Steps to Remove csrcs.exe or csrsc.exe Virus
This was the error message faced by one of our readers that when he boots the PC up, the CSRCS.exe error message comes up on the screen.
csrsc.exe is a process which is registered as W32.Spybot.CF Virus. DO NOT confuse it with csrss.exe which is an important file used by Windows. The attackers of this virus can access our computer and gain access to some important data remotely.
Steps to remove this virus:
1. Scan the system with a good and updated Anti Virus.
2. Open Task Manager, locate this exe (csrcs.exe or csrsc.exe but not csrss.exe), and kill the process.
3. Now type msconfig in the Run box, and then go to startup tab.
4. Locate this exe file, if any, and then remove it from there as well.
5. Now search the file in the C: drive.
6. Permanently delete the file (csrcs.exe or csrsc.exe only) from the computer.
7. Reboot the PC for changes to take place.
UPDATE
After doing the above steps, you need to clean the registry as well.
- Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\
- On the right side, there is a key named “Shell”, it may be having a value “explorer.exe csrcs.exe”. Just modify it to delete the csrcs.exe from it (not explorer.exe). Restart the computer
The virus should have gone.
You May Also Like to Read
- Remove Songs.exe or Khatarnak.exe Virus
- Remove W32.Gammima and W32.Gammima.AG Virus
- Steps to Remove MIRC Virus
- Remove Sysdate.exe Virus
- Process Information: What is csrss.exe?
- [Solved] Windows cannot find regsvr.exe
- Remove W32/Sality Virus
- [Solved] Error 1606: Could not access network location 0\
- Remove mwau.exe Virus
- Steps to Remove Windows Security Suite
February 14th, 2009 at 4:55 pm
How to Permanently delete the file (csrcs.exe or csrsc.exe only) from the computer.
February 15th, 2009 at 12:30 am
just locate the file and shift+delete it
February 15th, 2009 at 2:43 pm
hello friend,
i can’t locate this bug because this bug is hidden and not shown in “C:\WINDOWS\system32\csrcs.exe” directory.
also i try in command promp to fix this bug but error massage is shown “can’t find this file or directory”, but i still have problem my avg anti-virus don’t work but its firewall shown me “csrcs.exe” try to communicate with remote location in your network.
plz help me.
February 15th, 2009 at 2:49 pm
to see the hidden virus, go to Tools-> Folder Options-> View-> unckeck the Hide Protected Operating System Files and also check Show Hidden Files and Folders.
February 25th, 2009 at 1:40 pm
This solution is not working in my pc even i don’t find the file any where but getting the same error at start up,also check the registery valu dont find it.
March 20th, 2009 at 4:17 pm
simply scan the file name from registery and delete it
it will appear in the registry as explorer.exe csrcs.exe
delete the csrcs.exe
April 22nd, 2009 at 10:38 pm
can u olease help me. when i turn my computer on, an error message appears as “csrcs.exe file not found run search to find it”. how to rectify this problem
May 14th, 2009 at 11:18 am
People are smart, that file is not there (filesystem).
I have to delete all entries from registry and its gone !
(i hope)
May 15th, 2009 at 1:18 pm
just do this step other step wil not work
The error seems to be because some Antivirus has cleared your Virus program but did not remove the entries from the registries.
Follow these steps:
1) Backup the registry (Take care on editing registry coz u r solely responsible for any disasters)
2) Check out the following path for the entries of csrcs.exe and delete the entries containing csrcs.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\RunOnce
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Runonce
3) Check out this entry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
Here you will find a Key with the name “Shell” Check whether the value of this key is something like “explorer.exe csrcs.exe” If it is so then u need to modify the value by removing “csrcs.exe” alone. Note donot delete the “explorer.exe” or delete the entire key
4) Restart your system
Hope this will solve ur issue.
May 16th, 2009 at 2:28 pm
Thanks for the info!
