1

I recently discovered one of my online accounts had been hacked, nothing major yet, but I'm concerned I may have a keylogger on my Windows 10 desktop. It stirred me into a panic and I immediately ran a full scan with my Kaspersky AV, and also downloaded Malwarebytes Anti-Malware, and scanned my PC with that. Both finished and told me my computer was all clear, but when I checked my task manager I saw a process I've never seen before. I immediately checked my other two Windows 10 desktops and verified that this process was no present on them.

The process is called osrss and it's under Windows processes, of which I have 80 running. When I go to view the file location, it is stored in:

C:\WINDOWS\System32\svchost

Why it generated such alarm for me is because the only thing that was recently downloaded to my desktop is some game called Old School Runescape. I figured that would mean OSRS? But if that is the case, why is it running under windows processes if it is not a virus?

Any and all help providing information to osrss process, and the reliability of two seperate virus scans would greatly appreciated.

Improve this question
1
  • according to this site, runescape.salmoneus.net/forums/topic/… Runescape runs things from the Windows folder in the background to make loading faster, so not an immediate cause for concern if your virus scans say you are clean. Do a root kit scan if you are still concerned
    – Sir Adelaide
    Feb 12, 2018 at 7:25

2 Answers 2

Reset to default
1

Bleeping Computer recognizes this process: OSRSS.EXE as an undesirable program (PUP).

So, it is recommended that you remove it from your system, but first, to be sure of this, I suggest you to download System Explorer Portable, this is a very good alternative to Windows Task Manager and can provide you with more information about this file before making a decision.

After running the tool, go to Processes tab, search for the suspicious file, then right click and select File Check. This will send the file to VirusTotal where you can have a better idea of it (If it is a malware or not), see the image for a better reference.

system explorer on microsoft windows

Hope it helps, good luck!

Improve this answer
1

OSRSS files, and the Folder itself, are part of Windows Updating itself, and deal with any 'failed updates', (as when I stopped an "Update" downloading as didn't want/need it). I deleted osrss .dll files, two 'applications', and the Folder in Windows itself, (you CAN after 'taking control' of it), and, possibly not due to this I know, my desktop seems to run a little faster again. You certainly DON'T need to download anything else, (like the program above).

Improve this answer
1
  • I had a service called "windows 10 update facilitation service" which was started with svchost -c osrss. I was not able stop that service, so with remove osrss.dll in system32 it was removed from the services.
    – chloesoe
    Jul 23, 2018 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .