Is there a trojan csrss.exe? If so how do I eliminate it.

Okay, so, here we go. :)

Plug the power cord into the laptop. Remove any peripherals like external mouse, external monitor, external hard drives, etc. The only thing connected should be the flash drive with the W10 install media you made.

Turn the system on, and start tapping the key which gives you the one-time boot selection. (tap tap tap...)
This is usually F12, but depends on the system manufacturer. When then system first turns on, at the black screen there will usually be some indication at the bottom of the screen like: Press F12 for Boot Menu, Press F2 for BIOS, etc. If you can't figure it out, please advise the laptop specs and I'll look it up for you.

Select to boot from the flash drive.

Select to install Windows.

Select language, time and keyboard.

Select Install Now.

When/if it asks for a product key, select I don't have a product key.

If it shows multiple editions, select Windows 10 Home.

Accept the license.

Now select Custom Install.




Highlight each partition on the drive, one at a time, and delete it. You'll probably find there are quite a few-there usually are with a W8>W10 upgrade. We want to clean install to a completely unallocated drive, to be sure everything that the scammers may have done, is gone.



Proceed through the installation, create the user account, select privacy options, connect to the internet, etc.

I would create a local account for her. She can always change it to an MS account later if she wants.



Skip setting up Cortana for now. If she does that, she will need to use an MS account to login to her computer.

Here's the tutorial, in case you need it:
Clean Install Windows 10 - Windows 10 Installation Upgrade Tutorials

Any questions, please ask. It's quite painless really.

Bruce SX said:

She has changed the Google password.

Do we change her Microsoft password using her pc using the following steps?

• Press Ctrl+Alt+Delete, and then click Change a password.
• Type your old password followed by a new password as indicated, and then type the new password again to confirm it.
• Press Enter.

No, I would not change a password on a possibly compromised computer.
Is it an MS account password, or a local account password?

Bruce SX said:

I'm embarrassed to say, but I do not know the difference.

At the login screen of the computer, where you enter the password, does it just have, say, her first name, or is it an email address? If it's an email address, then it's an MS account.

Here's another way to check:

Type account in the search box and look at the window that pops up.
If it says Sign in with a Microsoft account instead, then she's using a local account and not an MS account.

Bruce SX said:

It says: can't sign in right now. go to account.live.com or use the last password you signed in with

Okay very good. This means she has changed her MS password, and that was how she was signing into the laptop. Good. That's what I needed to know.

Okay, post #53...here you go.
Is there a trojan csrss.exe? If so how do I eliminate it. - Page 6 - - Windows 10 Forums

.