Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Got a Virus Of MSN


  • Please log in to reply

#1
kranmer

kranmer

    New Member

  • Member
  • Pip
  • 3 posts
hello i got a link in MSN last night clicked it and got infected. and just so people know if it is the same virus you CANT run hijack this. csrss.exe and smss.exe terminate the process right away because they are infected files. and it also disables the regedit and admin tools.
and the link to the virus was a http link to a site called imzone.
if anyone could help i would really appreciate it. i am currently trying to fix this myself but havent been able to do so yet.
(it allows the scanners to still work apart from hijack this but i think the virus might still be to new. i tried various scanners including norton, avast, Xoftspy and Spybot to see if they could do it but they didnt find the proccess all they found was reg values which as soon as you delete get put back into the reg by csrss.exe)

PS. i am know how to use hijack this because i have had malware before and the program works great but now everytime i open it csrss.exe closes it and it also closes any web sites to do with the program so people who dont have it cannot download it from the offical site.

Edited by kranmer, 26 October 2005 - 03:22 AM.

  • 0

Advertisements


#2
kranmer

kranmer

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
ok i fixed the problem. i booted in safemode and deleted
C:\WINDOWS\System32\rrcvkvghyu\csrss.exe
C:\WINDOWS\System32\rrcvkvghyu\smss.exe
then i used Xoftspy to fix my registry and remove the other files it installed. then i manually edit the registry to remove
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load=C:\WINDOWS\System32\rrcvkvghyu\csrss.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windowsload=C:\WINDOWS\System32\rrcvkvghyu\smss.exe
and now my PC works again.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP