Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

CSRSS


  • Please log in to reply
8 replies to this topic

#1 Tamra R

Tamra R

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:04 PM

Posted 16 July 2011 - 04:56 PM

I have been having an error when booting up my computer - cannot find CSRSS.exe. It is looking for this exe in my local directory. When looking in the processes CSRSS.exe is running. Does anyone know of a virus that can cause this problem? It began a couple of days ago. Any help is appreciated.
Thanks

BC AdBot (Login to Remove)

 


#2 .X.

.X.

  • Members
  • 490 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:10:04 PM

Posted 16 July 2011 - 05:12 PM

What do you mean in your local directory?

#3 Andrew

Andrew

    Bleepin' Night Watchman


  • Moderator
  • 8,260 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Right behind you
  • Local time:07:04 PM

Posted 16 July 2011 - 05:16 PM

To be clear: Windows starts up normally, right? As in, it doesn't immediately force a reboot?

The real CSRSS.exe program is a very critical part of Windows. So critical, in fact, that if it's not found Windows will force a reboot. It is a common trick, however, for malware to use the name CSRSS.exe so as to appear legitimate to casual observers. The fact that the missing CSRSS.exe is located not in C:\WINDOWS\system32 but rather in a directory under your username (possibly the Temp folder) reenforces the notion that this is (or was) some bit of malware.

The good news is that the malicious CSRSS.exe could not be found and executed. It may have been quarantined by your anti-virus or deleted from the Temp directory (since it's only intended for temporary files anyway.) The reference in your system's startup settings to this file still exists, which is why Windows is complaining that it can't find it, but the actual file is gone.

Run a full scan with your anti-virus, being sure to get the latest updates to the scanner definitions. Let it clean anything it finds. For good measure you may want to run an additional scanning tool such as Malwarebytes Antimalware (free for personal use.) Think of it like getting a second opinion from another doctor.


However, if you have noticed other signs of potential malware activity (your Google search results are being redirected, odd warnings that entice you into downloading and/or purchasing some software to correct purported system errors, etc.) then you would be well served to start a topic in the Am I Infected? What Do I Do? forum detailing all the suspicious and unusual symptoms you have observed.

#4 Tamra R

Tamra R
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:04 PM

Posted 17 July 2011 - 10:15 AM

The directory it is looking for it is in C:\Documents and Settings\...\Local Settings\Temp.
I ran a scan and no viruses were detected. I also was unable to access the internet and I needed to change the settings to get back in which I thought was strange since it happened in conjuntion with the error.

#5 Andrew

Andrew

    Bleepin' Night Watchman


  • Moderator
  • 8,260 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Right behind you
  • Local time:07:04 PM

Posted 17 July 2011 - 05:08 PM

I also was unable to access the internet and I needed to change the settings to get back in which I thought was strange since it happened in conjuntion with the error.

Is this every time you start up or just once? What are the settings you had to change?

#6 Tamra R

Tamra R
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:04 PM

Posted 18 July 2011 - 06:57 AM

Everytime I startup it happens. I needed to change the broadband connection settings.

#7 Andrew

Andrew

    Bleepin' Night Watchman


  • Moderator
  • 8,260 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Right behind you
  • Local time:07:04 PM

Posted 18 July 2011 - 12:57 PM

Which broadband connection settings precisely?

#8 Tamra R

Tamra R
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:09:04 PM

Posted 18 July 2011 - 01:30 PM

I set it to find a connection automatically. Use a proxy server was checked and I unchecked it and had it search for a connection. I had no problems until the error message started occuring.

#9 Andrew

Andrew

    Bleepin' Night Watchman


  • Moderator
  • 8,260 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Right behind you
  • Local time:07:04 PM

Posted 18 July 2011 - 01:57 PM

To me that indicates that there is still some malware running in your system (changes the proxy settings is a common indicator of infection, especially if they revert by themselves after you reset them.)

Please follow this guide to generate a series of diagnostic logs and post them to the Malware Logs forum so that they can be analyzed by a member of the MRT. The MRT member will then post instructions on how to clean your computer of any malware which has been found.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users