What is the csrss.exe? It is not a virus, it is the Client Server Runtime Process. The Win32.sys is the kernel mode portion and this process is the user mode portion. It responsible for the running DOS programs, console subsystem and threads.

Many viruses masks by this name. Most common that file is placed in different directory and user see another csrss.exe process. So task manager show two processes with the same name but different path.

The case when csrss.exe is a virus when a) path is different from windows system32 b) size is very differ from 1 MB. I one case was running two processes one was big about 5MB and this was the trojan and second was small, the small was the original program.

Ahlem.A is the virus which is masked as legitim process. Removal of csrss.exe virus is described below. If computer have Ahlem.A virus it will run unusually slow with high disk activity. The other symptoms are unknown, but better to remove it anyway as it slows down your computer.

To test which process is legitim and which is a virus try to kill the csrss.exe. If it was the virus it will be killed silently but if it was the system process, windows will warn about it and propose not to kill.

After you killed this process, remove it from startup. This can be done either by regedit or by msconfig. Simpler is to use msconfig, find all references to csrss.exe and unselect check box. Thats all trojan will not start any mor. Further step which you maybe want to perform is to remove file completely (to expel accidental run), you can find full path to it in msconfig.

If you have any suggestions or you noticed some inaccuracy feel free to contact us. All information provided here is not pretended to be absolutely correct, as said earlier if you want to advice something you are always welcome.

You can download free spyware removal tools from Microsoft. Also good section about removing parasite on CNET.COM. Try searching on SimTel using keyword spyware.

Please listen to our several advises: