# Catroot



## tomatocurry1 (Jan 26, 2013)

My PC, Windows 8, is, for some reason, recursively executing catroot, sc, catrootsz, WerFault, conhost, and some other programs. I suspect this is all caused by a virus.
help?


----------



## OldGrayGary (Jun 29, 2006)

It appears likely that your suspicion of malware activity is correct. There is a System folder named Catroot, but I haven't found any mention of an executable named catroot.exe or catrootsz.exe in any version of Windows. There are reports of some malware executing under aliases of that filename. WerFault could be the Windows Error Reporting system getting a bit overworked trying to report system errors that could well be due to the activity of malware. Conhost is related to console use if I'm remembering right, a legitimate version lives in the system32 folder, but has been known to be compromised (sometimes completely replaced) by malware.

Seems like checking in with our malware experts in the Security forums is a good idea.
Virus/Trojan/Spyware Help - Tech Support Forum

Best of luck,
. . . Gary


----------

