posted a FQN to a file.


Please submit a sample to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission will then be tested against many different AV vendor's
scanners.
That will give you an idea what it is and who recognizes it. In
addition Virus
Total will provide the sample to all participating vendors.

You can also submit a suspect, one at a time, via the following email
URL... mailto:[email protected]?subject=SCAN

When you get the report, please post back the exact results.

Good point; I didn't catch the path he posted. That would point to a
virus/worm/whatever.