sonic352 Posted December 15, 2016 ID:1080472 Share Posted December 15, 2016 C:\Users\Chris\AppData\Local\Temp\phantomows\bin Around 2-4 days ago my malwarebytes detected that it blocked a malicious site from attacking my PC and it was CSRSS.exe. I know that its a normal file so I was curious why it was coming up. I searched my computer for the file, all the other files locations were normal, in the windows folders, except for the one I posted above. Yesterday I found it and had Microsoft Essentials and Malewarebytes scan it. Neither found anything, virus or spyware. I deleted it and used CCleaner to clean up all my temp stuff. I was good, until a hour ago it came back. Same folder, same location. Does anyone have an idea on why this suddenly has come up and why it can't stay gone? I tried to delete it just now and it won't let me. It says another program is using it but I had nothing open. Thanks to anyone who can help me out. Link to post Share on other sites More sharing options...
sonic352 Posted December 16, 2016 Author ID:1080908 Share Posted December 16, 2016 I was able to delete it yesterday but it came back today but malewarebytes didn't say anything like it was doing normally. This time the phantomows folder showed up as a rar file instead. I scanned the file but again, no infection alerts. I don't know why it keeps coming back. I was using my pc as normal for hours and it never came up. While I wasn't doing anything specific it just popped back up. But this time as a rar file instead of a open folder. Link to post Share on other sites More sharing options...
sonic352 Posted December 16, 2016 Author ID:1080910 Share Posted December 16, 2016 **** Edit of my previous comment: I was able to delete the csrss.exe file along with phantomows folder yesterday after restarting my pc and deleting it right after windows opened to the desktop but it came back today but malewarebytes didn't say alert me like it was the last couple of days. This time the phantomows folder showed up as a rar file instead. I scanned the file but again, no infection alerts. I don't know why it keeps coming back and it worries now because when it was a folder malewarebytes kept alerting me, like every 5-20 minutes that it was blocking the csrss.exe file communications and now its not giving me any alerts now that its a rar file. I was using my pc as normal for hours and it never came up. While I wasn't doing anything specific it just popped back up. But this time as a rar file instead of a open folder. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 30, 2016 Root Admin ID:1085174 Share Posted December 30, 2016 Hello @sonic352 and Sorry for the delay. I've been out on vacation and looks like your topic was over looked. Please read the following and post back the 3 requested logs as an attachment. Diagnostic Logs Thanks Link to post Share on other sites More sharing options...
sonic352 Posted January 6, 2017 Author ID:1087048 Share Posted January 6, 2017 Hey, I found the problem, that's why I haven't been back on this thread. It's Java. I don't know why specifically but that's the source of the problem. If you delete Java from your PC the problem will stop. I don't know why Java kept making the file in the temp folder but that's the culprit. There is another thread on this forum with the same topic as mine. I was using that as my support since no one was responding to mine. With the help of that and me looking at the file and tracing back the origin (which took a couple of days and a lot of hours on google) it was traced back to Java. The other thread also reached the same conclusion. The moment I deleted the folder from my PC it hasn't come back since. Been a couple of weeks since then. You should be fine after you get rid of it. But as to why it happened in the first place, no idea. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 6, 2017 Root Admin ID:1087084 Share Posted January 6, 2017 Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you. Link to post Share on other sites More sharing options...
Recommended Posts