Windows 10: What is CSRSS.exe?

Hello,

Earlier today I was online and my HP notebook started a very loud beeing sound that beeped continuously. A phone number on what appeared to be Microsoft's logos. It looked just like the Microsoft store. I am afraid I did a stupid thing. They wanted remote access to my computer and I allowed it. They ran a bunch of what looked like DOS stuff through the screen. I filmed it on my cell phone because I was already getting nervous about it. I also have still pictures as they entered other information or as I noticed different things. Then they wanted $199.00 to remove CSRSS.EXE. When I said no it was a one time fee of $99.00. THey very quickly wrapped the phone call up and said it would be 30 minutes and the laptop would restart. As I am writing this I can't believe I let them in my laptop. They said it had a CSRSS.EXE Trojan on my laptop and that is what was stealing my information and slowing down the laptop. My laptop has been very slow for the last couple of weeks. I don't know what just happened. First I need to know if this is a real virus/malware/trojan issue and second am I in worse shape because It someone enter my laptop remotely?

:)

 

CSRSS @ c/i386

(dell)

CSRSS @ c/i386

How to get rid of CSRSS virus?

click start..search for csrss and comes out with 5 results:
- CSRSS from C/i386
- CSRSS from c/windows/system32
- csrss and numbers end with hdmp from c/windows/PCHEALTH/ErrorRep/userdumps
- csrss and numbers end with mdmp from c/windows/PCHEALTH/ErrorRep/userdumps
- csrss and numbers end with mdmp from c/windows/PCHEALTH/ErrorRep/userdumps

went to C/ and found a folder called i386 and size of 988mb... open up... full of files... notepads, exe's, picture icon ect...

heres some of the names on the files in the i386 folder:
- sendmail.dll
- WINLOGON
- WSSCRIPT
- DellSys.dll
- AGENTSVR (shows man in suit with black shades and hat as icon)
- (jpeg file) name desktop_screen_shot. as preview on left side show desktop and desert wallpaper and browser open and paintshop open.



Heres some refference for you to help me get rid of this nasty virus:
- TechSpot : Tech Enthusiasts, Power Users, Gamers
- Search



and here is result when scanned with SDfix:

Trojan Files Found:



Could Not Remove C:\csrss.exe
Could Not Remove C:\WINDOWS\lsasss.exe
Could Not Remove C:\WINDOWS\system32\remote.exe
Could Not Remove C:\WINDOWS\system32\windowz.exe
Could Not Remove C:\WINDOWS\system32\winsys.exe
Could Not Remove C:\WINDOWS\system32\winxp.exe

 

CSRSS @ c/i386

alt tab delete... process list comes up.... found says CSRSS.EXE press end process.... popup says:

"this is a critial system process. task manager cannot end this process"

 

CSRSS @ c/i386

CSRSS.EXE - Confusion

Csrss.exe is the Microsoft client server runtime which generates worker threads for client requests. The confusion over csrss.exe comes from Trojans or viruses that use the same executable name (.exe) as that of csrss.

Many spyware/malware programs use filenames of usual, non-malware programs.

The legitimate csrss.exe is part of the Microsoft client server software and is a very important part of the system which should not be removed.

One way to determine if csrss.exe is a legitimate file besides looking at the date modified is to right click on csrss.exe inside Task Manager and attempt to end process. Because csrss is a critical file, Microsoft should inform you with a message that csrss.exe is a critical system process and end it is not possible.

If you do not receive this message when attempting to end the csrss.exe process, then it may indeed be a virus.