csrss.exe

[NunchakuKing]

Hi,

Searched around for this topic but didnt find much pertaining to my issue, Apologies if I overlooked an appropriate thread.

Everytime I start up my computer I am greeted with the following error, "Windows could not find C:\windows\config\csrss.exe". Once I search for the file I do indeed find it and attempt to paste it in the appropriate folder to no avail. Any suggestions on how to fix this issue?

Thanks very Much!

 

[Deleted member 133315]

csrss.exe should be in the windows/system32 folder

google is saying that what you are seeing is a trojan and that you have been infected since csrss.exe isnt in the correct place and the error message you see is relating to a virus.


It looks like your antivirus software already took care of the virus but the startup remains, you will have to carefully clean out the remainder of the virus so that it doesnt startup with windows, even though probably half of the virus has already been deleted or quarantined.

I would advise you to disable system restore and then scan again, also use hijack this and post a hijack this log and see if anyone can tell you which files to delete.

also install superantispyware if you havent already got it installed and then update it and then scan your pc.

I have stole the following from another website that deals with the same problem and the person who had the problem replied that the tips below did the job.

http://groups.google.com/group/micr...general/browse_thread/thread/633b115590466406




Recently on boot up I now receive the following error message
> " Cannot open C:\Windows\Config\csrss.exe"

> Any idea what is going on and how I can get rid of it??

> Thanks


First of, the legit file should be here in this directory:
C:\windows\system32\Csrss.exe"
I think your Anti-virus Quarantine the Viral infection but still on the
startup list.
Unexplained computer behaviour may be caused by deceptive software
http://support.microsoft.com/kb/827315

Go through these Cleaning steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from here:
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
RootkitRevealer v1.71
By Bryce Cogswell and Mark Russinovich
http://www.microsoft.com/technet/sysinternals/Security/RootkitReveale...

Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html

You can download this tool "AutoRuns for Windows"
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
And remove the entry from here:

Locate this key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run = look in
the right pane/window and remove the entry for it
"C:\Windows\Config\csrss.exe". I think this line is all that you would need if your antivirus has already taken care of the virus, but just left a startup entry in the registry, so by deleting that line it should all be solved, but do a scan afterwards to see if it has all been removed.

Run disk cleanup and defrag in safe mode. Then run this command:
sfc /scannow