Questions about csrss.exe

I have two questions on the process 'csrss.exe' running Vista Business 32 b SP2.

  1. In a variety of sites on the web, I read that having two processes csrss.exe running is an indication that a virus or malware are present, posing as one of the two images csrss.exe in memory.  If I bring up the Task Manager and a quick glance, I see only a single process csrss.exe (PID = 652, private memory = 1332K.  Field name of the image, the command line path and Description are white). However, if I hit the button "Show processes from all users", a second process csrss.exe appears, on PID = 596, private memory = 1200K (PID = 652 is now using 1 412 K or private working set memory).  No process uses any CPU at the moment, as far as I know.  Both display the same values following the different fields in the table:

    • Username = SYSTEM
    • Name=C:\Windows\System32\csrss.exe image path
    • Line=C:\Windows\system32\csrss.exe command ObjectDirectory = \Windows SharedSection = 1024, 12288, 512 Windows = SubSystemType = Windows ServerDll = basesrv, 1 ServerDll = winsrv:UserServerDllInitialization, 3 ServerDll = winsrv. ConserverDllInitialization, 2 = Off MaxRequest ProfileControl
    • Description = Client Server Runtime Process

    When I researched the csrss.exe file c:\ system, I found the following files csrss.exe. 'Properties' information after each. None of these files listed all the previous versions tab "Previous Versions":

    C:\Windows\System32\csrss.exe:

    File Client Server Runtime process Type Application version 6.0.6001.18000 file Description product name of the Microsoft Windows Operating System version 6.0.6001.18000 Copyright Microsoft Corporation product. All rights reserved size 6.00 KB updated Day 2008-01-19 03:33 language English (United States)

    C:\Windows\winsxs\x86_microsoft-Windows-csrss_31bf3856ad364e35_6.0.6001.18000_none_58e3e3d7e415ae4c\csrss.exe:
    File Client Server Runtime process Type Application version 6.0.6001.18000 file Description product name of the Microsoft Windows Operating System version 6.0.6001.18000 Copyright Microsoft Corporation product. All rights reserved size 6.00 KB updated Day 2008-01-19 03:33 language English (United States)

    C:\Windows\winsxs\x86_microsoft-Windows-csrss_31bf3856ad364e35_6.0.6000.16386_none_56ad21dbe72a9d78

    File Client Server Runtime process Type Application file version 6.0.6000.16386 Description product name of the Microsoft Windows Operating System version 6.0.6000.16386 Copyright Microsoft Corporation product. All rights reserved updated dimensions 7,50 KB day 02/11/2006 language English (United States)

    In addition, here are the MD5 signatures for each file:

    c:\Windows\System32\csrss.exe abca209eba02cb59233614db83b4f50d c:\Windows\winsxs\x86_microsoft-windows-csrss_31bf3856ad364e35_6.0.6001.18000_none_58e3e3d7e415ae4c\csrss.exe abca209eba02cb59233614db83b4f50d c:\Windows\winsxs\x86_microsoft-windows-csrss_31bf3856ad364e35_6.0.6000.16386_none_56ad21dbe72a9d78\csrss.exe 117b7c8a8b026a5dce5e3180ed05e823

    So the new version is identical in both of its directories. But there is an older version (6.0.6000.16386) hang out there.

    One last thing: when I look into a review process advantage 3rd, 596 PID and PID 652 tool appear as:

    Version 6.0.6001.18000 time: 2008-01-19 03:33

    And when I run the equivalent of the UNIX 'strings' command against them, I find that both contain the following (among others):

    version = "5.1.0.0.

    Is this normal? Or do I have to remove the old file csrss.exe?

  2. Csrss.exe does need access to the wider internet, or only certain addresses in the range of the internet on my home network behind my firewall/router; or only the loopback address?  Because Zonealarm says sometimes csrss.exe is asked for internet access. And when I allow it, it okays two access my local network and to the internet as a whole.  This behavior is normal? For now, I have disabled access to the wider internet of csrss.exe, and I'm limiting access to machines behind my firewall. I would like to be able to restrict it to my loopback address.  Nothing wrong with that?
Thank you!

