csrss.exe

[gabrib]

Ciao a tutti.Questa mattina mi sono collegato a internet e sygate mi diceva che csrss.exe voleva andare in rete e visto che è la prima volta che succede volevo sapere a cosa è dovuto grazie.

[juninho85]

Originariamente inviato da gabrib
Ciao a tutti.Questa mattina mi sono collegato a internet e sygate mi diceva che csrss.exe voleva andare in rete e visto che è la prima volta che succede volevo sapere a cosa è dovuto grazie.
eun file di windows,piu info non ti so dare:(

[bluepix]

E' un trojan !!!!!!!

vedi tu quale perchè ha diverse varianti

http://securityresponse.symantec.com/avcenter/venc/data/trojan.gutta.html

http://securityresponse.symantec.com/avcenter/venc/data/trojan.webus.html

http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

http://www.kephyr.com/spywarescanner/library/iceremotespy/index.phtml

[Hal2001]

Non è detto, c'è una componente di Windows NT5.x [Windows2000, XP, 2003] che si chiama così.

[juninho85]

Originariamente inviato da bluepix
E' un trojan !!!!!!!

vedi tu quale perchè ha diverse varianti

http://securityresponse.symantec.com/avcenter/venc/data/trojan.gutta.html

http://securityresponse.symantec.com/avcenter/venc/data/trojan.webus.html

http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

http://www.kephyr.com/spywarescanner/library/iceremotespy/index.phtml
ma quale trojan:asd:

[bluepix]

E' verissimo Hal, però il mio csrss.exe (controllato e targato Microsoft) non chiede di uscire (sontrollato sul firewall McAfee).

[bluepix]

Aggiungo per completezza:

Process File: csrss or csrss.exe
Process Name: Microsoft Client/Server Runtime Server Subsystem

Description:
csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem. This process manages most graphical commands in Windows. This program is important for the stable and secure running of your computer and should not be terminated. Note: csrss.exe is also process which is registered as the W32.Netsky.AB@mm worm, the W32.Webus Trojan, Win32.Ladex.a and more. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open it’s hostile attachment. The worm has it’s own SMTP engine which means it gathers E-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately. Please see additional details regarding this process
:(

[juninho85]

Originariamente inviato da bluepix
Aggiungo per completezza:

Process File: csrss or csrss.exe
Process Name: Microsoft Client/Server Runtime Server Subsystem

Description:
csrss.exe is the main executable for the Microsoft Client/Server Runtime Server Subsystem. This process manages most graphical commands in Windows. This program is important for the stable and secure running of your computer and should not be terminated. Note: csrss.exe is also process which is registered as the W32.Netsky.AB@mm worm, the W32.Webus Trojan, Win32.Ladex.a and more. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open it’s hostile attachment. The worm has it’s own SMTP engine which means it gathers E-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately. Please see additional details regarding this process
:(

se fosse u ntrojan l avrebbe avvisato l AV,ma in questo caso e semplicemente un file service di windows che chiede di accedere alla reta:boh: