csrss.exe help --Trojan?

Sanius

Hey, i'm trying to open up regedit from start command, but when I do, a program called "csrss.exe" pops up in task manager, and a second later regedit closes.

I did a lookup and it seems that csrss.exe is a virus, but is also a vital windows process. Anyone know what to do? Is csrss.exe closing this, or is it some other program and csrss.exe is just popping up for no real reason?

Grimm

From the quick google search i just did, it seems you want to leave it alone.
The search results that mention it being a virus, only talk about some other program trying to disguise itself as csrss.exe.

Heir

Maybe boot up into safemode and scanning everything from there? Sometimes that helps to eliminate worms and other malware that normally wouldn't be removed.

vonPoonBurGer

csrss.exe is a core part of Windows. I've seen it in every process list for every system I've ever looked at. If you see two instances of csrss.exe in your processes list, you probably have a virus. If you have a copy of csrss.exe anywhere other than C:\Windows\system32 or are service pack download, extraction or installation backup folder, you probably have a virus. Otherwise, you're probably fine.

iTunesIsEvil

Just like everyone else said, csrss.exe is a safe file 99% of the time. It should be running from C:\WINDOWS\System32\.

If you wanna read more about it check it out here.

Sanius

Yeah, but csrss.exe pops up in CPU usage when I start regedit, and closes it. When i'm in safemode, regedit will not close, and csrss does not appear.

But why is regedit closing?

vonPoonBurGer

Sanius wrote:

Yeah, but csrss.exe pops up in CPU usage when I start regedit

CSRSS manages most of the graphical presentation elements in Windows. It probably spikes in CPU usage when you start regedit because it has to draw the application window on the screen. As for why regedit is closing immediately afterwards, I'm inclined to think that doesn't have anything to do with csrss.exe per se. It sounds like a browser hijack or rootkit type move, though, so keep digging. If none of your running processes look suspicious, bear in mind that lots of viruses and malware like to hide behind svchost.exe.

Sanius

Chances are I just have to reformat instead, which i'll do later, since I have not in a year and a half. Lots of weird performance issues, crashes while installing games, not even able to run regedit.

Thanks anyway. I scanned svchost and got nothing, but I don't feel like searching any further.