lost my csrss.exe ??

[ChrisR]

I picked up some trojans etc from a torrent site. I think I've cleared everything, using a Superspyware prog, but a remaining prob is that I sometimes get the message

c:\windows\csrss.exe can't be found
Though Search finds:

WHat should I do?

Should I be looking harder for malware?
I have the MS thing and an old Norton utility. SPose I need to spend some money on something better.

 

[Igorian]

You could try this. We all seem to like it here.

 

[ChrisR]

Thanks Ig
It found a couple of thousand "errors" of course, mostly cookies , file associations etc. Nothing I could see as nasty but ...
Nothing it would fix free, either!.
ANything particular I should be looking for?

 

[Igorian]

You're probably good to go then. Malbytes is pretty good and the free version will allow any nasties to be removed.

 

[dave.m]

Nothing it would fix free, either!.

Chris,

Are you sure you actually got Malwarebytes because it is not one of these scam programs that finds thousands of problems but charges to remove them.

Either a quick or a full scan will produce a list and MBAM will then offer the option to tick them all and it will remove them for free.
I'll get nicknamed the wallpaper kid for pasting these instructions so often, but follow them because the csrss in system 32 is a genuine windows file but there is a virus that hides under the csrss name elsewhere on your computer.

1st thing to do is clear out all your temporary files, tool of choice is ATF Cleaner , it is free and you do not have to install it. Download and instructions here:
ATF CLEANER
Leave your Paswords unticked if you want to keep them on your computer.

Download MalwareBytes' AntiMalware aka MBAM, it too is free, FROM HERE, click the blue download button on the left of the page and save the file to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to the following:

o Update Malwarebytes' Anti-Malware
o Launch Malwarebytes' Anti-Malware

* Then click Finish .
· If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Full scan , then click Scan.
* When the scan is complete, click OK , then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected .
* When completed, a log will open in Notepad. Reboot as required.


dave

 

[ChrisR]

Thanks for that.
Not sure if it was the same program or not.
ANyway, a bunch of stuff now "quarantined or removed".
I feel much better!

Hmm... if it's been "quarantined" will it get found again if I do another scan?
I'll try it.

ot about that missinf file?
SHould I copy it into the directory it's being sought in, from another?

ANother thing I've seen in the last couple of days is notices about a "Proxy Desktop", like it's "Not Responding".
SHould I have one of those?

 

[dave.m]

Hmm... if it's been "quarantined" will it get found again if I do another scan?
I'll try it.

You should have removed it not quarntined it, It should not show on another scan but if anything does show up it is probably because of a snapshot of it in System Restore and that copy cannot be removed by the scanner.

Regarding the Proxy Desktop, I found this suggestion for stopping it:
http://tinyurl.com/bd4z4g

The missing csrss, will deal with later because I found two or three differing suggestions.

I have the MS thing and an old Norton utility. Suppose I need to spend some money on something better.

No need to spend even one penny on some good security software.
I assume the 'MS thing is Windows Defender, if so keep it.
What old 'Norton Utility' do you have, have you paid a subscription for it?
If the Norton is 2007 or previous, then it is a resource hog and it is worth getting rid of it.
This is the thing to use
Norton Removal Tool
because Norton is a sod for leaving leftovers behind that cause no end of problems with other software.

The first thing to do is have a read here:
NOW! That‘s What I Call Software. 1.
And select one firewall, one antivirus and, if you do have Windows Defender, another non-realtime antispyware program.
I use Comodo Internet Security, firewall and AV combined.
Windows Defender and Spyware Blaster.

Download what you want to use but do not install yet.
Remove Norton using the tool above and then disconnect from the internet.
Install all the new stuff, and connect up to the internet and update each of them.
Let them each run a scan in turn, they may find some things that are on system restore but don't worry.

The next thing is to purge the system restore points.

To remove all SR Points thus removing any contaminated ones:

In XP:
Start -> Control Panel -> Performance & Maint. -> System -> System Restore tab
Tick Turn Off System Restore -> Apply -> OK. Then reboot your computer.
Follow the instructions above but this time untick the Turn Off SR box. No need to reboot this time.
Then set a new Restore Point:
Start -> All Programs -> Accessories -> System Tools -> System Restore -> Create a restore point.
Give it a name and click Next.

In Vista:
Follow these instructions.
Then set a new restore point by following these instructions

I'll get back about the missing csrss file

dave

 

[dave.m]

Chris,
Regarding the csrss entry, this explains what it is:
http://www.liutilities.com/products/wintaskspro/processlibrary/csrrs/
Don't run their free registry scan because you have to pay to remove anything it finds normally.

There is a legit windows file called CSRSS.exe. The legit one ought to be in the Windows\System32 folder


dave

 

[ChrisR]

Good stuff Dave, thanks. I seem to be running smoothly at the mo - I'll go through your suggestions a bit later.