Hello elg476,

You can download (free) MalwareBytes link: http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572
.html? tag = mncol install, Update and do a scan of your system to make sure that it is indeed clean. To be completely sure that your computer is safe do this scan in safe mode. Restart it and press the F - 8 key several times when the system boots and select Safe mode and run Malwarebytes in safe mode, it will attract the most difficult malware.

Hope this helps you. Let us know anyway. Make it a great day!

"In the end the love you take is equal to The Love You Make" (The Beatles last song from their latest album, Abbey Road.)

Tags: Windows

Similar Questions

  • 2 questions about mcupdate.exe

    Use Vista Home Premium 32-bit with SP2 of Vista on HP desk top of page

    2 questions about mcupdate.exe

    1. what is? When I google it I get's things on McAfee. I have McAfee and never had McAfee. The information google seems to indicate that it could be a virus. However, I see the following

    -It seems to be in the ehome on my computer folder

    -It seems it works twice a day and every time it turns my internet connection log shows the connection to a microsoft ip address for 'download tv' or something like, think if it is not not a virus

    2 seems that it does not always work. I'll get these connections every day, twice a day for a few weeks or more, then get not every day.

    Currently I seem to not get any activity, just after the silver light updated 01/09/10. I do not use the TV feature on my computer, but I was wondering what it is and why it works sometimes

    Hello

    The link works here even if it could be glitch or malware, if you can access a Microsoft site. Try
    Yet once, and if no joy don't try to see if you can reach http://www.microsoft.com

    The 2nd link describes the file unless it has been replaced by malware here is information.
    Would that be a normal update.

  • A question about SearchIndexer.exe.

    I followed my performance computer periodically since the first day I fight the laptop. It has 4 GB of RAM and runs on Windows 7 Ultimate x 64 bit edition. Lately, I've noticed a few oddities with a certain process and its services. It's called SearchIndexer.exe.

    Usually, my use of the idle physical memory is usually in the low range 30 percentile. One day, I noticed that the physical memory usage is much more high by about 6 or more %. I check it out and noticed that SearchIndexer.exe used a memory MUCH what he usually does. He used about 120 000 kilobytes of memory.

    So I decided to consult services for this process. The service was WSearch (Windows Search), normal as always. There are a few weird things past with the service... The PID of the service always changes to reboot the computer, or whenever I restart the service. I don't know if it's normal that the services change their PID, so please tell me the wrong or right. Also, I find it rather odd that the group to which the service is associated is N.A. By checking the service Explorer window, it tells me that the service is actually part of the SYSTEM Group.

    So, this brings me to the final question. Is this malware process, has some sort of error, or is this normal? I have done many different AV analyses and etc and it came out clean.

    Hello

    Your description sounds normal.

    After that initial run to index the files/folders selected on the disc, the search indexer will be run periodically of new index files and re-index the changed files.

    The length of time to run and the amount of memory it uses depends on how strongly the system has been used and how many changes have been made to the file system since the last at the request of indexing.

    I hope this helps.

    Thank you for using Windows 7

    Ronnie Vernon MVP
  • How can I know the exact date of the csrss.exe download?

    HelloW please someone tell me how can I know the exact date of the download or installation of csrss on my pc. in the properties of the box, I can only find an old date (date of creation 2009) but think I didn t have this pc so... Please help me

    Hello

    Thanks for posting your query in Microsoft Community.

    I understand that you have questions about the date of download csrss.exe.

    But I would like to know more information, to help you better.

    (1) get any error message related to this csrss.exe process?

    (2) what is the problem in the computer?

    In the meantime, please refer to the below suggestion.

    In fact, the csrss.exe is not a program that can be downloaded, it is rather a process in the Windows System. Thus, it would display the date of creation as the process is being created. Csrss.exe is a system process that is needed for your PC to function properly. It should not be deleted.

    The Microsoft Client Server Runtime Server subsystem uses the csrss.exe. This process of management of the majority of the graphical instruction sets under the Microsoft Windows operating system. As such Csrss.exe offers the important functions of the operating system, and the Blue Screen of Death displayed may lead to his termination.

    Csrss.exe threading and features of Win32 console window controls. Threading is where the application itself is divided into several simultaneous running tasks. Threads supported by csrss.exe are different
    process in this son are usually included in the process, with different threads, sharing of resources within the same process. The Win32 console is plain text window in the Windows API system (programs can use the console without the need for display of the image).

    Additional information:

    Csrss.exe

    http://answers.Microsoft.com/en-us/protect/Forum/MSE-protect_scanning/csrssexe/26bba20c-2691-4D42-bec4-637436c53c4f

    I hope this helps. Otherwise, feel free to write back and we woll will be happy to help.

    Thank you

  • Is CSRSS.exe Trojan horse and how get rid of?

    I was told by one of the representatives of the Office to help HP that CSRSS.exe is a Trojan horse and the reason for which their printer is not working and why internet Explorer began to crash after I tried to install their printer... question is one CSRSS.exe Trojan and if I do I delete it from my computer.

    Hello

    If you need search malware here's my recommendations - they will allow you to
    scrutiny and the withdrawal without ending up with a load of spyware programs running
    resident who can cause as many questions as the malware and may be harder to detect as
    the cause.

    No one program cannot be used to detect and remove any malware. Added that often easy
    to detect malicious software often comes with a much harder to detect and remove the payload. Then
    its best to be thorough than paying the high price later now too. Check with them to one
    extreme overkill point and then run the cleaning only when you are sure that the system is clean.

    The methods below are for Windows 7 - Vista is very similar - for XP using RUN instead of
    Start - Search,.

    It can be made repeatedly in Mode safe - F8 tap that you start, however, you must also run
    the regular windows when you can.

    TDSSKiller.exe. - Download the desktop - so go ahead and right-click on it - RUN AS ADMIN
    It will display all the infections in the report after you run - if it will not run changed the name of
    TDSSKiller.exe to tdsskiller.com. If she finds something or not does not mean that you should not
    check with the other methods below.
    http://support.Kaspersky.com/viruses/solutions?QID=208280684

    Download malwarebytes and scan with it, run MRT and add Prevx to be sure that he is gone.
    (If Rootkits run UnHackMe)

    Download - SAVE - go to where you put it-right on - click RUN AS ADMIN

    Malwarebytes - free
    http://www.Malwarebytes.org/products/malwarebytes_free

    SuperAntiSpyware Portable Scanner - free
    http://www.SUPERAntiSpyware.com/portablescanner.HTML?tag=SAS_HOMEPAGE

    Run the malware removal tool from Microsoft

    Start - type in the search box-> find MRT top - right on - click RUN AS ADMIN.

    You should get this tool and its updates via Windows updates - if necessary, you can
    Download it here.

    Download - SAVE - go to where you put it-right on - click RUN AS ADMIN
    (Then run MRT as shown above.)

    Microsoft Malicious - 32-bit removal tool
    http://www.Microsoft.com/downloads/details.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

    Microsoft Malicious removal tool - 64 bit
    http://www.Microsoft.com/downloads/details.aspx?FamilyId=585D2BDE-367F-495e-94E7-6349F4EFFC74&displaylang=en

    also install Prevx to be sure that it is all gone.

    Download - SAVE - go to where you put it-right on - click RUN AS ADMIN

    Prevx - Home - free - small, fast, exceptional CLOUD protection, working with others
    security programs. It is a single scanner, VERY EFFICIENT, if it finds something to come back
    here or use Google to see how to remove.
    http://www.prevx.com/   <-->
    http://info.prevx.com/downloadcsi.asp?prevx=Y  <-->

    Choice of PCmag editor - Prevx-
    http://www.PCMag.com/Article2/0, 2817,2346862,00.asp

    Try the demo version of Hitman Pro:

    Hitman Pro is a second scanner reviews, designed to save your computer from malicious software
    (viruses, Trojans, rootkits, etc.). who infected your computer despite safe
    what you have done (such as antivirus, firewall, etc.).
    http://www.SurfRight.nl/en/hitmanpro

    --------------------------------------------------------

    If necessary here are some free online scanners to help the

    http://www.eset.com/onlinescan/

    -----------------------------------

    Original version is now replaced by the Microsoft Safety Scanner
    http://OneCare.live.com/site/en-us/default.htm

    Microsoft safety scanner
    http://www.Microsoft.com/security/scanner/en-us/default.aspx

    ----------------------------------

    http://www.Kaspersky.com/virusscanner

    Other tests free online
    http://www.Google.com/search?hl=en&source=HP&q=antivirus+free+online+scan&AQ=f&OQ=&AQI=G1

    --------------------------------------------------------

    After the removal of the malware: (for VISTA and XP, you must use their recommended
    methods to perform the SFC and CHKDSK which are similar.)

    Also follow these steps for the General corruption of cleaning and repair/replace damaged/missing
    system files.

    Start - type this in the search box-> find COMMAND at the top and RIGHT CLICK – RUN AS ADMIN

    Enter this at the command prompt - sfc/scannow

    How to fix the system files of Windows 7 with the System File Checker
    http://www.SevenForums.com/tutorials/1538-SFC-SCANNOW-Command-System-File-Checker.html

    How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program
    generates in Windows Vista cbs.log
    http://support.Microsoft.com/kb/928228

    Also run CheckDisk, so we cannot exclude as much as possible of the corruption.

    How to run check disk in Windows 7
    http://www.SevenForums.com/tutorials/433-disk-check.html

    -----------------------------------------------------------------------

    If we find Rootkits use this thread and other suggestions. (Run UnHackMe)

    http://social.answers.Microsoft.com/forums/en-us/InternetExplorer/thread/a8f665f0-C793-441A-a5b9-54b7e1e7a5a4/

    ======================================

    VISTA and XP need other methods for a repair Installation.

    If necessary AFTER you are sure that the machine is clean of any malware. (DO NOT USE IF)
    MALWARE IS STILL PRESENT).

    How to do a repair installation to fix Windows 7
    http://www.SevenForums.com/tutorials/3413-repair-install.html

    =======================================

    For extreme cases:

    Norton Power Eraser - eliminates deeply embedded and difficult to remove crimeware
    This traditional antivirus analysis does not always detect. Because the Norton Power Eraser
    uses aggressive methods to detect these threats, there is a risk that it can select some
    legitimate programs for removal. You should use this tool very carefully and only after
    you have exhausted other options.
    http://us.Norton.com/support/DIY/index.jsp

    ================================

    If you are in North America, you can call 866-727-2338 for virus and spyware help
    infections. See http://www.microsoft.com/protect/support/default.mspx for more details. For
    international information, see your subsidiary local Support site.

    Microsoft support - Virus and Security Solution Center
    http://support.Microsoft.com/contactus/cu_sc_virsec_master?ws=support#TAB0

    I hope this helps.

    Rob Brown - Microsoft MVP<- profile="" -="" windows="" expert="" -="" consumer="" :="" bicycle=""><- mark="" twain="" said="" it="">

  • I have Trojan in csrss.exe, leading to more mistakes 7 000.

    My computer is slow to connect to Internet Explorer.  I called the technical support of IE, and it has taken control of my computer remotely.  He found that a Trojan horse attached to the csrss.exe file.  This file is essential to Windows oprating system, he said.  It is originally more 7 000 errors.  What should I do to fix this?  Should I really have to pay 149.00 to fix this.  The tech said this Trojan horse is deep into my system, and that ordinary security software won't fix.  Help!

    Hi Rob,
    Try the sequence of steps 1 and 2 in this virus/malware removal guide: http://www.selectrealsecurity.com/malware-removal-guide
    It provides simple instructions on how to remove malware from a computer. If you have any questions, just ask. I hope this helps you.
    Brian
  • In XP get error log that csrss.exe is not found, what is it?

    The csrss.exe file is needed? I get an error when opening session that this file is not found.

    Hello

    To do: Important this section, method, or task contains steps that tell you how to modify the registry. However, serious problems can occur if you modify the registry incorrectly. Therefore, make sure that you proceed with caution. For added protection, back up the registry before you edit it. Then you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click on the number below to view the article in the Microsoft Knowledge Base:

    http://support.Microsoft.com/kb/322756/

    How to back up and restore the registry in Windows

    You can refer to the following steps:

    * Click Start > run

    * Type regedit and press to enter.

    * Search HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

    * Right-click on winlogon, and select export.

    * Save the reg file to a location incase you must cancel the following changes.

    * In winlogin search shell and double-click it.

    * Change the value of "Explorer.exe C:\WINDOWS\System32\csrss.exe" just "Explorer.exe".

    * Save changes and disconnect and reconnect.

    * Restart the computer.

  • Why csrss.exe freezes all other programs that are running when it is active?

    I don't know what to say here. I have an ASUS Intel duo Core Windows Vista OS and when I read the e-mail or watching Facebook, play WoW or just generally surf on the internet and the active process other programs freeze and I have to restart the program.

    I've read several channels that talk about the possibility of malware, and I have a current copy of Norton Antivirus and Malwarebytes, more I ran the quick scan of MRT and none of these show that I have a malware.

    Any suggestions?

    What do you mean by activation of csrss.exe? What program you restart?

    Csrss.exe is responsible for the separation and process and thread creation. I think that all activity on his part would be a symptom rather than the cause of the problem you are experiencing.

    This name has been used by malware to disguise himself. You can check if this copy is the real version of Microsoft looking where he was charged with the Task Manager. Go to view > select columns, look for the command line entry. It will show as C:\Windows\System32\csrss.exe if this is the true copy of Microsoft. Another thing would be malware.

    You can try to use the clean boot to diagnose the cause of the problem:

    http://support.Microsoft.com/kb/929135

  • Get BSOD under control of bug, I found the issue was csrss.exe. I uninstalled the video drivers intel, but the machine is still crushing.

    Hello

    I Keep getting this blue screen under bug death check I found that the issue was csrss.exe. I uninstalled the video drivers intel, but the machine is still crushing.

    https://onedrive.live.com/redir?RESID=BE2C45CEFD325C95! 162 & authkey =! AKZFqC6arezz-QI & ithint = the file % 2czip

    I join the crush dump files.

    Kindly help.

    First, you must upgrade to the Service Pack-1

    Service pack 1 update.

    http://Windows.Microsoft.com/installwindows7sp1

    Learn how to install Windows 7 Service Pack 1 (SP1)

    http://Windows.Microsoft.com/en-us/Windows7/learn-how-to-install-Windows-7-Service-Pack-1-SP1

    Additional resources:

    http://Windows.Microsoft.com/en-us/Windows7/uninstall-SP1
    http://Windows.Microsoft.com/troubleshootwindows7sp1

    After that, if you're still crashing

    These accidents were related to the corruption of memory (probably caused by Kaspersky).

    Run these two tests to check your memory and find which driver is causing the problem.  Launch auditor.  You don't need to run memtest again unless the auditor is not the cause, or you want to.

    If you are overclocking anything reset by default before running these tests.
    In other words STOP! If you don't know what it means that you're probably not  


    1-Driver Verifier (for full instructions, see our wiki here)

    2-Memtest. (You can learn more about running memtest here)
  • Client Server Runtime Process (csrss.exe) problem?

    When I right click Properties of csrss.exe in the Task Manager, the action request closes down the Task Manager and I don't get any list of properties.  If I right click Properties in C:\Window\system32\csrss.exe windows Explorer I get the list of properties.  While in Manager tasks there is no "user" shown for csrss.exe and try to complete the process for csrss.exe does not produce a warning message about data loss and csrss program can't.    A phone call unsolicited from someone who claims to be a subcontractor for support of MS (1-855-857-1687) said a virus attacked my csrss.exe file and had already modified 2855. Programs EXE and make them spies, considerably slowed down my computer and wanted to sell me a program $175.00 to solve this problem has alleged.  Windows defender and Professional of Iolo's System Mechanic can not find something wrong.  Is there a problem and if so how to find and fix?  Is this some kind of scam?

    Hello

    You made any hardware or software changes the computer recently?

    If you are unable to remove the virus from normal mode, and the Microsoft Safety Scanner is unable to run, then get the computer in safe mode with networking and to launch the scanner.

    Advanced boot (including safe mode) options: http://windows.microsoft.com/en-US/windows7/Advanced-startup-options-including-safe-mode

    Reference: Avoid scams to phone for tech support

    http://www.Microsoft.com/security/online-privacy/avoid-phone-scams.aspx

    If you suspect a virus infection on your computer, and then try the steps in this link.

    http://Windows.Microsoft.com/en-us/Windows7/how-do-I-remove-a-computer-virus

    Security Scanner warning: there will be data loss through an analysis using the Microsoft safety scanner to eliminate viruses as appropriate.

    I hope this helps.

  • Question about Dell OEM: SLP Windows 7 Installation disk domestic; can it be installed and activated on other computers from Dell?

    I bought a Dell installation disk and I want to use it to install a better version of Windows on my Dell PC. I have windows Vista and I want to use it to update my OS Windows7 Home Premium. However, the license type is SLP:OEM and no detail... not sure what SLP: OEM means... I thought that the OS discs are the same. Someone told me no retail editions are not suitable for a new OS, but I'm confused. The disc says, Windows 7 Home premium 64-bit, but didn't holograms who have all MS OS disks and the disk is labeled for use with a Dell system only, if the means it will work very well on my Dell PC? The label does not which brand or model this disc is for, but said only for the Dell PC which is my PC. I'm assuming, the disk won't work on all Dells, maybe someone can offer suggestions, any help is much appreciated. Thank you!

    I have a few other questions about Windows 7, can I ask you about this on your Web site? Do not know how to contact you on your website. I can see other people responding to your articles, but that's all. I thought that maybe their might be a forum to post a question... Thank you for everything.

    You can comment on my site but comments will be public and it is easier to answer questions in the forums.

    If you want to be more precise, you can post in the Dell Community Forums. :

    http://en.community.Dell.com/support-forums/software-OS/

    There are also ways to private message me there is something I don't think that can be done by non-moderateurs on Microsoft Answers. However, I prefer answering questions on the forum:

    http://en.community.Dell.com/members/natakuc4

    Concerning the compatibility with Windows 7, I have listed a full pilot system here compliment:

    http://dellwindowsreinstallationguide.com/driver-sets/Inspiron-desktops/Inspiron-518-Windows-7-64-bit/

    Theres nothing to worry about your circuit board, the only driver who can break your system's BIOS update. I only list the last official update BIOS list Dell in my unofficial driver sets.

    The webcam should be covered by Dell Webcam Central but what is the monitor?

    http://ftp.Dell.com/Monitors/Dell_SX2210-Monitor_Webcam%20SW%20RC1.1_%20R230103.exe

    The main difficulty is to get a genuine product key Windows 7 64 bit. The time now it's easier to buy the 64-bit Windows 8.1. No matter if you buy Windows 7 or 8.1 64-bit both going to Windows 10 free when the RTM is out.

  • Infected computer - unable to end csrss.exe and winlogon.exe in the Task Manager

    original title: Trojan horses and worms: _

    in my pc win 7 when I run the task mngr I see to the process without all the properties and descriptions and I cannot put an end to these processes, how do I know that they are infected, the processes are 1: csrss.exe 2:winlogon.exe
                                                    

    Hello

    Those who are part of Windows and should be in the process. Normally they are not a problem unless you
    have an infection that affects them.

    =======================

    If you need search malware here's my recommendations - they will allow you to
    scrutiny and the withdrawal without ending up with a load of spyware programs running
    resident who can cause as many questions as the malware and may be more difficult to detect as the
    cause.

    No one program cannot be used to detect and remove any malware. Added that often easy
    to detect malicious software often comes with a much harder to detect and remove the payload. Then
    its best to be thorough than paying the high price later now too. Check with them to one
    extreme overkill point and then run the cleaning only when you are sure that the system is clean.

    It can be made repeatedly in Mode safe - F8 tap that you start, however, you must also run
    the regular windows when you can.

    Download malwarebytes and scan with it, run MRT and add Prevx to be sure that he is gone.
    (If Rootkits run UnHackMe)

    Download - SAVE - go to where you put it-right on - click RUN AS ADMIN

    Malwarebytes - free
    http://www.Malwarebytes.org/

    Run the malware removal tool from Microsoft

    Start - type in the search box-> find MRT top - right on - click RUN AS ADMIN.

    You should get this tool and its updates via Windows updates - if necessary, you can
    Download it here.

    Download - SAVE - go to where you put it-right on - click RUN AS ADMIN
    (Then run MRT as shown above.)

    Microsoft Malicious - 32-bit removal tool
    http://www.Microsoft.com/downloads/details.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

    Microsoft Malicious removal tool - 64 bit
    http://www.Microsoft.com/downloads/details.aspx?FamilyId=585D2BDE-367F-495e-94E7-6349F4EFFC74&displaylang=en

    also install Prevx to be sure that it is all gone.

