By girishrane
May 4, 2006
  1. Hi,

    I downloaded torrent powerISO(stupid me) and installed. It prompted me to reboot. After reboot my sygate firewall detected that csrss.exe is trying to connect to[] using remot port 8163. I got scared out of it man and I blocked it. Now I did complete virus scan using CA's etrust didnt find anything.
    Now wat exactly it is? Is it spyware or trojan? How do I fix it?
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Looks like you`ve got a trojan.

    Go HERE and follow the instructions in the order they are given.

    Post a fresh HJT log, only after doing the above.

    Regards Howard :)
  3. AMDIsTheBest010

    AMDIsTheBest010 TS Rookie Posts: 398

    this may not be a trofan though, Csrss.exe is a windows process I know this b/c I had a sililar problem and I did a complete reformat of my HD and csrss.exe was still there and i checked my othyer systems running XP Home and they all displayed csrss.exe in the task mangers process tab

  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    CSRSS.exe is indeed a Windows process, but it can also be a trojan depending on where it is located.

    Regards Howard :)
  5. girishrane

    girishrane TS Rookie Topic Starter Posts: 27

    Thanks Guys

    It disabled my etrust antivirus then
    I checked with trend micro and CA online for viruses and there were no viruses and Trojans.
    But while doing spyaudit, My Laptop froze and then I had to restart.
    Now Its not restarting at all. It goes in to chkdsk mode but says
    sector [number] unreadable
    sector [number] unreadable (this looks to me strange though)
    and goes on and then gives blue screen saying uninstall recently upgraded HW/SW.
    My Harddrive is brand new and I installed it just 2 weeks back.

    I'm really frustrated now. What would be the best way? reformat?
    I got some really important docs there.

    Is there a possibility that there is some new virus/worm that is killing the hard disk/boot sector?

    Thanks for your help
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    It sounds to me like your hard drive is faulty.

    Doing a format may solve the problem, then again it might not.

    Regards Howard :)
  7. girishrane

    girishrane TS Rookie Topic Starter Posts: 27

    Drive fitness test is showing its healthy !! What are the chaces of windows getting corrupted?

  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    That does happen sometimes.

    Try doing a Windows repair as per this thread HERE.

    If that doesn`t help, then maybe you`re going to have to consider a reformat.

    Regards Howard :)
  9. AMDIsTheBest010

    AMDIsTheBest010 TS Rookie Posts: 398

    I did not know that, thank you howard now if i have another problem i know that it may be a trojan

    thanks for the info
  10. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Trojans etc, can use a variety of names, including some Windows file names. However, they are either not located in the proper directory, or they are in the proper directory, but the spelling is a little different.

    Regards Howard :)
  11. sw123

    sw123 TS Rookie Posts: 595


    I think i may have your problem solved.

    Disclaimer: I am not responsible for any damage done to your machine. If your system breaks down to the point where you cant use it, im not responsible. you may have to reformat your harddrive.

    Boot windows into safe mode. Heres how you do it:

    When you see your boot image, press F8 several times. It will take you to Windows Advanced Startup Options. Choose 'Safe Mode'. It will show a list of system files it loads. This is normal.

    When you have booted into safe mode(if your normal windows doesnt work), press ctrl+alt+del. It brings up windows task manager. Heres the tricky part. Look for "csrss.exe". Next to it, it should say 'SYSTEM' if it says owner or something else, end it.

    Hope this works, but if not, read the disclaimer

    regards, sw123(copying howard lol)
  12. AMDIsTheBest010

    AMDIsTheBest010 TS Rookie Posts: 398

    yes serious damage could be done to ur system since csrss.exe is labeled by windows as a "critical system process" so use EXTREME CAUTION, as he said u may have to reformat that means losing all personal files so weigh the benefits and the risks,if possible back up all documned to another media (CD/DVD, floppy, JumpDrive)
  13. sw123

    sw123 TS Rookie Posts: 595

    Yes back up all your personal data, as AMD said. Also, back up all your drivers for everything(graphics, sound, processor, motherboard, etc.)

    Next time don't download that file next time
  14. girishrane

    girishrane TS Rookie Topic Starter Posts: 27

    Thank you very much guys for your help.
    I’m ready to format the drive but It’s the data that I want to backup desperately. I do have external Hard Drive so that I can back it up.(***** me I should have done that in timely manner)
    when I try to repair after booting by CD it says partition is unformatted or damaged.
    So I’m unable to repair or even install a fresh copy of windows.

    So what would be the next step?IS it possible to repartition and install?
  15. sw123

    sw123 TS Rookie Posts: 595

    Yes its possible. But it seems your trojan is preventing that from happening. If it just wont get off, I would just trash your old hard drive, back up your clean personal data and get a replacment harddive. It almost seems your trojan is impossible to remove. Or, you can try running Norton Anti-Virus 2005. I have it and it detects and removes viruses, and fixes any registry errors also.

    Hope I helped!

  16. altheman

    altheman TS Rookie Posts: 425

    btw, you can check if the csrss.exe running is legit by using this tool from sysinternals: open it up, and look for csrss.exe. double click the process, and check if its digitally verified by m$ in the "image" tab. if it says not verified, then click verify at the bottem.
  17. N3051M

    N3051M TS Evangelist Posts: 2,115

    have you tried to do a low level format? it will wipe all data and partitions off the hdd and make it back to a condition like it just left the factory.... download the utility reletive to your hdd maker then try to repartition and install windows on it...

    three most common ones: ->diskwizard or disk doctor ->powermax ->data lifeguard (cant remember)
  18. girishrane

    girishrane TS Rookie Topic Starter Posts: 27

    Thanks Guys
    This is what I tried.
    I tried to Install WINXP on my external USB drive but it didn’t boot after install and gave me 7B error.
    Then I changed the Bios settings 32 bit block enabled. It worked it booted very slowly and took well long time but it did. I copied important files and reformat it. But now I get SMART failure error. This drive is still in warranty so I’m gonna send this back to Toshiba. But then this is second drive failed in 5 months. I’m just wondering what could be the problem.
  19. sw123

    sw123 TS Rookie Posts: 595

    I think your trojan has infected the real csrss.exe, so I would boot from Windows XP cd and recopy csrss.exe. See what that does.
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...