Unknown SCSI Access - Security Risk ???? WHO put it there and WHY ???

Originally posted by Cuhail
Boon, buddy. What is the real reason you're freaking out?
Why are you so alarmed by something that probably communicates with a printer program or Dropbox, or...something else most likely harmless?
Why all the emphatic panicking?
Just asking.

I do not have a SCSI printer.

And you say don't panic ??

What would you do if u woke up
in the middle of the night and there
were intruders in your house ???

Originally posted by miniatus
It's not unheard of that installed software will enable services if they require them.. the panic is probably a little unwarranted.

I think u underestimate this.

the scsiaccess.exe process was running
with ALL my SCSI Services turned off
in Windows.

The only way that can happen is for this
process to over-ride windows programming.

Basically, it would be like turning your car off
and as you get out, it cranks back up on it's own.

reply to post by boondock-saint


Did you come across all this:




Now I am a little pissed...it won't shut down.

I havent got the same as you OP...but I do have 3 unknown processes running without my consent called:

CSRSS.EXE
WINLOGON.EXE
EPOWEREVENT.EXE

Comp wont allow me to stop either of these processes...any ideas what they are?

Originally posted by jerryznv
reply to post by boondock-saint

 

Did you come across all this:
Now I am a little pissed...it won't shut down.

mine, looks just like that.
no targets in the SCSI windows
set-up, which means the target
is listed in the code of the process.
hidden

Originally posted by Sinny
I havent got the same as you OP...but I do have 3 unknown processes running without my consent called:
CSRSS.EXE
WINLOGON.EXE
EPOWEREVENT.EXE
Comp wont allow me to stop either of these processes...any ideas what they are?

i think the winlogon is a windows system process.
the others I do not know.

reply to post by boondock-saint


I think that does away with printer software as the cause...

I have a couple other computers in the house and none of them have this running...

Funnier yet...my wifes is just like mine, we got them at the same time...same everything, including printer software, and hers does not have this running.

Now I am curious...what the...hmmm....

reply to post by boondock-saint

Just posting a grabber before reading the thread...
Screen grab;

boon,

scsiaccess.exe

is usually a helper program associated with cd, camera, type programs.

as far as i know, it does not come with any programs (or trial programs either) that would be sold with windows 7 on a new pc.

there is a virus that uses that same name.....but little info is available, because it has not caused any major problems....just a pain in the ass if it slows the processor from time to time.


run task mgr.

look at the list of "processes"

if the "command line" tab is not visible,

click "view" in the top menu,

then "select columns"

the "command line" tab will show the location of the program....!

"right click" on the program line, then "open file location"

that will open the location folder where the thing resides.

then try to "end process".

try to delete......scsiaccess.exe


if you have unchecked it from startup, it may not be a problem.

it the damn thing persists....it might be a mild virus.....usually trying to send info to some data miner about what media you use....for ad purposes.

it is possible that it will start "on its own" if it is on some kind of "timer" clock......data mining does that.

"Basically, it would be like turning your car off
and as you get out, it cranks back up on it's own." is a good description !

good luck.

is your machine slow or "draging" ?

if it is, try to get rid of the program.

reply to post by Sinny


CSRSS.EXE

CSRSS hosts the server side of the Win32 subsystem. It is considered a system critical process, and if it is ever terminated you'll get a blue screen. More data is necessary, but you need to find out if some process is terminating csrss, or if it is crashing due to a bug.

WINLOGON.EXE

Winlogon sets the protection of the window station and corresponding desktops to ensure that each is properly accessible. In general, this means that the local system will have full access to these objects and that an interactively logged-on user will have read access to the window station object and full access to the application desktop object.

EPOWEREVENT.EXE

you wouldn't want to disable any of those three if you want your windows to run properly.

-

as to the OP, just uninstall Alcohol Soft 120% (use Revo Uninstaller then run CCleaner afterwards if you're feeling paranoid). and read the link in sm0k3's post.

reply to post by boondock-saint


did it come from a porn site maybe?

Originally posted by Xcathdra
reply to post by boondock-saint

 

did it come from a porn site maybe?

I have no idea where it came from
2nd

reply to post by toreishi


would love to uninstall Alcohol 120.
However, it has never been installed
on my machine that I know of.

How can I uninstall something
that is not there ???

just the scsiaccess.exe

OK.

When I told it to end the process, my browser closed.

I discovered by following advice of others in the thread and found what I believe to be the culprit.

I'm using a Dell- and this has a path leading me to believe this is a product of Dell. I'll be checking for your reply Boon before I get all "unplugged"...

I forgot to mention that I scanned the file with my Avast and it found no threat...

reply to post by loveguy


Mine is not a dell...so that can't be it!

Same thing though when I end task it closes my browser...but it starts up again all on it's own.

Originally posted by boondock-saint

Originally posted by Xcathdra
reply to post by boondock-saint

 

did it come from a porn site maybe?

I have no idea where it came from
2nd

Sorry.. That was not a serious questio, but more of a tongue in cheek sarcasm thing .

I have an HP laptop, and chceked for the files listred and they are not present.

Question about the remote access scsi. Out of curiosity what version of windows are you running, and could it possible have anything to do with the Windows remote assistance program you can opt into / out of? If I remeber right it allows others to access your computer to assist you with troubleshooting.

Even if you dont use it, if you have the option selected it will still "turn" the program on and ger your computer up for remote assistance.

Windows Remote Assistance

Possibly an explanation?

reply to post by boondock-saint


Is it SCSI or iSCSI? Those are different things, as far as I know.

You can try Process Explorer and see what information it shows about that process.

You can also try a search on the Registry to see if you find how it got installed.

But I don't think you should worry about it.

guys,

check my post again...

www.abovetopsecret.com...

reply to post by Xcathdra


Hi Xcathdra.

I have my remote access turned off, but I do have a support crapola I'm going to opt out of promptly!

Have a good day.

reply to post by boondock-saint


first off, i'll assume that you're using a limited account to logon to windows. you must be logged in as Administrator to disable system services. you can do this by following these instructions. it should open a command prompt (black window thingy). after that's done, type the following and press enter:

sc config MSiSCSI start=disabled

good luck!

p.s. what version of windows are you running?

EDIT:

it should be:

sc config MSiSCSI start= disabled

NOTE: space after the equal sign