csrss.exe virus, How do I get rid of it? Options

[Bigmeanbulldog55]

I think I have the csrss.exe virus and I can't figure out how to get rid of it. I run Symantic AntiVirus and Lavasoft's Ad-Aware program and still can't get rid of it. I'm not sure I have a hacker problem, but I do have pop ups every 10-15min that tell me to do things. I go into task manager and it says that csrss.exe is running the program when I click on the name of the pop up in the "Applications" part and scrole to "Go to Process." I know that csrss.exe is a nessisary software for the video card and what not, but I think this is just a dummy version. I can manually delete it because it says it's nessisary for basic applications, I can't even do it in safe mode. I'm not even sure I'm finding the right one when I'm trying to delete it. Anyone know what to do? Thanks.

[Supersprynt]

Thats a legitimate program. If you go to task mgr and try to disable it off the process list it should say you cant. It is NOT part of the video card.

Csrss.exe is the Microsoft client server runtime which generates worker threads for client requests. The confusion over csrss.exe comes from Trojans or viruses that use the same executable name (.exe) as that of csrss.

Many spyware/malware programs use filenames of usual, non-malware programs.

The legitimate csrss.exe is part of the Microsoft client server software and is a very important part of the system which should not be removed.

One way to determine if csrss.exe is a legitimate file besides looking at the date modified is to right click on csrss.exe inside Task Manager and attempt to end process. Because csrss is a critical file, Microsoft should inform you with a message that csrss.exe is a critical system process and end it is not possible.

If you do not receive this message when attempting to end the csrss.exe process, then it may indeed be a virus. If you decide to terminate the csrss.exe process, make sure any applications are shutdown (such as word, etc) and that you have a backup of your data.

If its CSRSS its the Ahlem.A Worm. But it doesnt cause pop ups. Thats spy-ware. Try running AVG; its free and regularly updated. Look for version 7.2

[P5ycho]

go to mcafee website and download a program called stinger, install and run it, it will get rid of the virus , but before u reconnect to the net i would install a good antivirus 1st...

[Bigmeanbulldog55]

Thats a legitimate program. If you go to task mgr and try to disable it off the process list it should say you cant. It is NOT part of the video card.

If its CSRSS its the Ahlem.A Worm. But it doesnt cause pop ups. Thats spy-ware. Try running AVG; its free and regularly updated. Look for version 7.2

Tried it, and it didn't pick up anything. I'll keep at it. One day something has got to update to the point of actually finding this on my computer. I couldn't find version 7.2, but I found 7.5. I get pop ups that say from, "Messager Service." It happens all the time, on the internet or not. Plain looking windows with just a message to go to a certain website and download something. No links or pretty colors on them.

go to mcafee website and download a program called stinger, install and run it, it will get rid of the virus , but before u reconnect to the net i would install a good antivirus 1st...

I now have 3 on the computer. Symantic is running all the time. The others are the Ad-Aware and now AVG. Neither of those 2 have a constant monitering option availible to me.

EDIT: Here is a picture of one of the pop-ups I get. I checked that regestrycleaner thing, its adware.


This post has been edited by Bigmeanbulldog55: Mar 5, 2007 - 6:31 PM

[Rayme]

start -> run "msconfig"

services / then untick "messenger".

What you have it random junk message, courtesy of registrycleanerxp.com

[lagos]

start -> run "msconfig"

services / then untick "messenger".

What you have it random junk message, courtesy of registrycleanerxp.com

yep... then after you get done doing that, UPDATE YOUR WINDOWS! this isn't a virus, its an old security issue that was in older versions of windows. windows update issued fixes for it a long time ago.

[Bigmeanbulldog55]

start -> run "msconfig"

services / then untick "messenger".

What you have it random junk message, courtesy of registrycleanerxp.com

yep... then after you get done doing that, UPDATE YOUR WINDOWS! this isn't a virus, its an old security issue that was in older versions of windows. windows update issued fixes for it a long time ago.

I can't update my Windows, I don't have the key. My buddy is working on that for me, but progress is slow. He bought Windows, and put it on his and mine. Now it won't let me use the key.

EDIT: That seems to have fixed it. I've been living with that for 2 months now and I'm happy it's gone.

This post has been edited by Bigmeanbulldog55: Mar 5, 2007 - 8:53 PM

[neKronos]

Oh the good old messenger popups, i had fun doing it to people