Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

csrss.exe


  • Please log in to reply
5 replies to this topic

#1 stable7

stable7

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:18 PM

Posted 13 July 2016 - 08:41 AM

Is csrss.exe a virus?

Is there anyway to check?

In processes tab it gives no info.

Here is the screenshot.

 

thank you

Attached Files



BC AdBot (Login to Remove)

 


#2 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:18 PM

Posted 13 July 2016 - 08:43 AM

Hi stable7 :)

csrss.exe is a legitimate Windows process. You won't be able to do anything with it unless you click on the Show processes from all users button in the bottom-left corner, since interacting with it requires Admin Rights. From there, you'll be able to right-click on it, select Open File Location and access it. I think that the description will also appear for it in the Task Manager, I don't remember really and I don't have access to a Windows 7 machine right now to confirm.

https://en.wikipedia.org/wiki/Client/Server_Runtime_Subsystem

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#3 stable7

stable7
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:18 PM

Posted 13 July 2016 - 08:58 AM

There are 2 instances in processes tab. Is that normal? They both go to C:\Windows\System32

I realize that this is a legitimate process. I have heard that this could be a virus. It seems that I am having browser slowdown and was just curious.



#4 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:18 PM

Posted 13 July 2016 - 08:59 AM

Yes, both of them are legitimate. There's usually 2 instances of it running, on Windows 7 at least.

And pretty much every single Windows exécutable have a virus or malware using its process name. As long as the process is launched from its right location, and isn't hijacked, then it's good :)

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#5 stable7

stable7
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:18 PM

Posted 13 July 2016 - 09:01 AM

ok thank you



#6 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:18 PM

Posted 13 July 2016 - 09:01 AM

No problem, you're welcome :)

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users