csrss.exe

Archived from groups: microsoft.public.windowsme.general (More info?)

On startup of computer i am getting the following message "Csrss has caused
an error in KERNEL32.DLL. Csrss will now close". And a McAfee Virus Scan
message-"A suspicious Script has been detected. The file
"C:\WINDOWS\SYSTEM\zwcitkni\csrss.exe contains suspicious scripting and has
been stopped". CTRL+ALT+DEL showing programs running has "Winoldap" open 28
times. The Ultimate Troubleshooter shows under tasks running 28 of -
C:\WINDOWS\SYSTEM\WINOA386.MOD and in the information window says"You
currently have an MS-DOS session open" All this is as I said is just after
the computer has been turned on and no other programs opened. Can anyone tell
me what is happening here and what I should do?
Cheers, Biss
5 answers Last reply
More about csrss
  1. Archived from groups: microsoft.public.windowsme.general (More info?)

    From: "Biss" <Biss@discussions.microsoft.com>

    | On startup of computer i am getting the following message "Csrss has caused
    | an error in KERNEL32.DLL. Csrss will now close". And a McAfee Virus Scan
    | message-"A suspicious Script has been detected. The file
    | "C:\WINDOWS\SYSTEM\zwcitkni\csrss.exe contains suspicious scripting and has
    | been stopped". CTRL+ALT+DEL showing programs running has "Winoldap" open 28
    | times. The Ultimate Troubleshooter shows under tasks running 28 of -
    | C:\WINDOWS\SYSTEM\WINOA386.MOD and in the information window says"You
    | currently have an MS-DOS session open" All this is as I said is just after
    | the computer has been turned on and no other programs opened. Can anyone tell
    | me what is happening here and what I should do?
    | Cheers, Biss

    CSRSS.EXE is a WinNT type file not Win9x/ME and that named file if found on a Win9x/ME PC is
    indicative of being infected.

    You can use the following tool to scan your computer and hopefully remove the infector. It
    may be non-viral malware and if the below tool doesn't help, I then suggest downloading,
    installing and updating Ad-aware SE v1.06 and SpyBot Search and Destroy v1.4.


    Download MULTI_AV.EXE from the URL --
    http://www.ik-cs.com/programs/virtools/Multi_AV.exe

    It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
    http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart scripts, one Link
    (.LNK) file, this PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE. It will
    simplify the process of using; Sophos, Trend and McAfee Anti Virus Command Line Scanners to
    remove
    viruses and various other malware.

    C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
    This will bring up the initial menu of choices and should be executed in Normal Mode. This
    way all the components can be downloaded from each AV vendor’s web site.
    The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.

    You can choose to go to each menu item and just download the needed files or you can
    download the files and perform a scan in Normal Mode. Once you have downloaded the files
    needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
    during boot] and re-run the menu again and choose which scanner you want to run in Safe
    Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

    When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
    file.

    To use this utility, perform the following...
    Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
    Choose; Unzip
    Choose; Close

    Execute; C:\AV-CLS\StartMenu.BAT
    { or Double-click on 'Start Menu' in C:\AV-CLS }

    NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
    FireWall to allow it to download the needed AV vendor related files.

    * * * Please report back your results * * *


    --
    Dave
    http://www.claymania.com/removal-trojan-adware.html
    http://www.ik-cs.com/got-a-virus.htm
  2. Archived from groups: microsoft.public.windowsme.general (More info?)

    Boot to Safe Mode and run a full system scan of all files using updated
    anti-virus.

    --
    Noel Paton (MS-MVP 2002-2005, Windows)

    Nil Carborundum Illegitemi
    http://www.btinternet.com/~winnoel/millsrpch.htm

    http://tinyurl.com/6oztj

    Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

    "Biss" <Biss@discussions.microsoft.com> wrote in message
    news:F8D68B6B-99B5-455B-B0C4-A004623488FC@microsoft.com...
    > On startup of computer i am getting the following message "Csrss has
    > caused
    > an error in KERNEL32.DLL. Csrss will now close". And a McAfee Virus Scan
    > message-"A suspicious Script has been detected. The file
    > "C:\WINDOWS\SYSTEM\zwcitkni\csrss.exe contains suspicious scripting and
    > has
    > been stopped". CTRL+ALT+DEL showing programs running has "Winoldap" open
    > 28
    > times. The Ultimate Troubleshooter shows under tasks running 28 of -
    > C:\WINDOWS\SYSTEM\WINOA386.MOD and in the information window says"You
    > currently have an MS-DOS session open" All this is as I said is just after
    > the computer has been turned on and no other programs opened. Can anyone
    > tell
    > me what is happening here and what I should do?
    > Cheers, Biss
  3. Archived from groups: microsoft.public.windowsme.general (More info?)

    Dave,
    Downloaded the tool and ran it in safe mode - came up with 2 w32/Generic.m
    viruses. Thank you for your help.
    Cheers , biss

    "David H. Lipman" wrote:

    > From: "Biss" <Biss@discussions.microsoft.com>
    >
    > | On startup of computer i am getting the following message "Csrss has caused
    > | an error in KERNEL32.DLL. Csrss will now close". >
    > CSRSS.EXE is a WinNT type file not Win9x/ME and that named file if found on a Win9x/ME PC is
    > indicative of being infected.
    >
    > You can use the following tool to scan your computer and hopefully remove the infector. It
    > may be non-viral malware and if the below tool doesn't help, I then suggest downloading,
    > installing and updating Ad-aware SE v1.06 and SpyBot Search and Destroy v1.4.
    >
    >
    > Download MULTI_AV.EXE from the URL --
    > http://www.ik-cs.com/programs/virtools/Multi_AV.exe
    >
    > It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
    > http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart scripts, one Link
    > (.LNK) file, this PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE. It will
    > simplify the process of using; Sophos, Trend and McAfee Anti Virus Command Line Scanners to
    > remove
    > viruses and various other malware.
    >
    > C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
    > This will bring up the initial menu of choices and should be executed in Normal Mode. This
    > way all the components can be downloaded from each AV vendor’s web site.
    > The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.
    >
    > You can choose to go to each menu item and just download the needed files or you can
    > download the files and perform a scan in Normal Mode. Once you have downloaded the files
    > needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
    > during boot] and re-run the menu again and choose which scanner you want to run in Safe
    > Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.
    >
    > When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
    > file.
    >
    > To use this utility, perform the following...
    > Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
    > Choose; Unzip
    > Choose; Close
    >
    > Execute; C:\AV-CLS\StartMenu.BAT
    > { or Double-click on 'Start Menu' in C:\AV-CLS }
    >
    > NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
    > FireWall to allow it to download the needed AV vendor related files.
    >
    > * * * Please report back your results * * *
    >
    >
    > --
    > Dave
    > http://www.claymania.com/removal-trojan-adware.html
    > http://www.ik-cs.com/got-a-virus.htm
    >
    >
    >
  4. Archived from groups: microsoft.public.windowsme.general (More info?)

    David:
    Thank you for providing that link.
    It is so much easier to handle than your previous versions.
    And works like a charm.
    Keep up the good effort.

    Harry.


    "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
    news:%23mos9cpmFHA.2920@TK2MSFTNGP14.phx.gbl...
    > From: "Biss" <Biss@discussions.microsoft.com>
    >
    > | On startup of computer i am getting the following message "Csrss has
    caused
    > | an error in KERNEL32.DLL. Csrss will now close". And a McAfee Virus Scan
    > | message-"A suspicious Script has been detected. The file
    > | "C:\WINDOWS\SYSTEM\zwcitkni\csrss.exe contains suspicious scripting and
    has
    > | been stopped". CTRL+ALT+DEL showing programs running has "Winoldap" open
    28
    > | times. The Ultimate Troubleshooter shows under tasks running 28 of -
    > | C:\WINDOWS\SYSTEM\WINOA386.MOD and in the information window says"You
    > | currently have an MS-DOS session open" All this is as I said is just
    after
    > | the computer has been turned on and no other programs opened. Can anyone
    tell
    > | me what is happening here and what I should do?
    > | Cheers, Biss
    >
    > CSRSS.EXE is a WinNT type file not Win9x/ME and that named file if found
    on a Win9x/ME PC is
    > indicative of being infected.
    >
    > You can use the following tool to scan your computer and hopefully remove
    the infector. It
    > may be non-viral malware and if the below tool doesn't help, I then
    suggest downloading,
    > installing and updating Ad-aware SE v1.06 and SpyBot Search and Destroy
    v1.4.
    >
    >
    > Download MULTI_AV.EXE from the URL --
    > http://www.ik-cs.com/programs/virtools/Multi_AV.exe
    >
    > It is a self-extracting ZIP file that contains the Kixtart Script
    Interpreter {
    > http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart
    scripts, one Link
    > (.LNK) file, this PDF instruction file and two utilities; UNZIP.EXE and
    WGET.EXE. It will
    > simplify the process of using; Sophos, Trend and McAfee Anti Virus
    Command Line Scanners to
    > remove
    > viruses and various other malware.
    >
    > C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
    > This will bring up the initial menu of choices and should be executed in
    Normal Mode. This
    > way all the components can be downloaded from each AV vendor's web site.
    > The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.
    >
    > You can choose to go to each menu item and just download the needed files
    or you can
    > download the files and perform a scan in Normal Mode. Once you have
    downloaded the files
    > needed for each scanner you want to use, you should reboot the PC into
    Safe Mode [F8 key
    > during boot] and re-run the menu again and choose which scanner you want
    to run in Safe
    > Mode. It is suggested to run the scanners in both Safe Mode and Normal
    Mode.
    >
    > When the menu is displayed hitting 'H' or 'h' will bring up a more
    comprehensive PDF help
    > file.
    >
    > To use this utility, perform the following...
    > Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
    > Choose; Unzip
    > Choose; Close
    >
    > Execute; C:\AV-CLS\StartMenu.BAT
    > { or Double-click on 'Start Menu' in C:\AV-CLS }
    >
    > NOTE: You may have to disable your software FireWall or allow WGET.EXE to
    go through your
    > FireWall to allow it to download the needed AV vendor related files.
    >
    > * * * Please report back your results * * *
    >
    >
    > --
    > Dave
    > http://www.claymania.com/removal-trojan-adware.html
    > http://www.ik-cs.com/got-a-virus.htm
    >
    >
  5. Archived from groups: microsoft.public.windowsme.general (More info?)

    From: "webster72n" <hbethke@copper.net>

    |
    | David:
    | Thank you for providing that link.
    | It is so much easier to handle than your previous versions.
    | And works like a charm.
    | Keep up the good effort.
    |
    | Harry.


    Thanx Harry !

    The whole idea has been to apply user feedback as much as possible to make an effective, yet
    simple, front end to anti virus tools. The Multi AV scanner front end tool is the
    culmination of those efforts. It has the added benefit of the Sophos scanner which I have
    not used in previous tools.

    All feedback of course will be graciously accepted and applied as needed.

    --
    Dave
    http://www.claymania.com/removal-trojan-adware.html
    http://www.ik-cs.com/got-a-virus.htm
Ask a new question

Read More

Computers Windows