Malware Information

Question: Is or can csrss.exe be malware?

(Posted by: Gregory O on 2010-03-06 11:17:19)

Can a altered form of this be malware?

Posted by: R on 2010-03-06, 11:26:13

Yes, for example if it is not located in the usual place (C:\Windows\System32\csrss.exe) then that should raise a red flag. Also, if it is named something slightly different from the original name like Csrss.exe or csrsss.exe that is suspicious as well. There is a CSRSS.EXE that is a worm. I would upload it to VirusTotal to check against multiple engines if I were you.

Posted by: zep516 on 2010-03-06, 12:38:06

What is it? csrss.exe - Client/ Server Runtime Server Subsystem What does it do? This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/ server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/ or deleting threads, and some parts of the 16-bit virtual MS-DOS environment. It needs to be in the System 32 folder, anywhere else is a worm. As mentioned above...