Post reply

Name:
Email:
Subject:
Message icon:

Verification:
Type the letters shown in the picture
Listen to the letters / Request another image

Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

shortcuts: hit alt+s to submit/post or alt+p to preview


Topic Summary

Posted by: Samker
« on: 12. October 2010., 17:07:12 »

hey i need help..
due to virus attack on my computer running windows xp all admistrative privileges are disabled and also i m unable to open taskmanger, gpedit.msc , regedit, and also unable to install mcafee 8.5i aur some aur antivirus as it is saying that u dont have sufficient privilege to start the mcafee commonframe sevice....

plz help me


Hi basant.ece, don't worry We'll help you... first of all you'll need to Open your own Topic at SCF "PC Help Center" (simply copy-paste this post): http://scforum.info/index.php?action=forum

cya there,

S.
Posted by: basant.ece
« on: 12. October 2010., 15:56:15 »

hey i need help..
due to virus attack on my computer running windows xp all admistrative privileges are disabled and also i m unable to open taskmanger, gpedit.msc , regedit, and also unable to install mcafee 8.5i aur some aur antivirus as it is saying that u dont have sufficient privilege to start the mcafee commonframe sevice....

plz help me
Posted by: manual2100
« on: 12. October 2010., 12:34:29 »

this is a worm, i think virtumonde does this... check your pc with several tools in order to remove it..and if nothing works clean install windows again...
Posted by: Samker
« on: 23. June 2010., 20:24:24 »

Hey Samker and Hazedaze.

Sorry for the delay in my reply, my router broke and took forever to get back from suppliers. Hazedaze thank you soo much for helping me,it worked like a bomb. Both you and samker made my machine brand new. thnx again.

Sorry I didnt post the logs

Excellent News!  :thumbsup:

Fell free to contact us any time when you have problem with PC, we also count on your recommendation of SCF to your Friends...  ;)

Best Regards,

S.
Posted by: 1edge1
« on: 23. June 2010., 18:38:19 »

Hey Samker and Hazedaze.

Sorry for the delay in my reply, my router broke and took forever to get back from suppliers. Hazedaze thank you soo much for helping me,it worked like a bomb. Both you and samker made my machine brand new. thnx again.

Sorry I didnt post the logs
Posted by: hazedaze
« on: 02. June 2010., 17:05:46 »

Hi Guys,

As Samker advised you really need to run the Hijack This program and get us some logs posted up, as it looks like the infection has not been totally cleaned off although it could simply be the registry needs reseting to the default value as shown below.

Little Extract I found ages ago with a little extra Info from myself:

csrsc.exe is a process which is registered as W32.Spybot.CF Virus or one of it's variants. DO NOT confuse it with csrss.exe which is an important file used by Windows.

The attackers of this little file can access your computer and gain access to your data remotely via this file if it is not removed and also you may find it has imbeded itself inside your "Windows Backups" so everytime you perform a reset this little nasty will keep rearing it's head so ensure it's turned off befor running any clean up tools preventing the little critter form hiding from the cleanup process. Once your happy your system is clean delete all previous backups and turn the backup option back on and you should be good to go.

MAKESURE YOU HAVE SAVED ANY DATA YOU MAY WANT TO KEEP BEFOR DELETING ANYTHING INC any BACKUPS!!

Try This:

1.    Scan the system with a good and updated Anti Virus. (McAfee If you can get hold of it) :thumbsup:

2.    Open Task Manager, locate this exe (csrcs.exe or csrsc.exe but not csrss.exe), and kill the process.

3.    Now type msconfig in the Run box, and then go to startup tab.

4.    Locate the csrsc.exe entry, if it's there, then remove.

5.    Now search for the file within the C: drive.

6.    Permanently delete the file (csrcs.exe or csrsc.exe only) from the computer.
REMEMBER DO NOT DELETE "csrss.exe" THEY HAVE PURPOSELY BEEN NAMED LIKE THIS TO CONFUSE!!

7.    Reboot the PC And run an AV scan or run it online via Bitdefender's online scanner to make sure it's gone!!

As a Precaution and the weird thing is you dont need to run it on all machines infected with this type of Virus/malware but After doing the above steps, you need to clean the registry as well if your still getting any error's.

   1. Run Regedit via Run
   1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\
   2. On the right side, there is a key named “Shell” near the bottom of the list, it may have a value “explorer.exe csrcs.exe”. Just modify it to delete the "csrcs.exe" from it so it shows as "Explorer.exe". Restart the computer and you should now find your problem gone.


Hope this helps..

HD

 :up:
Posted by: Samker
« on: 01. June 2010., 13:51:18 »

Hi Samker, thanks for your help. I found the problem, it was a worm in the windows registry. Now its sorted. I havent run HJT yet because I didn't think it was necessary.

However a new problem arises. I get an error message that keeps popping up. "csrcs.exe not found" so I did a system restore and it is gone, but every once in a while it comes back. Should i run HJT just to be safe and post the logs?

Hi mate, I suppose that.

Best option is to provide us both logs (HJT and some Online Antivirus)... after that We'll have more information's about problem with csrcs.exe.

Maybe PC still have some traces of that worm...

I'll wait your next reply,

S.

Posted by: 1edge1
« on: 01. June 2010., 13:00:44 »

Hi Samker, thanks for your help. I found the problem, it was a worm in the windows registry. Now its sorted. I havent run HJT yet because I didn't think it was necessary.

However a new problem arises. I get an error message that keeps popping up. "csrcs.exe not found" so I did a system restore and it is gone, but every once in a while it comes back. Should i run HJT just to be safe and post the logs?
Posted by: Samker
« on: 28. May 2010., 12:40:37 »

Hi guys

My laptop suddenly decided to disable windows task manager by itself.
I dunno how this happened but I presume it was since I plugged in a flash drive, but here's the catch; the flash drive was clean and so is my computer.
I scanned with everything known to man and even tried a system restore.
I'm hoping that I do not need to do a reinstall.

Please help!!!

Thanks in advance


Hi 1edge1,

probably this is some worm infection but don't worry we will help you to fix this, now please:

1. Scan your PC with BitDefender or Panda Online AntiVirus Scan: http://scforum.info/index.php/topic,734.0.html

2. Download & run HijackThis: http://scforum.info/index.php/topic,785.0.html

3. Provide us logs from HijackThis & AntiVirus Online Scan


I'll wait your reply (with logs).

Regards,

Samker
Posted by: 1edge1
« on: 28. May 2010., 11:28:42 »

Hi guys

My laptop suddenly decided to disable windows task manager by itself.
I dunno how this happened but I presume it was since I plugged in a flash drive, but here's the catch; the flash drive was clean and so is my computer.
I scanned with everything known to man and even tried a system restore.
I'm hoping that I do not need to do a reinstall.

Please help!!!

Thanks in advance
Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising