[happyrock]

post # 40 has the link

[Advertisements]

you also can download IE6 here and see if you can do the online scans...

http://www.snapfiles.com/get/ie6.html

[happyrock]

you also can download IE6 here and see if you can do the online scans...

http://www.snapfiles.com/get/ie6.html

[Renna]

Ok so just downloaded the regseeker thing. It comes up with 2 folders on the screen...one that just has "..." next to it and one that has "regseeker".
There are buttons all along the top " Add, Extract to, Test, View, Delete, Find, Wizard, info, virus scan, comment and SFX".
DO I have to open a certain folder within the regseeker? and then hit virus scan?

[Renna]

Bah! Just tried the snapfiles link. Says it can't install the explorer because there's a newer version already on the system, even though I took it off! Grrrr! Calm...calm.......ok. So what do I do with the regseeker again? Sorry, brain is like a siv, nearly bed time!

[Renna]

ok.....I'm cleaning the registry now.....getting there! Got the blonde wig on tonight. Yeesh!

[Renna]

Just cleaned it.....lots on there! But CPU is still at 100%.
Right, well it's my bed time now! Thank you so much again for your help. We'll attack something else tomorrow!

[happyrock]

when your up and moving get ...Security Task Manager
Security Task Manager displays detailed information about all running processes (applications, DLLs, BHOs, and services). For each process, it improves on Windows Task Manager, providing file path, security risk rating, description, start time, CPU usage graph, embedded hidden functions (for example keyboard monitoring, autostart entry, and browser supervision or manipulation), and process type, such as visible window, systray program, DLL, and IE plug-in. The security risk rating indicates the likelihood of the process being potential spyware, malware, a Trojan, or keylogger. It also deletes traces of your Internet and computer activity, prevents keyboard input monitoring, and warns you when the registry is changed.

It will look like this when you install and run it...we will see what all is running to be sure its not some malware...use printscreen to get a pic of it when its running and post it in your reply

http://www.download....4-10408960.html

Edited by happyrck, 20 July 2006 - 05:56 PM.

[computerwiz12890]

he's probably down at some bar trying to clear his mind.

Funny, but not true I've been busy with work. It's not easy being an IT guy at the 3rd largest bank in Louisiana. Especially when that bank thinks 5 IT guys is all it needs!! Plus I was hoping you'd get it solved so I could just kick back and relax

HappyRick, I'm sorry to say, but I think you are WAY off track! And asking someone to do virus or spyware scans when you are NOT a malware expert is a very BIG If you suspect that, you MUST send them to the Start Here Link and then the malware forum.


From what I see in the Filemon log looks almost 100% like corruption. There are files that csrss.exe is accessing over and over and over again. This is not normal. Those files are legitimate. So I'm almost positive it is NOT an infection.


More likely, it is either corruption, or it is a bug in one of the latest Windows Updates that you've downloaded.


Can you remember EXACTLY when this started happening?? If so, I would try a system restore back to a point in time before this mess started. But if it happened more than 2 weeks ago, I wouldn't try it.

If that is the case, I will write a batch file which will replace the files that appear to be corrupt. This may not work though...

If possible, try to find a friend of yours that has a Windows XP CD that has the same version of XP that you use on your computer. We may NEED this. Hopefully not though. There is one thing that we could do to see if this is definately corruption.

To test the corruption theory out, do this:

Go to Start, Run, type sfc.exe /scannow and press enter. If there is any corruption, it will ask you for your Windows XP CD. If you encounter this, let me know. Since I will know it is DEFINATELY corruption

You may be able to repair this corruption without the XP CD. Try this: Go to Start, Run, type chkdsk /f /r then press enter, type Y to confirm for next boot, press enter then reboot.

Windows will appear to load normally, then the monitor will show progress of the scan, rather than going to Windows. Do not disturb this. This will take an hour or so before it gets to the desktop.


Sorry for writing so much. I had to make up for my "absence". Let me know if you need any clairification. The only problem is that I will NOT have access to the internet for Friday - Sunday. I hope you'll be able to wait that long Renna.

Edited by computerwiz12890, 20 July 2006 - 06:21 PM.

[happyrock]

glad your back....online virus scans are not uncommon and are used all the time...without any problems I might add...and I clean up infected systems constantly...about 3 to 5 per week and have been doing it for over 2 years without yours or anyones help...although some were so infected a reinstall would have been faster....I was about done and about to suggest a repair of windows..but was saving that for last as you have to get all the updates again and I wanted to see if she had any suspect process's running

[computerwiz12890]

online virus scans are not uncommon and are used all the time...without any problems I might add

No argument here. But that's not my point. You can not give ANY type of malware advice anywhere on the board. Unless you have been through GeekU and graduated. You cannot tell users to do malware scans then give you the results. If you suspect they may have any malware...you MUST send the user to the Start Here Link or to the malware forum. Period.

I wanted to see if she had any suspect process's running

Using Security Task Manager to find that out is acceptable, and if you found anything you should immediately send them to malware. As for asking for a House and Panda scan, that is not allowed. Since I do not believe it is malware, we will move on.

But note for future referance that you cannot ask a user to do a malware scan.

Edited by computerwiz12890, 20 July 2006 - 06:47 PM.

[happyrock]

I post on several boards and dont always remember what site I'm on...I usually have about 20 working threads...I don't know exactly what her problem is and in having her do the online check I didn't realize would be in violation of your rules here...

[computerwiz12890]

I understand. And I myself find it strange that that rule is not in our Terms of Service. But if one of the administrators or moderators saw you asking for scans, they'd be fussing at you too.

I am almost certain her problem is corruption or a Windows Update with a programming bug. We may need an XP CD in order to repair it, possibly without doing a full XP repair.

However, I'm hoping she'll have a restore point before this mess started. Or, I can write a batch file to replace the files that appear to be corrupt. But that is a long-shot.

So...we will most likely need an XP CD. In which we will do sfc /scannow and let it replace the corrupt files. Or if that doesn't work, chkdsk /f /r. And, if still no go, then a full Windows repair.

Though I'd like to see if my batch file will work before we do sfc or the repair. If she does not have a restore point, have her run chkdsk. And if that doesn't work, as soon as I get the internet on Monday, I will write the batch file and hope it does the trick

Edited by computerwiz12890, 20 July 2006 - 07:01 PM.

[happyrock]

in post 22 she said she doesn't have a disk..it was a gift from ebay...she will have to get rc.iso for the repair...I hope your batch file works I dont think restore is going to work as this has been going on a long time so with the system check points fillig up the restore space ..she probably has a batch of "bad " ones

[happyrock]

I'm afraid I too will be offline until Monday morning...I'm in oregon and its getting hot inland so I'm headed to the coast for the weekend...I'm leaving in about 2 hrs

[Renna]

Hi guys, just at work checking the old board!
The problem has been going on for a lot longer than a couple of weeks...have already tried doing a system restore when it started having a heart attack but it woldn't do it.
So I'll run that sfc jiggy thing etc etc when I get home. Can live without the net for the weekend no worries! Just want my lil laptop fixed *sigh*. [bleep] bugs! Who invents these stupid things ANYways, cause so much trouble! grrr.
Hey Wiz, HappyRck got me to eable active x controls and java yaddah yaddah on my internet security options. Are they ok to leave or should I turn them all back to what they were?