30 replies to this topic

[Derek V]

Yes It's gone Fixwareout ver 1.003 Last edited 04/26/2006 Post this report in the forums please Reg Entries that were deleted HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\iahmd HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocne HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhps HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\mgcppp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\tesvaf HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\32refaselif ... Microsoft ® Windows Script Host Version 5.6 Random Runs removed from HKLM "dmhai.exe"=- ... PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. Example ipsec6.exe is lagitamate »»»»» Search by size and names... »»»»» Misc files »»»»» Checking for older varients covered by the Rem3 tool »»»»» Search five digit cs, dm and jb files This WILL/CAN also list Legit Files, Submit them at Virustotal C:\WINDOWS\SYSTEM32\CSRRS.EXE 155,648 2002-08-29

[Derek V]

One more thing, I have this CWS virus named feads, and I can't get rid of it. I try using CWS Shredder, and SBC yahoo antivirus, but It can't erase

[Micah_6:8]

Can you find/delete this file?

C:\WINDOWS\SYSTEM32\CSRRS.EXE <-- this file

EXTREMELY IMPORTANT!!!

The may be a file in there named csrss.exe

That file is a VALID WINDOWS application.

BE SURE AND DELETE THE CORRECT FILE!!!

Please note the difference in the file names!!!

Some malware files may be "hidden".
Be sure to show hidden files when looking.

Then empty it from the recycle bin.

Then run the program you ran earlier that was picking up some things, and let me know what it finds.

[Derek V]

I see the file, but I cannot delete it. It says application could not be run in Win32 mode? Maybe I need to run safe mode?

[Micah_6:8]

Don't "run" it, <right-click> on it and choose "Delete".

[Derek V]

I right click and clicked delete this time it says cannot delete CSRSS: Access is denied make sure the disk is not full or write-protected and that the is not currently in use. Im going to restart, and try again.

[Micah_6:8]

<right-click> on it and choose "Properties"

In the window that opens, look towards the bottom.

Next to Attributes:, if there is a check in the "Read-only" box, remove the check then click "Apply" then "OK", then try to delete it again.

[Derek V]

No same thing, anymore ideas?

[Micah_6:8]

Download Killbox from here:

Killbox.zip © Option^Explicit

Unzip it.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Now, run Killbox.

In Killbox select "Delete on Reboot".

Paste the next line into the "Full Path of File to Delete" text box.

C:\WINDOWS\SYSTEM32\CSRRS.EXE

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

When the machine reboots be sure it's gone.

[Derek V]

I wonder am I'm trying to delete the correct one. It says CSRSS client server runtime process. It doesn't say .exe. There's no exe.

[Micah_6:8]

See my last post.

[Derek V]

It says the file doesn't excist. I think that wasn't the .exe file, so I think my PC is clean now?

[Micah_6:8]

I just ran the program Xoftspy and it found 4 objects. One was a browser highjacker, worm, and two data miners. When I earse them they tend to come back. How could I prevent this from coming back? I have zone alarm pro, but I guess it does not seem to prevent viruses.

Run that program again, and let me know what it finds.

[Derek V]

It found nothing, it came out clean. I have to make sure I always open zone alarm pro before browsing. Thank You Micah if I have anymore problems I hope you are here. Thanks to you my pc is virus free, and running smoothly again. Thank You

[Micah_6:8]

You're welcome.

M68

Post Infection Items To Ponder