Home » Questions » Computers [ Ask a new question ]

Internet Explorer trying to run csc.exe

Internet Explorer trying to run csc.exe

Every so often I get the following dialog:

Asked by: Guest | Views: 276
Total answers/comments: 1
Guest [Entry]

"I'll bet dollars to donuts that call to CSC is not not directly from the site. This is also most definitely not a WPF nor Silverlight application.

The site is an agency of the United States government -- NOAA, specifically. I just opened it in IE. No popups, no issues -- essentially no reproduction of the issue. And no plugins loaded; all imagery was web-standard graphic files.

This indicates that something else is happening. Now, normally I'd blame a toolbar or other Browser Helper Object (BHO). However, at least in terms of the visible toolbars, two are known quantities (Yahoo and Google). I'm not familiar with the middle one (the ""Identity Defender""), so I can't judge it either way without more research.

There are probably, however, other BHOs installed, or some other malware, which intercepts web addresses and occasionally redirects or quietly launches requests to other sites. Try going to this site on the end user's computer, and watch the status bar very carefully -- you're looking for addresses that wouldn't make sense being requested from a US Government web page.

If you see any suspicious URL requests, bingo, we're in a world where -- at least some -- web requests are being spawned without the user requesting them. Now that we know that, your job just became malware removal and DNS troubleshooting.

For most end users, this is the point where I wag my finger disapprovingly, turn on their UAC, and tell them that if they turn it off again I will refuse to support them. Tough love, I know. But I only support friends and family -- and I do that for free -- so I don't want to have my time wasted constantly.

After you get through with any necessary chastising, you will need to get some good, reliable malware removal tools and go to work. At the point where you identify the specific malware, you might consider asking a separate question here on SuperUser regarding removal of the specific issues."