Steps to Remove csrcs.exe or csrsc.exe Virus

This was the error message faced by one of our readers that when he boots the PC up, the CSRCS.exe error message comes up on the screen.

csrsc.exe is a process which is registered as W32.Spybot.CF Virus. DO NOT confuse it with csrss.exe which is an important file used by Windows. The attackers of this virus can access our computer and gain access to some important data remotely.

Steps to remove this virus:

1.    Scan the system with a good and updated Anti Virus.

2.    Open Task Manager, locate this exe (csrcs.exe or csrsc.exe but not csrss.exe), and kill the process.

3.    Now type msconfig in the Run box, and then go to startup tab.

4.    Locate this exe file, if any, and then remove it from there as well.

5.    Now search the file in the C: drive.

6.    Permanently delete the file (csrcs.exe or csrsc.exe only) from the computer.

7.    Reboot the PC for changes to take place.

UPDATE

After doing the above steps, you need to clean the registry as well.

  1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\
  2. On the right side, there is a key named “Shell”, it may be having a value “explorer.exe csrcs.exe”. Just modify it to delete the csrcs.exe from it (not explorer.exe). Restart the computer

The virus should have gone.

To receive more cool updates like this, join us on Facebook
Tagged with: , , , , ,
Posted in Fixes of problems, Virus, Windows/Windows XP
Enter your email address:
77 comments on “Steps to Remove csrcs.exe or csrsc.exe Virus
  1. linda says:

    it really worked!!!!….the registry edit is the key to everything…thanks man…i got no warning on may PC start up anymore…thanks a bunch!!!

  2. Dan says:

    How to End the process of that “csrss.exe” if it said, it’s in critical process and the task manager can’t end it? what should i do? please help me sir….

  3. Shrish says:

    Hi all,
    just follow 2 steps to remove csrcs.exe
    1. remove it from system32
    a. open cmd and navigate to system32, type dir /a:h csrcs.exe
    b. now delete it
    2. remove it from regedit
    a. find for the 2 enries of csrsc.exe
    b. delete the value [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
    “csrcs”=”C:\\WINNT\\system32\\csrcs.exe”
    c. navigate to [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] and edit the “Shell”=”Explorer.exe csrcs.exe” to “Shell”=”Explorer.exe”

    Simple … now reboot your pc and format ur pen drive.

  4. priyamaalini says:

    Thanks, Very useful and my problem is solved aft editing the regedit.

  5. Roy says:

    thanks for advice to remove csrsc.exe…
    but the problem i can’t finish my scanning with my avira. It’s always scan “c:\windows\system32\drivers\msusbf.sys”.
    i cannot delete it from explorer…

    help me please… …
    thanks

  6. Salsan Jose says:

    To delete Permanently (csrcs.exe or csrsc.exe only) from the computer, just locate the file and shift+delete it.

  7. rAnDzgOnz says:

    Tnx for these Info.

    Anyway gUys, just want to share hOw I remOved this Virus:

    Steps:
    1. Full scanned by SuperAntiSpyware Free Edition then deleted all virus detected.
    2. I go to registry then deleted the word csrcs.exe beside of Explorer.exe to delete the annoying reminder that says ” csrcs.exe not found!” everytime I boot up my pc.
    3. Lastly, reboot! That’s all.!

    Hopefully these steps will be helpful.

    SuperAntiSpyware Rules.! ^j^

  8. Forumadresi says:

    Thank you very successful.Very good text.

  9. lkjlkj says:

    thx very much!!!!

  10. karmrajsinh says:

    if you really want to remove a csrsc.exe just use the hijackthis software and delete the entry of this file…

  11. shreyan says:

    Hi folks,
    I am in a serious trouble.A link came to my skype from a friend mentioning some jpg.when I clicked it its a dos application.Then after my cursor is doing auto work on its own after a particular time interval.Like calling any one of my skype contacts. And it is doing auto work.Plz help me. my antivirus can’t locate it.

  12. shreyan says:

    shreyanbose@gmail.com.. this is my id.. u can write back to me

  13. admin says:

    @shreyan
    try the malicious code removal tool Mbam
    http://www.malwarebytes.org/mbam.php

  14. jermet says:

    tnx i’ve got it!

  15. damian says:

    thank you , it is work :)

  16. Rajat says:

    This really helped

    Thanks!

  17. leo05678 says:

    hi guys,

    i was ale to remove the annoying error message for csrcs missing blah blah blah but after editing on reg edit, all my program file icon turns to generic. is this another virus? need help please!

  18. Riccardo says:

    Shrish
    Thanks a lot!!

  19. Noman'z says:

    tnx bro it helps!!!

  20. daniel says:

    thank you!!

  21. gibson says:

    hey guys? i can’t find the file csrcs.ex in drive C. and i have killed it on the task manager too…so how can i delete in the registry now? im a lil scared to change things there…and also the avira antivirus don’t work too it doesn’t scan…

    anybody can give me a step by step lecture here?…

  22. Mark Anthony says:

    Hey, Thanks alot!!!
    it really did work!

  23. Nick says:

    It worked….I was not able to find csrcs.exe when i did the msconfig or in the c drive search but. I located and killed it in the task manager and in the registry I found it attached to the explore.exe. after removing it from there and rebooting all was well.

    thanks guys!

  24. Francis says:

    I did the magic in the registry.

    Thank alot.

  25. Aleksej says:

    Thanks, deleted csrcs.exe from registry, now is ok.

  26. payam says:

    با سلام
    control panel کامپیوتر من کلا روی سبستم نیست من چکار باید بکنم
    جون هر کاری میکنم پیدا نمیشه لطفا راهنمائی کنید

    با تشکر از شما

  27. saxlkariani says:

    Good Advice, Thank You

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Recommend on Google
Archives