    Download - SAVE - go to where you put it-right on - click RUN AS ADMIN

    Prevx - Home - free - small, fast, exceptional CLOUD protection, working with others
    security programs. It is a single scanner, VERY EFFICIENT, if it finds something to come back
    here or use Google to see how to remove.
    http://www.prevx.com/   <-->
    http://info.prevx.com/downloadcsi.asp  <-->

    Choice of PCmag editor - Prevx-
    http://www.PCMag.com/Article2/0, 2817,2346862,00.asp

    Try the demo version of Hitman Pro:

    Hitman Pro is a second scanner reviews, designed to save your computer from malicious software
    (viruses, Trojans, rootkits, etc.). who infected your computer despite safe
    what you have done (such as antivirus, firewall, etc.).
    http://www.SurfRight.nl/en/hitmanpro

    --------------------------------------------------------

    If necessary here are some free online scanners to help the

    http://www.eset.com/onlinescan/

    New Vista and Windows 7 version
    http://OneCare.live.com/site/en-us/Center/whatsnew.htm

    Original version
    http://OneCare.live.com/site/en-us/default.htm

    http://www.Kaspersky.com/virusscanner

    Other tests free online
    http://www.Google.com/search?hl=en&source=HP&q=antivirus+free+online+scan&AQ=f&OQ=&AQI=G1

    --------------------------------------------------------

    After the removal of malicious programs:

    Also follow these steps for the General corruption of cleaning and repair/replace damaged/missing
    system files.

    Start - type this in the search box-> find COMMAND at the top and RIGHT CLICK – RUN AS ADMIN

    Enter this at the command prompt - sfc/scannow

    How to fix the system files of Windows 7 with the System File Checker
    http://www.SevenForums.com/tutorials/1538-SFC-SCANNOW-Command-System-File-Checker.html

    How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program
    generates in Windows Vista cbs.log
    http://support.Microsoft.com/kb/928228

    Also run CheckDisk, so we cannot exclude as much as possible of the corruption.

    How to run check disk in Windows 7
    http://www.SevenForums.com/tutorials/433-disk-check.html

    -----------------------------------------------------------------------

    If we find Rootkits use this thread and other suggestions. (Run UnHackMe)

    http://social.answers.Microsoft.com/forums/en-us/InternetExplorer/thread/a8f665f0-C793-441A-a5b9-54b7e1e7a5a4/

    ======================================

    If necessary AFTER THAT you are sure that the machine is clean of any malware.

    How to do a repair installation to repair Windows 7
    http://www.SevenForums.com/tutorials/3413-repair-install.html

    I hope this helps.

    Rob Brown - MS MVP - Windows Desktop Experience: Bike - Mark Twain said it right.

  • removal of csrss.exe

    I need to get rid of this Trojan horse virus csrss.exe, whatever it is? My teacher helped me to find it but now its place to get rid of him. I desperately need my computer back as soon as possible. I'm behind on my homework. Can someone help me please? IM on a different computer now, but it's been nearly a week since mine acted as terrible. I have to run it in safe mode only practically do anything about it. Im running windows 7

    Please download the free version of Malwarebytes.
    Update immediately.
    Do a full scan of the system
    Let us know the results at the end.

    http://www.Malwarebytes.org/products

  • General questions about errors in eventvwr

    Greetings.

    I have a general question about some failed modules are stored in the Windows Event Viewer.

    An error leading to the crashes some applications that I've seen several times now when supporting computer problems is something like this:
    (Windows error reporting) Fault bucket, Type 0, name of the event: PCA2, (...) P1: application.exe, (...)

    I wonder what this 'PCA2. Which is a kind of module Windows handles tasks such as allocating memory or smth. Like this? What could be the cause of these errors (physical memory problems / corrupt swap file / insufficient rights?)

    Same Question for the application falls down because of "kernelbase.dll" as in:
    (Application error) Failing application: application.exe, Version: 0.0.0.0, (...) Failed module: KERNELBASE.dll, Version: 6.1.7601.18015, (...) Path of the failing module: C:\Windows\syswow64\KERNELBASE.dll (...)

    What is the .dll file and what could possibly cause kernelbase.dll Fault?

    The application can be a bit buggy, but I wonder what could possibly cause these accidents and if there is a way to fix these problems - or what dev did wrong.

    The two errors occur mainly on x 64 systems - especially Windows 7/vista

    Kind regards

    With application errors, the application is called everything first and the module he collaborated with is named second. Normally you should try to reinstall the application if you see not to repeat the mistakes. If this does not work, you go to the forum on the application to see if other users see the same error. There may be a bug in the application.

    The observer of the Application event log contains Information reports (event ID: 1001) for errors where the details were sent to Microsoft for review. You will find that there are corresponding to the event ID: 1000 reports errors, either in the system or Application logs. These reports are also included in the center of the Action. Center type action in the area of research above the Start button and press ENTER. Click on the arrow pointing downwards to the right of Maintenance, and then click view reliability history. The errors reported are the Red orbs with a white cross. You can search for solutions to problems, but occasionally you get a significant response from Microsoft.

    I can't tell you what it means PCA2. Google did not find a significant result. The reports themselves are not unintelligible, although I have never tried to understand the meaning of a particular report. I have extracted what, in my view, is a starting point of two reports:
    Event name: PCA2 = P1: motherboard_utility_onoffchargesetup.exe P2: 4.65.0.0

    Event name: PCA2 = P1: setup.exe P2: 11.0.0.28844

    You have the app in the boredom and the version of the file. These details have been extracted a file of information system to a computer with a card mother Gigabyte. So, you see I have a starting point, if I wanted to determine the cause of a failure.

    I will say before you go dive deep into each event ID: 1001 report that many are not easy to even begin to understand. However, they can provide useful clues.

    KERNELBASE.dll is likely to be the module with which the application works. You need to focus on the application.  KERNELBASE is probably preceded by P3 or P4 in the report?

    General remarks on the event viewer:
    http://www.gerryscomputertips.co.UK/syserrors5.htm

  • Received a call of 'Microsoft Partner' £100 to fix the virus csrss.exe eager...

    I received a call from Aishaz Tech informing me, I got the "csrss.exe"virus and that they could solve the problem for me for £100, which is the cost of the "Microsoft Tools" necessary to solve the problem.  They said that I not able to repair myself, nor anyone else would have had none of these tools and they are a Microsoft partner.  I run MS Windows 7 Home Preimium.  I didn't even notice that I had a problem.  There is only one version of crss.exe in the running task manager (although I can't open the file location) and I have had no other problems such as unexpected POPs Windows that other people with this virus are complaining about.

    How can I know that this is not just a scam to get 100 pounds of me?
    How can I know that I even the virus?
    How do they know I have the virus and where they got my phone number from?
    Is it also true that not even reformat the HARD drive and reinstall all the software from scratch can solve the problem?

    They asked me to use "Teamviewer" free software to enable them to take on my screen, showing me the 'evidence' that I got the virus csrss.exe by:
    (1) running msconfig and showing me that much Microsoft services in the Service tab have the status 'arrested '.  They said all Microsoft services in the Service tab are essential and must always be running - is this true?
    (2) they ran regedit and viewd under HKEY_LOCAL_MACHINE SAFETY record, for which the data column says (value not set) and told me that it meant my anti-virus did not work (I use AVG Free, who says he runs and certainly seems to be analyzes all incoming e-mails).  Nobody knows what the data column should be in it?
    (3) they then looked at what is called prefetch, showed me loads of entries with numbers and no names of recognizable program or file which said, contained the virus.
    4 BACK), they ran a tree, sending loads of country names and other information too fast to read the screen, followed a sentence saying your antivirus software is out of date or does not work and an urgent need to be updated.  But I keep my AVG anti-virus updated software automatically.
    I don't know what to do and I am really worried about what they could do with my computer while they were back online.  Someone at - it good suggestions please?

    I don't know if Microsoft would take interest because they have themselves identified (many claim come / working on behalf of Microsoft/Windows).

    Your main course would be your local trading standards office find a letter enough to follow through is going to be extremely lucky.

    The Police has a role through the Central cybercrime Police Unit (info here, puts it's national) Although the report must be done locally and the same COMPUTER literacy issue may arise as to Trading Standards. Perhaps mention the group could wake up a local Plod that they should actually do something, but that you have not paid what was then a crime took place?

    PS as you have no evidence as such a problem of recovery is far away still.

Maybe you are looking for