ok well now for a few weeks when i first log in my pc something starts to run in the backround because ive watched it start up on my task manager its called CRSS.exe i dont know what this is and when i search for it on my computer it brings back no results what could cause this also when this starts up it uses like 50% to 60% of my cpu so i have to end it whenever i have to log in my computer or restart someone please help me soon
Don't be afraid to do a simple google search. I did one for crss.exe and the first link said that it was a worm. You rgoing to want to get an antivirus program or if you have one run a scan to remove the virus.
i found this,but... Are you sure that the process is crss.exe and not csrss.exe? I do not have crss.exe as a process on my machines and have not found much in the way of things on crss.exe online aside from it being a truncated version of csrss.exe. csrss.exe is the Client-Server Runtime Subsystem. This is the user-mode componet of the win32 subsystem. It manages the creation and deletion of threads, console windows, and portions of the virtual DOS environment. You can't end this process from tsk manager, and if you end it another way, windows will become unstable. As far as why it would connect to the net, it shouldn't need to connect to the net except when other processes or applications are connecting to the net (actively) especially IE. This is my understanding of it. If you have any other questions on it, feel free to ask, or if you find anything out about it, post that as well, I'm always up for learning something new. crss - crss.exe - Process Information Process File: crss or crss.exe Process Name: W32.AGOBOT.GH Worm Description: crss.exe is a process which is registered as the W32.AGOBOT.GH worm. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open it’s hostile attachment. The worm has it’s own SMTP engine which means it gathers E-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately. Please see additional details regarding this process
Hi andy25, please post a HijackThis log to here and we'll clean you. Instructions -> http://forums.afterdawn.com/thread_view.cfm/263784 (steps 3-5)
