Is csrss.exe a virus?

[Jorge Cervantes]

Recently, AVG 8.0 picks "csrss.exe" up as a virus and quarantined into
virus vault.
This caused an error during booting as follow:

" Windows cannot fid c:\WINDOWS\Config\csrss.exe. Make sure your typed the
name correctly, blah, blah, "

When searched, I found two csrss.exe in my computer:

c:\WINDOWS\Config\csrss.exe (298.278; 9/11/08)
c:\WINDOWS\system32\csrss.exe (6,144; 4/12/08)

It seems that both csrss.exe are necessary for WinXP.
I wonder how I can fix this booting error.

Jorge

 

[John John (MVP)]

The one in the \WINDOWS\Config\ folder is almost certainly a virus.

John

 

[Jorge Cervantes]

I have several computers. The computer in my office has
c:\WINDOWS\Config\csrss.exe.
I thought that it might be a virus. As described in the previous message,
it was removed under safe mode.
When booted, the computer prompted " Windows cannot find
c:\WINDOWS\Config\csrss.exe. Make sure your typed theJorge

 

[John John (MVP)]

A reference to the file still exists in one of the startup locations.
Do a registry search for "\Config\csrss.exe" and report your findings
back here. Or use the built-in Msconfig tool to see if it can disable
the bogus startup entry. You can also use Autoruns by Sysinternals to
look for the startup location for the bogus file, be careful with
Autoruns, you don't want to disable the legitimate entry at
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\SubSystems

John

 

[Jorge Cervantes]

Thanks John,

When googled, there were some information how to get rid of this virus stuff
by going through registry.
I will try to fix it on Monday.
Then, I will let you know how it goes.

Thanks again.

Jorge

 

[Jorge Cervantes]

John,

By removing c:\WINDOWS\Config\csrss.exe from registry, the problem resolved.
Thank you.

Jorge

 

[John John (MVP)]

You're welcome.

John