csrss.exe

[iFrankie]

im such a fool, so iv just ran a virus scan and it found csrss.exe i googled it to see what it was and what it did and i read it takes personal information internet banking info ect, this morning i bought some stuff off ebay via paypal and went onto my internet banking, what should i do and am i at risk of fraud?
Thanks

---------- Post added at 02:03 ---------- Previous post was at 02:03 ----------

and im wondering why avast didn't pick it up in the first place.

[Ben B]

Eek! That process is running in my task manager!

[iFrankie]

Originally Posted by Ben B

Eek! That process is running in my task manager!

im worried sick lol, iv had viruses before and bought stuff and nothing happened.

[Ben B]

Hang on, it is an essential windows process http://www.neuber.com/taskmanager/pr...csrss.exe.html but can sometimes be disguised as a virus

[iFrankie]

Originally Posted by Ben B

Hang on, it is an essential windows process http://www.neuber.com/taskmanager/pr...csrss.exe.html but can sometimes be disguised as a virus

well its deleted now among others ill try restarting and see what happens

[webcrawler2050]

Originally Posted by Frankie07

well its deleted now among others ill try restarting and see what happens

2) The Microsoft Client Server Runtime Server subsystem utilizes the process csrss.exe for managing the majority of the graphical instruction sets under the Microsoft Windows operating system. As such Csrss.exe provides the critical functions of the operating system, and its termination can result in the Blue Screen of Death being displayedCsrss.exe controls threading and Win32 console window features. Threading is where the application splits itself into multiple simultaneous running tasks. Threads supported by csrss.exe are different from processes in that threads are commonly contained within the process, with various threads sharing resources within the same process. The Win32 console is the plain text window in the Windows API system (programs can use the console without the need for image display).In mobile devices such as notebooks and laptops, the process csrss.exe is closely dependent on power management schemes implemented by the system as defined under the Control Panel option.This process should be treated as suspicious if there are two instances running. Always take note of the process location when trying to determine whether or not the process is genuine or malicious.This Windows component should be located in your Windows System directory ie: something similar to C:\Windows\System32\csrss.exe

[iFrankie]

Originally Posted by webcrawler2050

2) The Microsoft Client Server Runtime Server subsystem utilizes the process csrss.exe for managing the majority of the graphical instruction sets under the Microsoft Windows operating system. As such Csrss.exe provides the critical functions of the operating system, and its termination can result in the Blue Screen of Death being displayedCsrss.exe controls threading and Win32 console window features. Threading is where the application splits itself into multiple simultaneous running tasks. Threads supported by csrss.exe are different from processes in that threads are commonly contained within the process, with various threads sharing resources within the same process. The Win32 console is the plain text window in the Windows API system (programs can use the console without the need for image display).In mobile devices such as notebooks and laptops, the process csrss.exe is closely dependent on power management schemes implemented by the system as defined under the Control Panel option.This process should be treated as suspicious if there are two instances running. Always take note of the process location when trying to determine whether or not the process is genuine or malicious.This Windows component should be located in your Windows System directory ie: something similar to C:\Windows\System32\csrss.exe

hmm there must of been 2 then cause i deleted one and theres still one in the processes

[Raistlin]

Do a search for that file on your hard drive and see where it's located.

If it's in C:\Windows\System32\ then it should be ok, if it's anywhere else it's probably a trojan of some sort.

If it's one of the Windows files then it will be 'protected' (in other words Windows will restart/restore it when it's rebooted and won't let you (easily) delete it for good). If it's a trojan then the chances are that it is also protecting itself and will restore itself from a backup copy elsewhere in your system when you delete the original.

Work out exactly what it is, and where it is, before you go deleting anything else - until then don't access anything sensitive, and use a known clean machine to change passwords/credentials for anything that you've accessed with this machine.

[lauzjp]

I just did a search and it said that there's a csrss.exe in C:\WINDOWS\ServicePackFiles\i386 - should I ignore that or delete it?

[Raistlin]

That will have been installed as part of SP2 or SP3 I would imagine. Should be safe enough to ignore That said, I don't think it will be necessary, so it should be safe enough to delete (in fact, you could probably delete the whole folder).

More information here:

http://support.microsoft.com/?kbid=329260

[lauzjp]

ta.

[iFrankie]

Originally Posted by Rob M

Do a search for that file on your hard drive and see where it's located.

If it's in C:\Windows\System32\ then it should be ok, if it's anywhere else it's probably a trojan of some sort.

If it's one of the Windows files then it will be 'protected' (in other words Windows will restart/restore it when it's rebooted and won't let you (easily) delete it for good). If it's a trojan then the chances are that it is also protecting itself and will restore itself from a backup copy elsewhere in your system when you delete the original.

Work out exactly what it is, and where it is, before you go deleting anything else - until then don't access anything sensitive, and use a known clean machine to change passwords/credentials for anything that you've accessed with this machine.

thanks everything is fine now except that i keep getting mines.exe i tried to delete it with avast but it fails ill give it a try in safe mode.

[jonifen]

The real csrss.exe cannot be killed in Task Manager under WinXP and higher. If you can kill such a process, it would definitely mean it is a "fraudulent" one and should be deleted.

If you do kill the real csrss.exe using an alternative method of killing a task (pskill for example), your PC will blue screen & memory dump instantly as its essential to the running of a PC.

[DaiNasty]

Originally Posted by Frankie07

thanks everything is fine now except that i keep getting mines.exe i tried to delete it with avast but it fails ill give it a try in safe mode.

http://www.prevx.com/filenames/X7184...MINES.EXE.html

Does not look like something you'd want to keep.

Try booting into safe mode and clearing everything from the TEMP folders. Ccleaner is good for this.
http://www.ccleaner.com/

[AntiSilence]

Originally Posted by DaiNasty

Ccleaner is good for this.
http://www.ccleaner.com/

CCleaner is fantastic and is one of those utils that I install straight away after any re-install of Windows. And it does file shredding when it deletes them too