Hi Guys,
As Samker advised you really need to run the Hijack This program and get us some logs posted up, as it looks like the infection has not been totally cleaned off although it could simply be the registry needs reseting to the default value as shown below.
Little Extract I found ages ago with a little extra Info from myself:
csrsc.exe is a process which is registered as W32.Spybot.CF Virus or one of it's variants. DO NOT confuse it with csrss.exe which is an important file used by Windows.
The attackers of this little file can access your computer and gain access to your data remotely via this file if it is not removed and also you may find it has imbeded itself inside your "Windows Backups" so everytime you perform a reset this little nasty will keep rearing it's head so ensure it's turned off befor running any clean up tools preventing the little critter form hiding from the cleanup process. Once your happy your system is clean delete all previous backups and turn the backup option back on and you should be good to go.
MAKESURE YOU HAVE SAVED ANY DATA YOU MAY WANT TO KEEP BEFOR DELETING ANYTHING INC any BACKUPS!!Try This:
1. Scan the system with a good and updated Anti Virus. (McAfee If you can get hold of it)
2. Open Task Manager, locate this exe (csrcs.exe or csrsc.exe but not csrss.exe), and kill the process.
3. Now type msconfig in the Run box, and then go to startup tab.
4. Locate the csrsc.exe entry, if it's there, then remove.
5. Now search for the file within the C: drive.
6. Permanently delete the file (csrcs.exe or csrsc.exe only) from the computer.
REMEMBER DO NOT DELETE "csrss.exe" THEY HAVE PURPOSELY BEEN NAMED LIKE THIS TO CONFUSE!!7. Reboot the PC And run an AV scan or run it online via Bitdefender's online scanner to make sure it's gone!!
As a Precaution and the weird thing is you dont need to run it on all machines infected with this type of Virus/malware but After doing the above steps, you need to clean the registry as well if your still getting any error's.
1. Run Regedit via Run
1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\
2. On the right side, there is a key named “Shell” near the bottom of the list, it may have a value “explorer.exe csrcs.exe”. Just modify it to delete the "csrcs.exe" from it so it shows as "Explorer.exe". Restart the computer and you should now find your problem gone.Hope this helps..
HD
Total Members: 14199
Topic: Windows Task Manager Disabled By Administrator (Read 9690 times)
