As was foretold, we've added advertisements to the forums! If you have questions, or if you encounter any bugs, please visit this thread: https://forums.penny-arcade.com/discussion/240191/forum-advertisement-faq-and-reports-thread/
Options

csrss.exe help --Trojan?

SaniusSanius Registered User regular
edited January 2007 in Help / Advice Forum
Hey, i'm trying to open up regedit from start command, but when I do, a program called "csrss.exe" pops up in task manager, and a second later regedit closes.

I did a lookup and it seems that csrss.exe is a virus, but is also a vital windows process. Anyone know what to do? Is csrss.exe closing this, or is it some other program and csrss.exe is just popping up for no real reason?

Sanius on

Posts

  • Options
    GrimmGrimm Registered User regular
    edited January 2007
    From the quick google search i just did, it seems you want to leave it alone.
    The search results that mention it being a virus, only talk about some other program trying to disguise itself as csrss.exe.

    Grimm on
  • Options
    HeirHeir Ausitn, TXRegistered User regular
    edited January 2007
    Maybe boot up into safemode and scanning everything from there? Sometimes that helps to eliminate worms and other malware that normally wouldn't be removed.

    Heir on
    camo_sig2.png
  • Options
    vonPoonBurGervonPoonBurGer Registered User regular
    edited January 2007
    csrss.exe is a core part of Windows. I've seen it in every process list for every system I've ever looked at. If you see two instances of csrss.exe in your processes list, you probably have a virus. If you have a copy of csrss.exe anywhere other than C:\Windows\system32 or are service pack download, extraction or installation backup folder, you probably have a virus. Otherwise, you're probably fine.

    vonPoonBurGer on
    Xbox Live:vonPoon | PSN: vonPoon | Steam: vonPoonBurGer
  • Options
    iTunesIsEviliTunesIsEvil Cornfield? Cornfield.Registered User regular
    edited January 2007
    Just like everyone else said, csrss.exe is a safe file 99% of the time. It should be running from C:\WINDOWS\System32\.

    If you wanna read more about it check it out here.

    iTunesIsEvil on
  • Options
    SaniusSanius Registered User regular
    edited January 2007
    Yeah, but csrss.exe pops up in CPU usage when I start regedit, and closes it. When i'm in safemode, regedit will not close, and csrss does not appear.

    But why is regedit closing?

    Sanius on
  • Options
    vonPoonBurGervonPoonBurGer Registered User regular
    edited January 2007
    Sanius wrote:
    Yeah, but csrss.exe pops up in CPU usage when I start regedit
    CSRSS manages most of the graphical presentation elements in Windows. It probably spikes in CPU usage when you start regedit because it has to draw the application window on the screen. As for why regedit is closing immediately afterwards, I'm inclined to think that doesn't have anything to do with csrss.exe per se. It sounds like a browser hijack or rootkit type move, though, so keep digging. If none of your running processes look suspicious, bear in mind that lots of viruses and malware like to hide behind svchost.exe.

    vonPoonBurGer on
    Xbox Live:vonPoon | PSN: vonPoon | Steam: vonPoonBurGer
  • Options
    SaniusSanius Registered User regular
    edited January 2007
    Chances are I just have to reformat instead, which i'll do later, since I have not in a year and a half. Lots of weird performance issues, crashes while installing games, not even able to run regedit.

    Thanks anyway. I scanned svchost and got nothing, but I don't feel like searching any further.

    Sanius on
Sign In or Register to comment.