Jump to content

Search the Community

Showing results for tags 'csrss'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Announcements
    • Malwarebytes News
    • Beta Testing Program
  • Malware Removal Help
    • Windows Malware Removal Help & Support
    • Mac Malware Removal Help & Support
    • Mobile Malware Removal Help & Support
    • Malware Removal Self-Help Guides
  • Malwarebytes for Home Support
    • Malwarebytes for Windows Support Forum
    • Malwarebytes for Mac Support Forum
    • Malwarebytes for Android Support Forum
    • Malwarebytes for iOS Support
    • Malwarebytes Privacy
    • Malwarebytes Browser Guard
    • False Positives
    • Comments and Suggestions
  • Malwarebytes for Business Support
    • Malwarebytes Nebula
    • Malwarebytes Nebula Modules
    • Malwarebytes Endpoint Security
    • Other Malwarebytes Business Products
    • Malwarebytes Business Products Comments and Suggestions
  • Malwarebytes Tools and Other Products
    • Malwarebytes AdwCleaner
    • Malwarebytes Junkware Removal Tool Support
    • Malwarebytes Anti-Rootkit BETA Support
    • Malwarebytes Techbench USB (Legacy)
    • Malwarebytes Secure Backup discontinued
    • Other Tools
    • Malwarebytes Tools Comments and Suggestions
  • General Computer Help and Security Updates
    • BSOD, Crashes, Kernel Debugging
    • General Windows PC Help
  • Research Center
    • Newest Rogue-Ransomware Threats
    • Newest Malware Threats
    • Newest Mobile Threats
    • Newest IP or URL Threats
    • Newest Mac Threats
    • Report Scam Phone Numbers
  • General
    • General Chat
    • Forums Announcements & Feedback

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


AIM


MSN


Website URL


ICQ


Yahoo


Jabber


Location


Interests

Found 9 results

  1. I have a process called csrss.exe,is it a virus or not ? If yes,what I should do ?
  2. Hello, Recently my anti-virus, avast, has been saying that it has blocked a csrss.exe infection coming from AppData>Local>Temp>phantomows>bin. I have tried to delete the folder many times but it has reappeared every couple of hours. I have run a boot-time scan and avast found nothing. I am quite lost as there is very little info on the internet about this virus. Any info or help would be greatly appreciated!
  3. After the Anit-Ransomware Beta has been running for a while. One to Two days....... The CSRSS.exe process goes to 70-85% and makes my PC unusable. It take me about 5 minutes to get the Anti-Ransomware Beta open and "Stop Protection". After stopping Anti-Ransomware Beta, the CSRSS.exe returns to 0% CPU and my system returns to normal. I can click Start Protection in Anti-Ransomware Beta and the CSRSS.exe goes back to 70-85% and my system becomes sluggish. I can repeat this on demand until I reboot, then it takes another day or two before it happens again. This whole thing is full reproducible. mbarwind-crash.zip logs.zip
  4. Good morning/evening I've read many posts here and elsewhere, installed the required/suggested programs and finally thought it would be wise to add my problem to the pile :s It's been a while since the computer is kind of slow, I installed all the updates, windows, java, flash, the malware byte rootkit remover and malware remover, super anti spyware, changed comodo for zone alaram, and now I'm having spyware cease/Avg /adva canced system care, GMER (so far the only one that actually recognizes something and allows me to kill process but they pop randomly) and I know what false positives are, etc,registry cleaners... ...the thing is, all of a sudden Korean and Mandarin characters are popping in GMEr and I've never seen them before. It's brutally annoying, I work for a japanese-owned company and wonder if it's not industrial spying. I'm in North America, with lots of co workers from Asia and this could also be a possibility. It's very frustrating as I did all the search for the corrupt csrss.exe file and obviously won't find it. I'd join screen shots so you can see, some repeating threads but mostly program jacking. I also used panda cloud scanner/rogue killer/ kapersky/eset all to no avail/real result it seems they only look for english characters and they did remove a few PUP and adware but nothing serious. I Tried moving everything to another user (that I just created) and before I report this to my employer as a serious issue I'd like to have some Idea ( are there apps I can use to track the origin of the sender so I can show those smart asses a lesson? This has been burning lots of time I'M working as you all are I suppose and a part time student as well. *update:I've been working with computers for a while so don'T worry and suggest me a straight up solution. The regedit won'T detect the csrss.exe file but the virus keeps emulating it along with .32 processes. I also noticed that gmer mentions a windows without capital w but the other times it has it.Ask for the logs if you'd like but they show nothing. 0, zilch, nada. I guess I could try to ''search for the chinese character meaning'' if it can bebackdoor stuff.txtproblemz.txtRkill.txtshiiiiiiiiit.txt tracked from the photo. I've only seen those kinds of post a few times and I don't mean to be racist but I studied in cyber criminology and was told asian script kiddies&seasonal criminals are fond of unweary american cyber surfer's funds. Thanks in advance!
  5. Hi, just signed up to get some assistance. My pc has been starting up very slowly recently. I was looking in my system processes and found two instances of csrss.exe running and they are nearly identical with the only difference being the Memory Usage. I'll attach the FRST logs. I just want my computer to start up the way it used to T.TAddition.txtFRST.txt
  6. I just done a malware check and has found a malware as following : Memory Processes Detected: 1C:\Windows\csrss.exe (Backdoor.Bot) -> 2620 -> No action taken. Registry Values Detected: 1HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Client Server Runtime Process (Backdoor.Bot) -> Data: "C:\Windows\csrss.exe" -> No action taken. Files Detected: 1C:\Windows\csrss.exe (Backdoor.Bot) -> No action taken. I also found a csrss.exe in C:\Windows\System32\csrss.exe My question is : is it wise to remove this? and is it truly a malware/Backdoor.bot? Because i has googled for a bit and found that csrss.exe is an important file in windows.. Thanks.
  7. Hello, and good night. As the title says, I KNOW I have malware somewhere in my computer. I noticed because my internet suddenly slowed down a lot, pages take ages to load and videos don't load at all sometimes, in the Task Manager, I noticed that the processes csrss.exe and dllhost.exe sometimes do not have Description, I think that's wrong. I installed MBAM but at first it wouldn't run, so I looked up help and found out the Chameleon technology. I tried everything but still didn't work. I even tried RKill, but nothing would allow me to run MBAM, except rebooting on Safe Mode! Once in Chameleon, it opened MBAM and did a scan, but found nothing.... I also tried that Microsoft Malware tool, I forget its name, but it didn't find anything either. As a side note, when I was in Safe Mode, I noticed that csrss.exe DID have a description in the Task Manager; could this be the infection I'm looking for? Still after the scans I ran, my internet connection is very slow, and it takes a little bit longer to boot the computer now. I have no idea what to do now! My major concern is my internet connection, as I am very often active in many forums and sites, I have important stuff here and I'm afraid it's not only malware but spyware or anything else. Please help me!
  8. I have been having major problems with installing my belking modem and range extender. Belkin support told me that both my desk top and laptop are infected with csrss. I think they were just trying to sell me something since I am running EVERYTHING on both computers to protect them. I downloaded Hijack this and ran a scan from a forum I previously read and the two entries that were supposed to be checked are not in my log. Please help. i cant deal with the speed of these computers anymore. Here is a copy of the log below. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:57:32 AM, on 8/21/2012 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18639) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\PROGRAM FILES\COMMON FILES\LIGHTSCRIBE\LIGHTSCRIBECONTROLPANEL.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Users\Joe Reilly\AppData\Local\Google\Update\1.3.21.115\GoogleCrashHandler.exe C:\Users\Joe Reilly\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Joe Reilly\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Joe Reilly\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Joe Reilly\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Joe Reilly\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\taskeng.exe C:\Users\Joe Reilly\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Joe Reilly\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Joe Reilly\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\sdclt.exe C:\Program Files\Real\RealPlayer\update\realsched.exe C:\Windows\System32\mobsync.exe C:\Users\Joe Reilly\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Users\Joe Reilly\AppData\Local\Google\Chrome\Application\chrome.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww.facebook.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O1 - Hosts: 74.208.10.249 gs.apple.com O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [synTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\Update\realsched.exe" -osboot O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKCU\..\Run: [Advanced SystemCare 5] "C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe" /Manual O4 - HKCU\..\Run: [Google Update] "C:\Users\Joe Reilly\AppData\Local\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE O23 - Service: Adobe Active File Monitor V9 (AdobeActiveFileMonitor9.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) - IObit - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: WebEx Service Host for Support Center (atashost) - WebEx Communications, Inc. - C:\Windows\system32\atashost.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe O23 - Service: dlcx_device - - C:\Windows\system32\dlcxcoms.exe O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- End of file - 9099 bytes Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.21.02 Windows Vista Service Pack 1 x86 NTFS Internet Explorer 7.0.6001.18000 Joe Reilly :: DONALDCLARK-PC [administrator] 8/21/2012 3:03:11 AM mbam-log-2012-08-21 (03-03-11).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 214128 Time elapsed: 24 minute(s), 58 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
  9. I recently downloaded Malwarebytes after Norton 360 kept telling me that I was getting attacked by a worm. I thought with Norton 360 I was protected from everything, but it appears not. After downloading Malwarebytes I ran a few scans and had to restart my computer a few times. I have run into 8 files that keep coming up on the scan. Here is the log: Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.05.25.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Owner :: OWNER-PC [administrator] 26/05/2012 3:07:26 PM 1.txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 207390 Time elapsed: 2 minute(s), 22 second(s) Memory Processes Detected: 3 C:\Windows\Temp\svchost.exe (Trojan.Agent) -> 3412 -> No action taken. C:\Windows\Temp\svchost.exe (Trojan.Agent) -> 3424 -> No action taken. C:\Windows\Temp\svchost.exe (Trojan.Agent) -> 2776 -> No action taken. Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\Software\VB and VBA Program Settings\SrvID (Malware.Trace) -> No action taken. Registry Values Detected: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|msvcnp (Backdoor.Agent) -> Data: C:\Users\Owner\AppData\Roaming\msvcnp .exe -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|csrss (Trojan.Agent) -> Data: C:\Users\Owner\AppData\Roaming\csrss .exe -> No action taken. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\Windows\Temp\svchost.exe (Trojan.Agent) -> No action taken. C:\Users\Owner\AppData\Roaming\csrss .exe (Trojan.Agent) -> No action taken. (end) Here is the removal log of the same files. A popup also appears telling me to restart my computer. Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.05.25.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Owner :: OWNER-PC [administrator] 26/05/2012 3:07:26 PM mbam-log-2012-05-26 (15-07-26).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 207390 Time elapsed: 2 minute(s), 22 second(s) Memory Processes Detected: 3 C:\Windows\Temp\svchost.exe (Trojan.Agent) -> 3412 -> Delete on reboot. C:\Windows\Temp\svchost.exe (Trojan.Agent) -> 3424 -> Delete on reboot. C:\Windows\Temp\svchost.exe (Trojan.Agent) -> 2776 -> Delete on reboot. Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\Software\VB and VBA Program Settings\SrvID (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Detected: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|msvcnp (Backdoor.Agent) -> Data: C:\Users\Owner\AppData\Roaming\msvcnp .exe -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|csrss (Trojan.Agent) -> Data: C:\Users\Owner\AppData\Roaming\csrss .exe -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\Windows\Temp\svchost.exe (Trojan.Agent) -> Delete on reboot. C:\Users\Owner\AppData\Roaming\csrss .exe (Trojan.Agent) -> Quarantined and deleted successfully. (end) After restarting my computer, the same 8 files appear in the next scan. Is there anything I can do to stop this? I had problems before with a file called update.exe appearing in my Roaming folder. When I deleted it, it would just appear again after a few seconds. So I deleted it and then put a folder in Roaming called update.exe. This stopped the file from appearing. Any input or help is appreciated.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.