Tech Support Forum - View Single Post

tetonbob · 05-25-2008, 07:32 PM

csrss.exe in system32 and system32\dllcache is a legit process. It should be 6,144 bytes on most XP machines.

cssrss.exe is not legit, as grumpygit has pointed out.

There's quite possibly something else on the system alongside...but in addition to deleting the file, you need to remove the loading point(s).

If you require assistance, follow the instructs in the link grumpygit has already provided.

05-25-2008, 07:32 PM	#3 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 39,501 OS: 2000 Pro; XP Pro; XP Home	Re: cssrss creating HQS Trojan at startup csrss.exe in system32 and system32\dllcache is a legit process. It should be 6,144 bytes on most XP machines. cssrss.exe is not legit, as grumpygit has pointed out. There's quite possibly something else on the system alongside...but in addition to deleting the file, you need to remove the loading point(s). If you require assistance, follow the instructs in the link grumpygit has already provided. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009