Disagree with this determination?
CSRSS.EXE
System Back DoorYour PC is infected. The file called CSRSS.EXE is considered unsafe and there may be other infections on your PC.
You should urgently check your PC and remove any malicious software including CSRSS.EXE as soon as possible. The free version of Prevx 3.0 will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx 3.0.
Associated Malware Groups
The filename is associated with the malware group:
- System Back Door
File Behavior
CSRSS.EXE has been seen to perform the following behavior:
- The Process is packed and/or encrypted using a software packing process
- Can make outbound communication to other computers, IM chat rooms and other services using IRC protocols
- This Process Contains User Mode Rootkit Functionality and can hide itself from the running process list
- Includes file creation code which could be used to test for interception by security products
- Uses DNS to retrieve the IP address for web sites
- Uses your PC to connect to Chat rooms
- Uses reverse DNS to retrieve the host names on IP addresses
- Found on infected systems and resists interrogation by security products
CSRSS.EXE has been the subject of the following behavior:
- Executed as a Process
- Registered as a Dynamic Link Library File
- Created as a new Background Service on the machine
- Created as a process on disk
- Created by processes which appear to be checking for interception by security products
Country Of Origin
The filename CSRSS.EXE was first seen on May 18 2007 in the following geographical regions of the Prevx community:
- The UNITED STATES on May 18 2007
- CANADA on May 18 2007
File Name Aliases
CSRSS.EXE can also use the following file names:
- 21997514.EXE
- ZMEUE.EXE
Filesizes
This file has been seen with the following file size:
- 593,262 bytes
Vendor, Product and Version Information
This file has no vendor, product or version information specified in the file header.
File Type
The filename CSRSS.EXE refers to an executable program.