Close

Results 1 to 5 of 5
  1. #1
    DF VIP Member doughboy's Avatar
    Join Date
    Jul 2001
    Location
    Beckenham
    Posts
    2,142
    Thanks
    139
    Thanked:        90
    Karma Level
    407

    Help Do I have a virus/malicious software? phantomows folder running csrss.exe

    Hey guys,

    Recently been have malwarebytes pop up warning me that it has blocked a process accessing websites - many different ones.

    The process in question is named csrss.exe and described as "Microsoft Security Client User Interface".

    The thing is, it's running from the /Users/<me>/Appdata/Local/Temp/phantomows folder.

    Sometimes the file phantomows.zip appears here too after I've deleted the phantomows folder.

    Ran scans with Nod32/MS Security Essentials/Malwarebytes AntiMalware and nothing was reported.

    Should I be worried?

  2. #2
    DF Super Moderator
    DejaVu's Avatar
    Join Date
    Nov 2005
    Location
    Essex
    Posts
    9,107
    Thanks
    1,836
    Thanked:        4,004
    Karma Level
    953

    Default Re: Do I have a virus/malicious software? phantomows folder running csrss.exe

    It's a relatively new case and I think should have been dealt with by Malwarebytes by now.
    You are right though, it is malicious -

    https://forums.malwarebytes.com/topi...ting-detected/

    Apparently removing Java solves it, but that is probably just because the program runs if Java. It's a work around.

    Thanks to DejaVu

    doughboy (9th January 2017)  


  3. #3
    DF VIP Member doughboy's Avatar
    Join Date
    Jul 2001
    Location
    Beckenham
    Posts
    2,142
    Thanks
    139
    Thanked:        90
    Karma Level
    407

    Default Re: Do I have a virus/malicious software? phantomows folder running csrss.exe

    Thanks DejaVu.

    Removed Java as a start.

    On a side note I always assumed Malwarebytes Premium 3 was an extra cost as I'd already paid for a legit version of the original. DL'd the trial and it lapped up my reg details - happy days.

    No time to do a new scan now but will update when I can. I have that temp folder currently popping up when windows starts as I'm paranoid now.

  4. #4
    DF VIP Member doughboy's Avatar
    Join Date
    Jul 2001
    Location
    Beckenham
    Posts
    2,142
    Thanks
    139
    Thanked:        90
    Karma Level
    407

    Default Re: Do I have a virus/malicious software? phantomows folder running csrss.exe

    No sign since the removal of Java.

    Mbam 3 found nothing. Also tried another one called Zemana Antimalware - again no hits.

    Obviously glad that it's no longer active, but not at rest since the root cause hasn't been found.

    If I reinstall Java it may come back - it's lurking somewhere on my machine out of sight of the scanners

  5. #5
    DF Super Moderator
    evilsatan's Avatar
    Join Date
    Jul 2004
    Location
    Essex
    Posts
    20,079
    Thanks
    1,105
    Thanked:        3,241
    Karma Level
    1541

    Default Re: Do I have a virus/malicious software? phantomows folder running csrss.exe

    Quote Originally Posted by doughboy View Post
    Thanks DejaVu.

    Removed Java as a start.

    On a side note I always assumed Malwarebytes Premium 3 was an extra cost as I'd already paid for a legit version of the original. DL'd the trial and it lapped up my reg details - happy days.

    No time to do a new scan now but will update when I can. I have that temp folder currently popping up when windows starts as I'm paranoid now.
    Originally the MBAM licence were lifetime so looks like they are honouring that

    Try running ADWCleaner, it was recently acquired by Malwarebytes and I use this in conjunction with MBAM when cleaning machines. Also look in your web browsers for any extensions/add-ons you don't want.


Similar Threads

  1. GBC backup carts - software and XP
    By BlackBeard in forum Old Skool Gaming & Retro
    Replies: 2
    Last Post: 15th October 2002, 08:36 PM
  2. 6210 Software Update...??
    By gunner in forum Unlocking Questions & Solutions
    Replies: 20
    Last Post: 6th October 2002, 09:33 AM
  3. Name some well built, safe, solid running, low priced cars.
    By Neuron Pulse in forum Cars & Motorbikes
    Replies: 13
    Last Post: 14th September 2002, 02:53 PM
  4. sky software
    By williamh in forum Digital Satellite TV
    Replies: 5
    Last Post: 3rd September 2002, 06:03 PM

Social Networking Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •