CSRSS.exe trojan software?

Hi webkeeper,


Client Server Runtime Process, (CSRSS) is a Microsoft process that can run multiple times on your device which is normal. To verify this, can you check the location of the processes on your device? The legitimate csrss.exe file should be located in the " C:\Windows\system32 ". 

To check the location, kindly open your Task Manger then on the Process tab look for the Client Server Runtime Process. After that, right-click the csrss process then go to "Open file location". 
Let us know if the location is not on system32.

Awaiting for your response. 
- Ann

Yes, the two processes I found are both in the System32 location.  So I guess I'm OK.  But I found a description on the web indication that the CSRSS process is often used to hide a Trojan to record keystrokes.  Is that a hoax or is it true? If true, will TM protect me from that?

Yes, there are cases that csrss.exe is used to mask malicious activity but in order to check if it is legit or not, you'll have to check the file location and the properties if it is from Microsoft. Trend Micro program will notify you if there is any suspicious activity. 

- Ann