Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Are Winlogon.exe and csrss.exe malware here?


  • Please log in to reply
2 replies to this topic

#1 mred27

mred27

  • Members
  • 56 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:38 AM

Posted 24 August 2013 - 09:18 PM

I just came from another forum that looks strikingly similar to yours. The "expert" there who did the troubleshooing stated "I don't see anything" when done although the issues still persists. Thought maybe you could give me a second opinion please?  I sent him screenshots showing these two items running in processes and they still are. Windows task manager shows the basic winlogon.

 

winlogon.exe          \\??\E:\WINDOWS\system32\winlogon.exe

csrss.exe                \\??\E:\WINDOWS\system32\csrss.exe

 

My question is whether these executables are malware because they have questionmarks in the path almost like they are designed to be hidden. They also are the only items that run as high priority. Do you concur that I am not infected as the other person does?

T

hey show up in the Glarysoft Pro 3 process manager but cannot be deleted. In windows task manager, they cannot be deleted either as they are critical system processes.My windows system32 folder has the real winlogon.exe that is only 496kb versus the infection file which shows memory of 2554 kb. Same deal for csrss.exe which is 6kb versus the infection at 2764kb. Perhaps the memory doesn't reflect the actual file size so maybe that isn't a factor. I read that malware files are much larger than the real windows files.

 

My understanding is that winlogon.exe only runs at startup then stops shortly thereafter. These items are running constantly.

 

Here is the troubleshooting that was already done with nothing found:

dds 

RogueKiller

Malwarebytes Anti-Rootkit

Combofix

 

Thanks!

 

 

 

 

 



BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,661 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:38 AM

Posted 24 August 2013 - 10:11 PM

None of the above tools except for MBAR scan (not fix) are allowed in this forum.

 

If you think your computer is infected...

 

Please follow the instructions in THIS GUIDE starting at Step 6. If you cannot complete a step, skip it and continue.

Once the proper logs are created, then make a NEW TOPIC and post it HERE. Please include a description of your computer issues, what you have done to resolve them, and a link to this topic.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 mred27

mred27
  • Topic Starter

  • Members
  • 56 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:38 AM

Posted 25 August 2013 - 08:42 AM

Moderator: Please close this topic thread as I created a new one as instructed. Thanks!






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users