Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Got a Virus Of MSN


  • Please log in to reply

#1
kranmer

kranmer

    New Member

  • Member
  • Pip
  • 3 posts
hello i got a link in MSN last night clicked it and got infected. and just so people know if it is the same virus you CANT run hijack this. csrss.exe and smss.exe terminate the process right away because they are infected files. and it also disables the regedit and admin tools.
and the link to the virus was a http link to a site called imzone.
if anyone could help i would really appreciate it. i am currently trying to fix this myself but havent been able to do so yet.
(it allows the scanners to still work apart from hijack this but i think the virus might still be to new. i tried various scanners including norton, avast, Xoftspy and Spybot to see if they could do it but they didnt find the proccess all they found was reg values which as soon as you delete get put back into the reg by csrss.exe)

PS. i am know how to use hijack this because i have had malware before and the program works great but now everytime i open it csrss.exe closes it and it also closes any web sites to do with the program so people who dont have it cannot download it from the offical site.

Edited by kranmer, 26 October 2005 - 03:22 AM.

  • 0

Advertisements


#2
kranmer

kranmer

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
ok i fixed the problem. i booted in safemode and deleted
C:\WINDOWS\System32\rrcvkvghyu\csrss.exe
C:\WINDOWS\System32\rrcvkvghyu\smss.exe
then i used Xoftspy to fix my registry and remove the other files it installed. then i manually edit the registry to remove
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load=C:\WINDOWS\System32\rrcvkvghyu\csrss.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windowsload=C:\WINDOWS\System32\rrcvkvghyu\smss.exe
and now my PC works again.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP