|
i found this,but...
Are you sure that the process is crss.exe and not
csrss.exe? I do not have crss.exe as a process on my
machines and have not found much in the way of things on
crss.exe online aside from it being a truncated version of
csrss.exe. csrss.exe is the Client-Server Runtime
Subsystem. This is the user-mode componet of the win32
subsystem. It manages the creation and deletion of
threads, console windows, and portions of the virtual DOS
environment. You can't end this process from tsk manager,
and if you end it another way, windows will become
unstable. As far as why it would connect to the net, it
shouldn't need to connect to the net except when other
processes or applications are connecting to the net
(actively) especially IE. This is my understanding of
it. If you have any other questions on it, feel free to
ask, or if you find anything out about it, post that as
well, I'm always up for learning something new.
crss - crss.exe - Process Information
Process File: crss or crss.exe
Process Name: W32.AGOBOT.GH Worm
Description:
crss.exe is a process which is registered as the W32.AGOBOT.GH worm. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open it?s hostile attachment. The worm has it?s own SMTP engine which means it gathers E-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately. Please see additional details regarding this process
|
