{"id":20134,"date":"2024-06-13T12:01:01","date_gmt":"2024-06-13T12:01:01","guid":{"rendered":"https:\/\/gridinsoft.com\/blogs\/?p=20134"},"modified":"2024-06-13T21:20:40","modified_gmt":"2024-06-13T21:20:40","slug":"csrss-exe-process-troubleshooting","status":"publish","type":"post","link":"https:\/\/gridinsoft.com\/blogs\/csrss-exe-process-troubleshooting\/","title":{"rendered":"Csrss.exe Trojan Virus"},"content":{"rendered":"

Csrss.exe is an important Windows process, which may sometimes consume a lot of system resources and puzzle the users with such behavior. Some people may mistake it for trojan virus and try to terminate it forcefully. So, is csrss.exe dangerous? And how to fix the issues it creates? Let’s find out.<\/p>\n

What is Csrss.exe?<\/h2>\n

Csrss.exe is a legitimate Windows process<\/strong> with the full name of Client Server Runtime Process and is critical to the system. This process is present in all modern Windows versions, and it is not uncommon to notice several instances running back to back. Such a phenomenon is normal and is not considered a sign of viruses. The system runs one upon the startup, and terminating it leads to BSoD<\/a>.<\/p>\n

This process in Windows 7, 8, and 10 is responsible for console programs, shutdown processes, starting another vital process – conhost.exe<\/strong> – and other critical system functions. It uses a few resources in normal mode<\/strong>, so there is no reason to terminate it. It is needed for System shutdown, Virtual DOS Machine (VDM) support and other system functions such as Ctrl+C and Ctrl+Break signal processing, user switching, and mounting and unmounting disks. As a legacy function, csrss.exe is responsible for opening the console window, but only to the extent of launching the conhost.exe process.<\/p>\n

Csrss.exe BSOD – How to Fix?<\/h2>\n

Sometimes, after unsuccessful manipulations with the Csrss.exe file or other system files, the Windows may become unstable or not start. The corruption of important Windows system files can cause this. The solution is as follows:<\/p>\n

Go to the Troubleshooting menu<\/strong> – Advanced Options<\/strong> – Command Prompt<\/strong> in the recovery environment. At the command prompt that launches, execute the following command:<\/p>\n

sfc \/scannow \/offbootdir=C:\\ \/offwindir=C:\\Windows<\/code><\/p>\n

After entering the command, press Enter and wait for the process to complete. This may take some time, but be sure to wait until the end, as it is required to finish the system files’ repair. After that, close the command prompt and restart your computer.<\/p>\n

\"Sfc
Sfc command result<\/figcaption><\/figure>\n

Analysis a Real Trojan Virus<\/h2>\n

We found several samples of Csrss.exe as Trojan Virus.<\/p>\n

They can be downloaded from the Internet by the users themselves. Often when users open unknown files from the spam message, they infect the computer with different kinds of virus-like malware. But the malware developer usually has a plan B. They attach similar viruses to installing various free programs. Hence, if you skip the installation process and don’t look to the advantage setting, then ready that your computer will be infected with a virus-like this.<\/p>\n

We discovered a sample of Trojan.CoinMiner written in Delphi, which is distributed via spam mail:<\/p>\n

\"Trojan<\/a><\/p>\n

GridinSoft Anti-Malware detect it as “Trojan.Win32.CoinMiner.dd”<\/p>\n

MD5<\/strong>: 922e0891ae30ac3adb3a09cb963570cc
\nSHA1<\/strong>: 77feeefff422519cdb63faa438fea87e5e70882a<\/code><\/p>\n

Other antivirus programs detect Trojan.CoinMiner (csrss.exe) as:<\/p>\n

\n\n\n\n\n\n\n
DrWeb<\/td>\nTrojan.Hosts.6838<\/td>\n<\/tr>\n
Emsisoft<\/td>\nTrojan.Agent.CEQQ (B)<\/td>\n<\/tr>\n
ESET-NOD32<\/td>\na variant of Win64\/BitCoinMiner.AP potentially unsafe<\/td>\n<\/tr>\n
Kaspersky<\/td>\nnot-a-virus:RiskTool.Win64.BitCoinMiner.cev<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Trojan Miner Drop Files:<\/h4>\n

C:\\Windows\\MicrosoftU
\nAuto.bat
\nStart.vbs
\nStart2.vbs
\nHide.bat
\nStart.bat
\nStart2.bat
\n1.bat
\n2.bat
\nSrvany.exe
\nCsrss.exe
\nSrvanyx.exe<\/code><\/p>\n

After Trojan.CoinMiner has been unpacked. It hides its presence using the strings in Hide.bat, setting the hidden and system attributes to the folder and files.<\/p>\n

Attrib C:\\Windows\\MicrosoftU + S + H \/ S \/ D
\nAttrib C:\\Windows\\MicrosoftU\\*. * + S + H \/ S \/ D<\/code><\/p>\n

Trojan Miner uses the name of one of the system files “csrss.exe<\/strong>” to hide its presence in the system.<\/p>\n

Csrss.exe virus starts with the following parameters:<\/p>\n