If your computer installed Windows-based operating system, you might have seen csrss.exe and smss.exe in Task Manager. What is it? Actually, they are essential software component for Microsoft Windows. However, they must be run as SYSTEM process and no duplication. If you found two copies of them, one is SYSTEM and one is yours, you machine has been already infected. I don’t know exactly but it seems to be a kind of malware. NOD32 don’t classify them. These processes couldn’t be deleted or terminated as usual. msconfig or regedit cannot help you. Fortunately, you can remove it permanently by yourself.

First of all, you have to make sure it is in your machine or not.

1. Open Task Manager and find csrss.exe. if you found 2 of them, it is
2. In Task Manager, find smss.exe. If you found 2 of them, it is
3. Open C:\Windows\System and find directory started by "Level", e.g., Level3. If you found csrss.exe in these directories, it is
4. Open C:\Program Files\Windows Media Player\Skins\WindowsMediaSkin\Data and find directory started by "Level", e.g., Level3. If you found smss.exe in these directories, it is

If you found them, sit back, relax and follows below steps.

1. Reboot into Saft mode using F8
2. Open C:\Program Files\Windows Media Player\Skins and remove WindowsMediaSkin
3. Open C:\Windows\System and remove all directories started by Level
4. Run regedit and goto HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
5. Remove all keys started by smssLevel and csrssLevel
6. Restart to normal mode

Technorati Tags: English, IT, Security, News, Tips and Tricks, Csrss, Smss, Malware