Open task manager.

Click processes.

Scroll down and look for the process called winlogon.exe

If you have multiple winlogon.exe processes you have a problem.

I dont know how this works a 100% but under task manager you can go to processes and one of them should be the keylogger or you can tell from there. Try googling 'taskmanager keylogger' and see what you can find for that.

crumb wrote Open task manager.

Click processes.

Scroll down and look for the process called winlogon.exe

If you have multiple winlogon.exe processes you have a problem.

ok thank you there is only one winlogon.exe but there is also a csrss.exe ,Is that a windows file or a virus ?

koolboy747 wrote

crumb wrote Open task manager.

Click processes.

Scroll down and look for the process called winlogon.exe

If you have multiple winlogon.exe processes you have a problem.

ok thank you there is only one winlogon.exe but there is also a csrss.exe ,Is that a windows file or a virus ?

This is the user-mode portion of the Win32 subsystem; Win32.sys is the kernel-mode portion. Csrss stands for Client/Server Run-Time Subsystem, and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and implementing some portions of the 16-bit virtual MS-DOS environment.
Note: The csrss.exe file is located in the folder C:\Windows\System32. In other cases, csrss.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.
Virus with same name: Nimda.E

[ Register or Signin to view external links. ]

crumb wrote

koolboy747 wrote

crumb wrote Open task manager.

Click processes.

Scroll down and look for the process called winlogon.exe

If you have multiple winlogon.exe processes you have a problem.

ok thank you there is only one winlogon.exe but there is also a csrss.exe ,Is that a windows file or a virus ?

This is the user-mode portion of the Win32 subsystem; Win32.sys is the kernel-mode portion. Csrss stands for Client/Server Run-Time Subsystem, and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and implementing some portions of the 16-bit virtual MS-DOS environment.
Note: The csrss.exe file is located in the folder C:\Windows\System32. In other cases, csrss.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.
Virus with same name: Nimda.E

[ Register or Signin to view external links. ]

ok thanks for the help ,i have +repped

koolboy747 wrote

crumb wrote

koolboy747 wrote

crumb wrote Open task manager.

Click processes.

Scroll down and look for the process called winlogon.exe

If you have multiple winlogon.exe processes you have a problem.

ok thank you there is only one winlogon.exe but there is also a csrss.exe ,Is that a windows file or a virus ?

This is the user-mode portion of the Win32 subsystem; Win32.sys is the kernel-mode portion. Csrss stands for Client/Server Run-Time Subsystem, and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and implementing some portions of the 16-bit virtual MS-DOS environment.
Note: The csrss.exe file is located in the folder C:\Windows\System32. In other cases, csrss.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.
Virus with same name: Nimda.E

[ Register or Signin to view external links. ]

ok thanks for the help ,i have +repped

Sure, it was my pleasure.

Pm me if you need any further assistance.

Good luck and I hope all is well.

Malwarebytes free download

[ Register or Signin to view external links. ]

Download the correct Hitman Pro 3.6 (I have 64bit)

[ Register or Signin to view external links. ]

does anybody know how i can tell if the file csrss.exe is infected as apparently if it is infected it cant be removed so what can i do ??

The only way you got a keylogger is if it asked to run java and you clicked run or always run on this site, otherwise your fine, this is called a jdb or java drive by, it is the only way to infect over a link... Yes i do know this for a fact, i can make viruses