May 18th, 2009 at 9:47 am
>even if the folders are not hidden still can’t find WINDOWS/system32/csrsc.exe
> also even I end proccess of it on task manager it keeps on apearing
> regstry edit (shell) has only explorer.exe
> BUT a pop up keeps on occuring as i boot my pc stating “windows not working properly etc.” followd by the shield reporting csrsc.exe problem
>tnx in advance
July 22nd, 2009 at 1:00 pm
Thanks for the solution…
It works…
July 28th, 2009 at 9:22 am
you could also try searching for csrsc.exe in the registry, specifically under HKEY_LOCAL_MACHINE. i found an entry under SYSTEM\ControlSet001\Services\WinSpoolSvc executing the already deleted/missing program csrsc.exe which caused a repeated explorer.exe error which eventually hang-up my system.
August 17th, 2009 at 3:01 am
posporo, u can try remove it from the explore policies, thats where it make it keep poping up at windows start up.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explore\Run
notice on ur right panel there is an entry name csrcs.exe, remove it n u will b fine.
August 29th, 2009 at 8:59 am
I’ve searched “csrcs.exe” in the registry, but I didn’t found it.
The error message was so annoying when my windows startup (after removing the file). Any tweaker utilities didn’t help to away the message.
This help so helpful, thanks. Editing the registry was help me to away the annoying message.
August 29th, 2009 at 9:10 pm
Hi guys,
Just followed Suhas’ advice and the problem gone. Wish you good luck as well.
August 31st, 2009 at 4:09 am
Hi, guys. Useful tip. Thanks. Worked well:)
September 1st, 2009 at 5:17 am
hi i just follow last suhas advice and the problem gone..thnx
September 19th, 2009 at 6:49 pm
Thank you… you saved my life!
September 27th, 2009 at 8:35 am
When I boot my computer I get a message on my computer “csrcs.exe not found.” What does it mean? What should I do to remove this?
September 28th, 2009 at 6:54 am
hi,my computer cpu is throttling to 100% even there were no programs on (idle) and if i open any program, the process too slow. after using process explorer, i found that csrcs.exe was causing the cpu loading. after i kill the process then everything back to normal. i will try the solution u guys given.thanks
October 6th, 2009 at 4:38 pm
You Guys R The Greatest It Solve my 2 Months headache……Love u 4 the info
October 8th, 2009 at 7:00 am
it works. thank’s
greeting from Indonesia. Gbu.
October 11th, 2009 at 7:46 am
Thanks.. it works fine.. csrsc.exe is completely and permanently removed from my laptop.
October 14th, 2009 at 6:41 am
Already solved the problem. Thanks guys.
October 21st, 2009 at 9:49 pm
I went crazy trying to solve this “csrcs.exe” thing. In every boot the system didnt load exploer.exe so i had to ctrl+alt+del and execute explorer.exe myself in order to start windows. Finally I managed to solve it searching in the registry and blocking registry changes with spybotS&D. It was ok until I plugged in my usb flash storage device, then the mess came back. Now I’ve inmnized the pendrive with panda usb vaccine and everything seems to be ok. So, be careful with pen drives, make sure they are clean.
October 24th, 2009 at 10:04 am
rapas velho
muito obrigado pela ajuda
eu nao aguentava mais
esse virus maldito chamado
csrcs.exe
valeu mesmo!!!
October 27th, 2009 at 2:48 pm
nice news…thank guy
November 5th, 2009 at 5:09 am
It worked. Thanks!
November 15th, 2009 at 3:17 pm
Thanks so much. It works!
November 30th, 2009 at 7:09 am
terima kasih banyak(thank you very much) mr.suhas.
3) Check out this entry
i follow this parts (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
Here you will find a Key with the name “Shell” Check whether the value of this key is something like “explorer.exe csrcs.exe” If it is so then u need to modify the value by removing “csrcs.exe” alone. Note donot delete the “explorer.exe” or delete the entire key
4) Restart your system
Hope this will solve ur issue.)
and it works. (^^)v
December 1st, 2009 at 1:37 pm
thanks…a lot. the virus is spreading around my university…
December 4th, 2009 at 2:04 am
my antivirus deleted the Csrcs.exe file and now i cannot delete it because its gone
. Does any1 know what i must do ? i am sick of that dumb start up error
December 30th, 2009 at 7:09 pm
This was very helpful and worked a treat. Although I did have some problems finding the registry, never having been there before. Then found the vital missing clue, type regedit in the run field… this is worded for even the most non-techy of us… thanks
January 3rd, 2010 at 8:17 pm
I have this process on my pc. I can’t find the file csrcs.exe in C:. Antivirus and spybot didn’t find anything. Any solutions? Thanks
January 4th, 2010 at 6:38 pm
can u please help me. when i turn my computer on, an error message appears as
could not load or run ‘c:\windows\system32\KHATRA.exe’ specified in the registry.
make sure the file exists on your computer or remove the reference to it in the registry.how to correct this problem.
January 14th, 2010 at 9:11 pm
This is the message i get every time at startup, “windows cannot find ‘csrcs.exe’ Make sure you typed the name correctly” what should i do???
January 14th, 2010 at 9:13 pm
Download X-RayPC.. It will show the list of all the programs and processes running on your system,
You can use X-rayPc app to kill the process and permenantly delete the corresponding file.
January 14th, 2010 at 9:16 pm
i have tried everything you guys said, but the file is no where to be found…What to do next??
January 19th, 2010 at 10:35 am
Hello!
I had the above problem on my laptop. Thanks to the guidelines that I could remove it safely.
Then my desktop also had the same problem, but with this rundll thing..which was “Cannot find rundll.exe” error. It was showing “rundll.exe”
It was showing “rundll.exe” instead of “rundll32.exe”.
I spent a hell of time to find the cause and then saw that the note was showing “rundll.exe” which is a ab-normal file!!
Promptly I went to the regedit and to the same path: -
“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\”
as showed above and found in the shell value, it was showing “explorer.exe rundll.exe”.
Removed that rundll.exe and then wow!!
My desktop starts without the error!!
Now one more problem remains. My PC asks everytime for the programme to be used to open HDDs.
I hope that I will get the solution soon for that too.
Thanks and Regards
Dr. Apurva Tamhane
January 26th, 2010 at 2:09 pm
hi all
i just want to know what this file csrcs.exe will do in our system???
February 6th, 2010 at 1:38 am
awesome dude..thx very much
February 6th, 2010 at 12:41 pm
thanks for the tips.
it helped me a lot.
February 10th, 2010 at 2:21 am
MUITO OBRIGADO ESSA DICA RESOLVEU O MEU PROBLEMA DE csrcs.exe
VALEU, VALEU, OBRIGADO!
February 12th, 2010 at 11:38 am
thanks dudz its worked.
February 18th, 2010 at 4:20 am
After doing the above steps, you need to clean the registry as well.
1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\
2. On the right side, there is a key named “Shell”, it may be having a value “explorer.exe csrcs.exe”. Just modify it to delete the csrcs.exe from it (not explorer.exe). Restart the computer
The virus should have gone.
The best way.
February 19th, 2010 at 9:51 am
Not having any luck here at all. Delete, reboot, recheck regedit and it appears all over again. Any tips/ideas?
March 2nd, 2010 at 4:21 pm
Thank you very much
It works!
March 4th, 2010 at 1:58 pm
what is the registry?
where can i find it?
and how to find it?
March 5th, 2010 at 6:00 pm
Hello here i removed the csrcs.exe using Malwarebytes (antimalware tool) + C.O.M.O.D.O antivirus just deep scan with malwarebytes while comodo is turned on and u will get lot of virus pop-ups just click remove… after the full scan is done (takes about 40mins ~ 2hrs) depending on hard disc size and how much crap u got on it xD … anyway after Malwarebytes did its job just click remove with it restart pc and done
Malawarebytes automatically fix registry errors… HF peeps
March 6th, 2010 at 6:10 pm
it really worked!!!!….the registry edit is the key to everything…thanks man…i got no warning on may PC start up anymore…thanks a bunch!!!
March 7th, 2010 at 8:21 am
How to End the process of that “csrss.exe” if it said, it’s in critical process and the task manager can’t end it? what should i do? please help me sir….
March 9th, 2010 at 11:20 am
Hi all,
just follow 2 steps to remove csrcs.exe
1. remove it from system32
a. open cmd and navigate to system32, type dir /a:h csrcs.exe
b. now delete it
2. remove it from regedit
a. find for the 2 enries of csrsc.exe
b. delete the value [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
“csrcs”=”C:\\WINNT\\system32\\csrcs.exe”
c. navigate to [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] and edit the “Shell”=”Explorer.exe csrcs.exe” to “Shell”=”Explorer.exe”
Simple … now reboot your pc and format ur pen drive.