Removal procedure for csrcs.exe

Manual proceudre

Steps to remove this virus:
1.    Scan the system with a good and updated Anti Virus.
2.    Open Task Manager, locate this exe (csrcs.exe or csrsc.exe but not csrss.exe), and kill the process.
3.    Now type msconfig in the Run box, and then go to startup tab.
4.    Locate this exe file, if any, and then remove it from there as well.
5.    Now search the file in the C: drive.
6.    Permanently delete the file (csrcs.exe or csrsc.exe only) from the computer.
7.    Reboot the PC for changes to take place.
After doing the above steps, you need to clean the registry as well.

1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\
2. On the right side, there is a key named “Shell”, it may be having a value “explorer.exe csrcs.exe”. Just modify it to delete the csrcs.exe from it (not explorer.exe). Restart the computer

With the help of ePO console

1. Log on to ePO console
2. System --> My Organisation --> Policies -->
3. Edit the Unwanted Program policy from VirusScan Enteprise v8.5i & 8.7i
4. User Defined detection tab
5. Click on New process
6. Specify file name as csrcs.exe
7. Description will be "virus infected file" or "new virus"

With Regards,

Prashob