Share via

What is CSRSS.exe?

Anonymous
2020-01-29T02:05:08+00:00

Hello,

Earlier today I was online and my HP notebook started a very loud beeing sound that beeped continuously.  A phone number on what appeared to be Microsoft's logos.  It looked just like the Microsoft store.  I am afraid I did a stupid thing.  They wanted remote access to my computer and I allowed it.  They ran a bunch of what looked like DOS stuff through the screen.  I filmed it on my cell phone because I was already getting nervous about it.  I also have still pictures as they entered other information or as I noticed different things.  Then they wanted $199.00 to remove CSRSS.EXE.  When I said no it was a one time fee of $99.00.  THey very quickly wrapped the phone call up and said it would be 30 minutes and the laptop would restart.  As I am writing this I can't believe I let them in my laptop.  They said it had a CSRSS.EXE Trojan on my laptop and that is what was stealing my information and slowing down the laptop. My laptop has been very slow for the last couple of weeks. I don't know what just happened.  First I need to know if this is a real virus/malware/trojan issue and second am I in worse shape because It someone enter my laptop remotely?

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. David Sanchez 19,070 Reputation points Independent Advisor
    2020-01-29T02:40:00+00:00

    Hi Cathe, thanks for posting your question in the community! My name is David an independent advisor and I am here to help you.

    I am very sorry for the situation you have been through, I will do my best to help you know if your PC has been infected and help you.

    To begin, I must clarify that the situation you have presented has been a technical support scam, during the use of your PC a PopUp should have been opened that simulated an official Microsoft support page. Keep in mind that for you to receive direct support from Microsoft, you should always contact them at their official support lines, in no way will they contact you in any other way.

    I am a little worried about what they could have done with the CMD on your PC, so, if you can, send me screenshots of the commands they have executed and of which you have images, this, to determine what processes they executed on your PC .

    Now, referring to the "CSRSS.exe" service, this service natively exists within Windows in "C:\Windows\System32", as you can see in the attached image that I sent to you, this image is from my personal PC, which is free of viruses and malicious software.

    However, it is possible that scammers have installed a service with a similar name on your PC, to do a review against malware and viruses, I recommend using the MSRT (Malicious Software Removal Tool) tool that is official of Microsoft. I give you the explanatory link of the tool and the download links, depending on your Windows in 32 or 64 bits:

    * https://support.microsoft.com/en-us/help/890830... (explanatory link)

    * https://www.microsoft.com/en-us/download/detail... (32-Bits download)

    * https://www.microsoft.com/en-us/download/detail... (64-Bits download)

    Run the tool and perform a thorough analysis, if you do not know the architecture of your PC, you can see it in, Start> Settings> System> About.

    If your PC has been underperforming in recent weeks, we must rule out many things, including malware infections, therefore, I recommend you first perform the virus scan and then follow the instructions in the following link to improve Windows performance https://support.microsoft.com/en-us/help/400201...

    Let me know if the information I have shared with you has been useful or if you still need more help, I am here to help you overcome this problem, I will be waiting for your response.

    Was this answer helpful?

    40+ people found this answer helpful.
    0 comments
  2. Anonymous
    2020-01-29T02:28:38+00:00

    It was a scam.  Run Windows Defender and Malwarebytes.

    Microsoft does not all you or give you a phone number to call unless you asked them to.

    Was this answer helpful?

    10 people found this answer helpful.
    0 comments