Csrss.exe dwm.exe conhost.exe nvvsvc.exe nvtray.exe virus ?
pirosigma
Posted messages
2
Status
Member
-
@res Posted messages 654 Status Member -
@res Posted messages 654 Status Member -
I've looked for a VERY long time on all the forums discussing these processes, some say they are not dangerous and others the opposite. The origin of csrss.exe, nvvsvc.exe, and nvxdsync.exe is not indicated in the task manager, and for conhost.exe, it shows console window host, for dwm.exe, window manager for the desktop, and for taskmgr.exe and taskhost.exe, Windows task manager and Windows tasks host process.
conhost.exe is found in C:\Windows\System32, dwm.exe is also there, nvvsvc.exe is also there, taskhost.exe is also there, and taskmgr.exe is also there. For csrss.exe I don’t know and nvxdsync.exe is in C:\Program Files\NVIDIA Corporation\Display and C:\Program Files\NVIDIA Corporation\Installer2\Display.ControlPanel.1
after extensive searching, I cannot disable dwm.exe by changing the Aero theme (which is buggy after the change), and I cannot delete conhost.exe because it is protected by trustedinstaller even though it is disabled. At first, several conhost processes (4) appear and then only 2 processes remain. I don't know if these are viruses or malware or not, but for some time my computer has been slow to start up, and I do take care of it.
Thank you for your help.
conhost.exe is found in C:\Windows\System32, dwm.exe is also there, nvvsvc.exe is also there, taskhost.exe is also there, and taskmgr.exe is also there. For csrss.exe I don’t know and nvxdsync.exe is in C:\Program Files\NVIDIA Corporation\Display and C:\Program Files\NVIDIA Corporation\Installer2\Display.ControlPanel.1
after extensive searching, I cannot disable dwm.exe by changing the Aero theme (which is buggy after the change), and I cannot delete conhost.exe because it is protected by trustedinstaller even though it is disabled. At first, several conhost processes (4) appear and then only 2 processes remain. I don't know if these are viruses or malware or not, but for some time my computer has been slow to start up, and I do take care of it.
Thank you for your help.
3 answers
-
Hello, contrary to what @res says, these processes are legitimate:
csrss.exe: it's the Client/Server Runtime Subsystem, a necessary mechanism for Windows
dwm.exe: it's the Desktop Window Manager, a component that manages transparent windows (and other details) since Windows Vista
nvvsvc.exe and nvxdsync: update service (I believe) and management of the nVidia graphics driver
nvtray.exe: once again nVidia, responsible for placing a small shortcut icon in the taskbar (next to the time)
taskmgr.exe: it's the Task Manager you use to view your list of processes...
conhost.exe launched by TrustedInstaller: it's for Windows updates, hands off. And no one except the system can access the "account" of TrustedInstaller, and this "account" cannot be disabled.
--
from human import idiocy
del idiocy -
Indeed, these are some big viruses!
You need to disinfect your PC
Create a Kaspersky Rescue Disc from another PC!
https://support.kaspersky.com/fr/14540
Then change the boot order in the BIOS to start from the CD drive
Publish the report-
-
Yes, but they can be used by viruses; I myself had a PC that paid the price for it.
Fortunately, Avira, during a complete scan, said that a complete scan would not be enough, so I created the Avira rescue system CD in ISO format.
Then I found a treasure trove of viruses.
After that, with the Kaspersky scan, I found the forty thieves. -
The only "questionable" process is conhost.exe, but it is launched by TrustedInstaller; the only time it becomes dangerous is when there is a rootkit; but you are partially right.
If the other processes are launched from the Windows folder, that's fine, and the same goes for the nVidia processes that are launched from the correct location. -
-
-
-
Thank you, gravgun. After a long search, you are right, and you confirm it again. Thank you so much! :)
