CSRSS.exe Blank Icon in Hidden Icon Tray

[elohpool]

I've recently notice I have a blank icon that's been system in my Hidden Icon Tray. I used PS Tray Factory and it tells it's csrss.exe but that's about it. I found that this icon appears when I run FL Studio and some other VSTs but after exiting out it doesn't go away. I have BitDefender and ran a deep scan on my PC as well as Malwarebytes (recently installed) but nothing was found. I've delete my Iconcaches from the Explorer directory and in the main local directory but the icon will reappear until I restart. Is there anyway to see if this is malicious. I can't find a single process through task manager or process hacker that gets rid of this.

 

[elohpool]

Also, CSRSS.exe is not found in any other directory except for C:\Windows\System32

[MKDB]

Hello @elohpool  and 

 

My name is MKDB and I will assist you.

 

Let's keep these principles as we proceed. Make sure to read the entire post below first.

• Please follow the steps in the given order and post back the log files.
• Please copy and paste all log files into your post.
• Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
• Only run the tools I guide you to. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• As English is not my native language, please do not use slang or idioms. It may be hard for me to understand.
• If you do not respond within 4 days, your topic will be closed.
• Cracked or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also a big source of current trojan infections. If you are running any kin of illegal software on your system, please uninstall them now, before we start the cleaning procedure.

 

 

Step 1

• Please download the Malwarebytes Support Tool (MBST).
• Run MBST and accept license agreement.
• In the left navigation pane of MBST, click Advanced.
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine.
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply.

 

Edited September 16, 2023 by MKDB

[Maurice Naggar]

Hello Elohpool. My name is Maurice. I will guide you. Please provide the support-report ZIP as listed above. In addition, also provide this other

Create an Autoruns Log:

• Please download Sysinternals Autoruns from here:   https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
• Save Autoruns.zip to your computer. Then locate it and extract it to a new folder where you can find and run it.
• Once it starts you may not be able to easily stop the scan but you can try to press the Escape key on your keyboard.
• Once scanning is stopped, click on the Options menu at the top of the program and select Scan Options... 
• Then place a check mark on the following items Verify Code Signatures, Check VirusTotal.com, and Submit Unknown Images
• Then click the Rescan button. Agree to the VirusTotal EULA
• Once the new scan has been completed, please click on the File button at the top of the program and select Save, or use the Save icon, and save the Autoruns.arn file to your desktop and close Autoruns.
• Right-click on the Autoruns.arn file (it will typically be the name of your computer) on your desktop or where you save it, and hover your mouse over Send To and select Compressed (zipped) Folder
• Attach the Autoruns.zip folder (your computer name.zip) you just created to your next reply.

 

[Maurice Naggar]

@MKDB I dont think I specifically had noticed that you were the one that made the first reply. My regret. I am recusing myself from this case. 

[MKDB]

14 hours ago, Maurice Naggar said:

@MKDB I dont think I specifically had noticed that you were the one that made the first reply. My regret. I am recusing myself from this case. 

@Maurice Naggar No problem to have you here. 4 eyes see more than 2.

[MKDB]

Hi @elohpool,

do you still need help? If so, please follow my instructions and post the logfiles.

Thank you.

[MKDB]

Due to the lack of feedback, I do not follow this topic any longer.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection.

Thank you.