Sign in with
Sign up | Sign in
Your question

csrss.exe

Last response: in Windows 95/98/ME
Share
Anonymous
August 6, 2005 8:45:51 AM

Archived from groups: microsoft.public.windowsme.general (More info?)

On startup of computer i am getting the following message "Csrss has caused
an error in KERNEL32.DLL. Csrss will now close". And a McAfee Virus Scan
message-"A suspicious Script has been detected. The file
"C:\WINDOWS\SYSTEM\zwcitkni\csrss.exe contains suspicious scripting and has
been stopped". CTRL+ALT+DEL showing programs running has "Winoldap" open 28
times. The Ultimate Troubleshooter shows under tasks running 28 of -
C:\WINDOWS\SYSTEM\WINOA386.MOD and in the information window says"You
currently have an MS-DOS session open" All this is as I said is just after
the computer has been turned on and no other programs opened. Can anyone tell
me what is happening here and what I should do?
Cheers, Biss

More about : csrss exe

Anonymous
August 6, 2005 2:57:59 PM

Archived from groups: microsoft.public.windowsme.general (More info?)

From: "Biss" <Biss@discussions.microsoft.com>

| On startup of computer i am getting the following message "Csrss has caused
| an error in KERNEL32.DLL. Csrss will now close". And a McAfee Virus Scan
| message-"A suspicious Script has been detected. The file
| "C:\WINDOWS\SYSTEM\zwcitkni\csrss.exe contains suspicious scripting and has
| been stopped". CTRL+ALT+DEL showing programs running has "Winoldap" open 28
| times. The Ultimate Troubleshooter shows under tasks running 28 of -
| C:\WINDOWS\SYSTEM\WINOA386.MOD and in the information window says"You
| currently have an MS-DOS session open" All this is as I said is just after
| the computer has been turned on and no other programs opened. Can anyone tell
| me what is happening here and what I should do?
| Cheers, Biss

CSRSS.EXE is a WinNT type file not Win9x/ME and that named file if found on a Win9x/ME PC is
indicative of being infected.

You can use the following tool to scan your computer and hopefully remove the infector. It
may be non-viral malware and if the below tool doesn't help, I then suggest downloading,
installing and updating Ad-aware SE v1.06 and SpyBot Search and Destroy v1.4.


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart scripts, one Link
(.LNK) file, this PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE. It will
simplify the process of using; Sophos, Trend and McAfee Anti Virus Command Line Scanners to
remove
viruses and various other malware.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode. This
way all the components can be downloaded from each AV vendor’s web site.
The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
Anonymous
August 6, 2005 5:24:20 PM

Archived from groups: microsoft.public.windowsme.general (More info?)

Boot to Safe Mode and run a full system scan of all files using updated
anti-virus.

--
Noel Paton (MS-MVP 2002-2005, Windows)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"Biss" <Biss@discussions.microsoft.com> wrote in message
news:F8D68B6B-99B5-455B-B0C4-A004623488FC@microsoft.com...
> On startup of computer i am getting the following message "Csrss has
> caused
> an error in KERNEL32.DLL. Csrss will now close". And a McAfee Virus Scan
> message-"A suspicious Script has been detected. The file
> "C:\WINDOWS\SYSTEM\zwcitkni\csrss.exe contains suspicious scripting and
> has
> been stopped". CTRL+ALT+DEL showing programs running has "Winoldap" open
> 28
> times. The Ultimate Troubleshooter shows under tasks running 28 of -
> C:\WINDOWS\SYSTEM\WINOA386.MOD and in the information window says"You
> currently have an MS-DOS session open" All this is as I said is just after
> the computer has been turned on and no other programs opened. Can anyone
> tell
> me what is happening here and what I should do?
> Cheers, Biss
Related resources
Anonymous
August 9, 2005 8:16:07 AM

Archived from groups: microsoft.public.windowsme.general (More info?)

Dave,
Downloaded the tool and ran it in safe mode - came up with 2 w32/Generic.m
viruses. Thank you for your help.
Cheers , biss

"David H. Lipman" wrote:

> From: "Biss" <Biss@discussions.microsoft.com>
>
> | On startup of computer i am getting the following message "Csrss has caused
> | an error in KERNEL32.DLL. Csrss will now close". >
> CSRSS.EXE is a WinNT type file not Win9x/ME and that named file if found on a Win9x/ME PC is
> indicative of being infected.
>
> You can use the following tool to scan your computer and hopefully remove the infector. It
> may be non-viral malware and if the below tool doesn't help, I then suggest downloading,
> installing and updating Ad-aware SE v1.06 and SpyBot Search and Destroy v1.4.
>
>
> Download MULTI_AV.EXE from the URL --
> http://www.ik-cs.com/programs/virtools/Multi_AV.exe
>
> It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
> http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart scripts, one Link
> (.LNK) file, this PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE. It will
> simplify the process of using; Sophos, Trend and McAfee Anti Virus Command Line Scanners to
> remove
> viruses and various other malware.
>
> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> This will bring up the initial menu of choices and should be executed in Normal Mode. This
> way all the components can be downloaded from each AV vendor’s web site.
> The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.
>
> You can choose to go to each menu item and just download the needed files or you can
> download the files and perform a scan in Normal Mode. Once you have downloaded the files
> needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
> during boot] and re-run the menu again and choose which scanner you want to run in Safe
> Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.
>
> When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
> file.
>
> To use this utility, perform the following...
> Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> Choose; Unzip
> Choose; Close
>
> Execute; C:\AV-CLS\StartMenu.BAT
> { or Double-click on 'Start Menu' in C:\AV-CLS }
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
> FireWall to allow it to download the needed AV vendor related files.
>
> * * * Please report back your results * * *
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
>
Anonymous
August 10, 2005 5:49:07 PM

Archived from groups: microsoft.public.windowsme.general (More info?)

David:
Thank you for providing that link.
It is so much easier to handle than your previous versions.
And works like a charm.
Keep up the good effort.

Harry.


"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:%23mos9cpmFHA.2920@TK2MSFTNGP14.phx.gbl...
> From: "Biss" <Biss@discussions.microsoft.com>
>
> | On startup of computer i am getting the following message "Csrss has
caused
> | an error in KERNEL32.DLL. Csrss will now close". And a McAfee Virus Scan
> | message-"A suspicious Script has been detected. The file
> | "C:\WINDOWS\SYSTEM\zwcitkni\csrss.exe contains suspicious scripting and
has
> | been stopped". CTRL+ALT+DEL showing programs running has "Winoldap" open
28
> | times. The Ultimate Troubleshooter shows under tasks running 28 of -
> | C:\WINDOWS\SYSTEM\WINOA386.MOD and in the information window says"You
> | currently have an MS-DOS session open" All this is as I said is just
after
> | the computer has been turned on and no other programs opened. Can anyone
tell
> | me what is happening here and what I should do?
> | Cheers, Biss
>
> CSRSS.EXE is a WinNT type file not Win9x/ME and that named file if found
on a Win9x/ME PC is
> indicative of being infected.
>
> You can use the following tool to scan your computer and hopefully remove
the infector. It
> may be non-viral malware and if the below tool doesn't help, I then
suggest downloading,
> installing and updating Ad-aware SE v1.06 and SpyBot Search and Destroy
v1.4.
>
>
> Download MULTI_AV.EXE from the URL --
> http://www.ik-cs.com/programs/virtools/Multi_AV.exe
>
> It is a self-extracting ZIP file that contains the Kixtart Script
Interpreter {
> http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart
scripts, one Link
> (.LNK) file, this PDF instruction file and two utilities; UNZIP.EXE and
WGET.EXE. It will
> simplify the process of using; Sophos, Trend and McAfee Anti Virus
Command Line Scanners to
> remove
> viruses and various other malware.
>
> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> This will bring up the initial menu of choices and should be executed in
Normal Mode. This
> way all the components can be downloaded from each AV vendor's web site.
> The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.
>
> You can choose to go to each menu item and just download the needed files
or you can
> download the files and perform a scan in Normal Mode. Once you have
downloaded the files
> needed for each scanner you want to use, you should reboot the PC into
Safe Mode [F8 key
> during boot] and re-run the menu again and choose which scanner you want
to run in Safe
> Mode. It is suggested to run the scanners in both Safe Mode and Normal
Mode.
>
> When the menu is displayed hitting 'H' or 'h' will bring up a more
comprehensive PDF help
> file.
>
> To use this utility, perform the following...
> Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> Choose; Unzip
> Choose; Close
>
> Execute; C:\AV-CLS\StartMenu.BAT
> { or Double-click on 'Start Menu' in C:\AV-CLS }
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to
go through your
> FireWall to allow it to download the needed AV vendor related files.
>
> * * * Please report back your results * * *
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
Anonymous
August 10, 2005 7:20:51 PM

Archived from groups: microsoft.public.windowsme.general (More info?)

From: "webster72n" <hbethke@copper.net>

|
| David:
| Thank you for providing that link.
| It is so much easier to handle than your previous versions.
| And works like a charm.
| Keep up the good effort.
|
| Harry.


Thanx Harry !

The whole idea has been to apply user feedback as much as possible to make an effective, yet
simple, front end to anti virus tools. The Multi AV scanner front end tool is the
culmination of those efforts. It has the added benefit of the Sophos scanner which I have
not used in previous tools.

All feedback of course will be graciously accepted and applied as needed.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
!