Multiple instances (between 3 and 15) of this of this process Wslxrqjet.exe are running on my Windows 8 system at all times. Windows Task Manager 'Description' field for all instances is "Google Chrome". Yet I have uninstalled Google Chrome from my system.

Location of the executable on my system is C:\Users\RickReeves\AppData\LocalLow\Browseforchange\egdpdkynurp\gfuxocjp\Wslxrqjet.exe (840 kb).

Constantly changing program memory entry is 37,676.

Of course I tried deleting it, but since it is an active process, I can't delete it.

A Google search for this file reveals NOTHING.

Does anyone have any information regarding this program such as how to remove?

  • possible duplicate of How do I deal with a compromised server? – Deer Hunter Dec 12 '14 at 7:23
  • @DeerHunter This question does not address security, merely an unknown process, hence why I added 'malicious' to the tile in my edit. Not sure why it is unacceptable to you. – cremefraiche Dec 12 '14 at 7:33
  • @cremefraiche - when editing please take care to fix all the issues you can find, including typos and grammar. – Deer Hunter Dec 12 '14 at 7:40
  • Reference: meta.security.stackexchange.com/a/1570/13820 – Deer Hunter Dec 12 '14 at 7:44
  • 2
    Browseforchange is a browser extension where everytime you shop on a supported site, a small amount is donated to the charity (sounds more like phishing). Check IE if you have the extension installed? – void_in Dec 12 '14 at 7:50

Unless you know full info about the malware, or your AV itself removes it,It cannot be fully determined for sure that you have removed the traces. Even if you are able o delete that particular instance, if will re-spawn with a different name,

By the looks of your problem, the malware in install per-user wise rather than system-wide. (Because the extension/malware reside in localappdata)

The easiest way to get rid of problem is create the new user account. And then make sure you are not installing that plugin again.

If you can share more details I can give a better answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.