malicious Look alikes of Csrss.exe

Last Updated on Wednesday, 29 May 2013 16:32 Saturday, 03 April 2010 06:47

Harmful - Clones

 The file Csrss.exe is (Client/Server Run-Time Subsystem) in Microsoft windows.

 Files with the name Csrss.exe are also created by several computer virus programs that affect computers running on Microsoft windows operating systems. Their analysis reports are given below.

 Files found :-  view 
%AppData%\csrss.exe

Files found :-  view
%AppData%\Microsoft\csrss.exe  

Files found :- view
%CommonPrograms%\Startup\csrss.exe

Files found :- view
C:\windows\csrss.exe

Files found :- view
C:\windows\Config\csrss.exe 

Files found:- view
C:\windows\system32\csrss\csrss.exe

Files found :- view
C:\Windows\System32\Windows Explorer\csrss.exe

Files found :- view
C:\Windows\System32\oobe\rule8\files\csrss.exe 

There may be more files created by these virus programs. You can find them out. First locate and note down the "date of creation" of the malicious look alike of csrss.exe, and after that, search the hard disk for other files created on that date or onward. See image.

Necessary steps to remove these virus programs

• To remove processes created by the virus program from the Task Manager.
• To search and delete files created by the virus program from the hard disk. Enable to view "hidden files and folders" before you search. Otherwise files created by the virus program inside the hidden folders will not be found.
• To remove obsolete registry keys using CCleaner.