dwm.exe virus - What it is, and How to Remove it.

[Vision667]

"I Believe you have my stapler"

[blueguy09]

@Vision667 lmfaooo 

[bluesy92]

@5bracers sorry, I never had that virus, so I've never had to remove it. Sorry :-/

[5bracers]

How about removing a virus called zaberg exe ? Didn`t manage to get rid of it with any anti-viruses :(

[Roxxzor816]

lol XD epic trol le reddit FTW

[Driggas]

Quit trying to tell him its not virus, he knows its not a virus, he's just trolling everyone.

DON"T remove dwm.exe, its a windows file, its fine, not a virus, just don't watch this guy's video

[inhuman0id]

@Driggas You are a jackass.

[587shadow]

DWM.exe is not a virus! and if you delete it your gonna be cussing out this uploader on your parents computer. If this were such a well known virus that this world of warcraft addict knows about your AVG or whatever virus protection would have picked up on it. THUMBS UPS!

[587shadow]

dwm.exe isnt a virus it runs your display and this kids a douchebag for posting this video dont fuck ur pcs up

[bluesy92]

@587shadow Does no one pay attention? It uses the names of Windows components. Look at the directories - it is not stored in your system files. The virus and real dwm.exe are completely different things. If you were going to release a virus, wouldn't you WANT people to believe it is a Windows component, for this exact reason? Educate yourself before talking, or you'll just prove yourself a dumbass.

[587shadow]

@bluesy92 really? well for such a well known virus i would think avg norton or kaspersky would have told me. and not to mention dwm came with my computer fresh out of the box. im not saying there isnt a virues out there that runs as a process called dwm.exe but if people watch this video and then delete there dwm.exe there gonna be pissed

[theoriginalfatdonkey]

Lmhosts is a point your missing bud

[toms641]

Pretty good vid by Bluesy92. To be clear, folks, these files are rogues viruses only if they appear in the folders that Blue is describing: e.g. AppData. Don't delete anything from \Windows folders!

To see \users[username]\AppData you have to toggle windows explorer to show hidden folders/ In Win7 -> Click Organize , folder & Search options , View tab, Click radio button "show hidden files, folders and drives" .... Or, you can go to DOS command and navigate to the same.

Thanks again Bluesy92.

[Tobleus]

mine says:

File desc: Client runtime error

Company: Microsoft corporation

Date created: 21/01/2008/ 02:24

Size: 6.00 KB  is that normal??? ITS THE CSRSS.exe file..

[bluesy92]

@Tobleus I'm not sure how to fix the error, but if it's published by Microsoft, it's the real csrss.exe, not the virus one.

[jingting001]

Whenever I try to boot my cpu, it works perfectly until I left the my desktop on for 5-10 mins. It froze and sometimes give the "Blue Screen of Death" and the type of error is - 0x0000008E and sometimes the screen go black, and sometimes it just froze. Please help!!!! This have been happening to me for 1 week!

[foxx121]

Hahahaha, opps. Should before I did anything. Just deleted dwme.exe from system32. I hope it wasn't vital. Although google didn't come up with anything so I figured it wouldn't hurt either way. Seems to have rebooted fine

[iBeFamouZzZ]

i hope you realize DWM.exe isn't a virus its desktop windows manager it is put on your computer when windows is installed its not a virus and removing it to replace just takes time and will eventually take up the same amount of space jeez under educated.

[bluesy92]

@iBeFamouZzZ Uh...the virus uses names of windows components to appear more legitimate in the task manager...dwm.exe is legit, but not if it's in your appdata folder...

[1EZOD1]

this guy is kinda noob what he doesnt tell u is to keep that from happening again get a firewall with manual mode zone alarm free set program control to manual mode advanced uncheck allow certified ms programs to run auto then clear your program list all u need to connect to net is 1 svchost and your browser allowed csrss lsass smss even explorer.exe doesnt need net access to work they all call ms to submit "non personal information" so block that shit

[1EZOD1]

@1EZOD1 also if u have 64 bit os its easy to spot noob virus' cuz they all 32bit open task mngr and see an svchost.exe*32 or randomfile.exe*32 that u know doesnt need to run to make windwos function its prolly bad open file location note it kill it in task mngr delete it hunt the file name down in regedit then check hijackthis for anything relating to it then 99% of the time following these steps u can remove a noob virus without an antivirus KNOW WHAT SHIT RUNS IN TASK MANAGER ON A FRESH INSTAL

[trixstaTUTS]

i got 1 csrss.exe on system file..but when i perform administrative i get 2 but still in the system file....also i got a DWM.exe

[bluesy92]

@trixstaTUTS If it's in the system file, it should be legit. There are other search hijackers out there, so something that has the same effects of dwm.exe may be on your computer, but I doubt it is dwm.exe. I suggest using hijack this and showing the log file in a forum. Maybe that can help you narrow it down.

[DS316316]

I see that I have dwm.exe running under user in the task manager.

I am the only user on my computer.

I am running Windows 7, but cannot find a appdata folder. What is the full path for it?

Also, I tried to restore from prior recovery point, but was not successful, as it said that a certain log file was missing. This is strange, as I just did a recovery a week or two ago and received no errors.

[bluesy92]

@DS316316 Appdata is a hidden folder, you need to enable "Show Hidden folders" to see it. You can also use the search bar and type %appdata%

As far as not being able to restore, I don't think I can help you. Sorry :-/

[TheIRONMANPRO]

i am getting error "project1.exe" send error report..do u think its dwn.exe also in my task manager it opens lot of "local.exe" process

[bluesy92]

@TheIRONMANPRO Doesn't sound like anything I've seen of this virus...

[TheIRONMANPRO]

@bluesy92 unknow process like csrss.exe , local.exe, smss.exe are running on task manager and when i click to close it , it says "this is very critical process and cant be closed"...

[bluesy92]

@TheIRONMANPRO The only one that could be a part of this virus is csrss.exe. It is a legitimate Windows process (which is why the virus uses that name - so it's less noticable) so you need to figure out whether it's running from your system files, or appdata folder.

[diplom112]

it says i got conhost.exe on my vista how can i remove it? if u know PLZ tell me it pisses me off when i play games

[randomxfirerecording]

So the way to tell if you've got the virus is if you see dwm.exe in task manager? Or is it normal to see it?

[bluesy92]

@randomxfirerecording dwm.exe is an actual Windows component, so seeing it in task manager is common. The dwm.exe virus is placed in your appdata folder. The real dwm.exe is a Windows component, so when checking task manager, if it is running from your user, it's the virus.

[randomxfirerecording]

@bluesy92 So pretty much if under "User Name" in processes, it says my user name, its the virus? Shit...

[pocchama94]

Ok well thanks for the help anyway. I can't even find my User folder, but I found the temp but no virus

[pocchama94]

this would help me except i have windows xp :( Do u or anybody else know where to find these files on windows xp??? Plz help me I miss my internet on my PC

[bluesy92]

@pocchama94 Wow...I haven't used XP in forever. If I remember right, AppData is User\AppData and Temp is Documents\Temp. I'm probably wrong, though :-/

[St0lenFayth]

Awesome :) found everything and deleted it all! No more issues! Thanks again for this awesome instructional. Virus free finally and thanking god for Vipre/Malwarebytes!

[Lunarwolves3]

Lmao!!!! Robert you gotta shave man XD and did you make this cuz you thought I had a hijacker? (btw I do) lol

[bluesy92]

@Lunarwolves3 I made this before that, because I had one that was a PITA to remove...

[rlpmarketinginc1]

Hi bluesy92, I have Vista and not able to locate the files in those folders.

[bluesy92]

@rlpmarketinginc1 In Vista, if I remember right, temp is not part of AppData, and dwm.exe and E11E.576 are in AppData, not AppData/Roaming. I haven't used Vista in a while, though, so I'm not completely sure about the directories. If task manager is running dwm.exe from System32 or something, it's legit, so that may also be why.

[NelsonIncredulous]

Thanks so much bluesy92!! I FINALLY got rid of this annoying virus after watching your vid. The only file you mentioned I didn't find was the CSRSS.exe in the 'temp' directory, but getting rid of the other three had done the trick. THANKS again!!!!

[bluesy92]

@NelsonIncredulous Nice to know it helped :-)

[St0lenFayth]

Do you know how to access the folders in Vista or rather, where the virus hides? The only way I can even access appdata is by searching for it... I've searched for csrss conhost and dwm and nothing comes up. It's locked me out of the internet too. Any help is appreciated. Feel free to msg me also.

[bluesy92]

@St0lenFayth I sent you a message. I couldn't fit it all in a comment, but I think you have a different virus. Check your inbox :-)

[TheangryGhast]

It says it's publisher and signature is Microsoft Corporation

[bluesy92]

@TheangryGhast Did you go to the dwm.exe contained in System32? dwm.exe is a system file, but the virus uses the names of system files. The real ones are in System or System32. The fake ones (the virus) are in appdata and temp.

[bluesy92]

@TheangryGhast Oh and btw, nice name. Guessing you play Minecraft? :D

[TheangryGhast]

@bluesy92 Yep :D

[Mduran0889]

Thank you so much! You are awesome.

[bluesy92]

@Mduran0889 Thank you! :-) I was having problems myself untill I realized it installed for everyone, so I figured I would post this :-)

[salemblackfire]

HI ROBERRRRRRRTTTTT! =D

[bluesy92]

@salemblackfire Hi Cara. *Poke* So, should I ask why you are watching my virus-related video? What did you do? :P

[salemblackfire]

@bluesy92 i was watching your virus video because i was bored =d so i figured i would say "hi" as well =D

[bluesy92]

@salemblackfire lol. You would :P  And now, I am taking this FaceBook poke-war to YouTube. *pokepokepokepokepokepoke*

[salemblackfire]

@bluesy92 That's low =P I refuse to participate in such uncivilized acts in a neutral zone.

[bluesy92]

@salemblackfire I throw the Geneva Convention laws out the window. *Poke*

The sad part is, this is my own video I am filling with this spam :-/

[salemblackfire]

@bluesy92 and now everyone is going to know how unprofessional you are >.>