I kkep gettin this virus (C:\WINDOWS\csrss.exe).?

Question

What does it do and why do i have it, and why does it come back day after day, its not in the system32 so i believe its a trojan backdoor, but if theres any one that might have a solution, i will be on my way. I do have McAfee antivirus and firewall, plus i have ad-aware and yahoo anti-virus, and it still comes back, lol, i dunno.

Answer 1

I would check Symantec.com for a removal tool.

Answer 2

2

Answer 3

csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem. This process manages most graphical commands in Windows. This program is important for the stable and secure running of your computer and should not be terminated.

Note: csrss.exe is a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.

Determining whether csrss.exe is a virus or a legitimate Windows process depends on the directory location it executes or runs from in WinTasks.

Answer 4

Search that by yahoo or google it! That maybe an old worm if my memory serves me right. Some anti virus don't catch the older trojan now a days.And yes you are correct on that. GRRRRRRRRRRrrrrrr If it is just do a system restore while in safe mode! good luck. And in my oppion MaAfee is junk{sorry}

Answer 5

Hi there,

Here's some detailed information on the BAD file CSRSS.EXE:
http://spywarefiles.prevx.com/RRHDCD526/csrss%252Eexe.html

The best and easiest way to remove this is by installing the Free Trial of Prevx1. This will scan your PC and remove this and any other infections free of charge.

Answer 6

C:\WINDOWS\csrss.exe <-- is an RBot/SDBot/IRCBot, run this tool below:(Only if your OS is 2000/XP)

Download SDFix and save it to your desktop.
http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
Please then reboot your computer in "Safe Mode" by doing the following:
[*]Restart your computer
[*]After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
[*]Instead of Windows loading as normal, a menu with options should appear;
[*]Select the first option, to run Windows in Safe Mode, then press "Enter".
[*]Choose your usual account.
[*] In Safe Mode, right click the SDFix.zip folder and choose "Extract All",
[*] Open the extracted folder and double click "RunThis.bat" to start the script.
[*] Type "Y" to begin the script.
[*] It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
[*] Press any Key and it will restart the PC.
[*] Your system will take longer that normal to restart as the fixtool will be running and removing files.
[*] When the desktop loads the Fixtool will complete the removal and display "Finished", then press any key to end the script and load your desktop icons.

SDFix creates a backup folder(where the bad file is backed up) that needs to be deleted also afterwards.

Answer 7

i think you better install a new windows for your computer i had this virus before i think it's his name is Brontok or something..

it will be soo hard for you to understand how to remove it coz it will be alot of steps you might won't understand it very well..

in another way I don't like McAfee Antivirus. Norton is much much better trust me..

Answer 8

No anti virus is going to find this virus. You have to find it yourself. Got to start and run and type in Regedit. It will open up. Next type in the or better copy and paste the virus name in. It will locate the file. You can manually delete it. But make sure your Internet is turned off. When you have finish you have to re-bot your PC in safe mode. F8 when it open up you close it again and start up. Hopefully it gone.

Answer 9

Ok Instead of a free scan or anything like that go to this link at the bottom and just remove that trojan.I thinks you'll just need a quick download.

Answer 10

The Svchost.exe record is placed interior the %SystemRootp.c.System32 folder. At startup, Svchost.exe exams the centers area of the registry to construct a catalogue of centers that it is going to load. dissimilar cases of Svchost.exe can run on an identical time. each Svchost.exe consultation can incorporate a grouping of centers. hence, separate centers can run, reckoning on how and the place Svchost.exe is began. This grouping of centers facilitates greater beneficial administration and much less annoying debugging.

Answer 11

It's not anything serious. It's just one stage higher than a PUP which should be blocked. You'll get it on most sites