The executable csrss.exe has been detected as malware by 37 anti-virus scanners. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘csrss’. This trojon will perform a number of actions that will compromise a PC including changing protected system registry values, hiding in protected operating system locations and downloading and installing additional malware. While running, it connects to the Internet address ip-91-197-13-28.gadu-gadu.pl on port 8074.