NEED HELP NOW!

[Steve]

Well that depends on which trojan or virus you have - AVG or Spybot should be able to tell you. I just gave you the links to Symantec to let you see that crss.exe is not to be trusted and shouldn't be allowed out through your firewall. You've probably got quite a long job ahead of you cleaning this lot up by the sound of it.

[Steve]

One thing which you should do for starters is open Task Manager and click the Running Processes tab and end the process crss.exe - that also applies to any other processes which you identify as being malicious.

[SpyMaster]

The first trojan problem that I found. AVG calls it

Trojan horse Downloader.Swizzor.AND

don't know what the and is for. I'm scanning again anyway but a swizzor wasn't mentioned at synantec.


A change has also been noted on

ntoskrnl.exe by AVG whatever that is.


Anyway I don't think anything will get worse or slef-combut or anything if I go to bed as it is nearly 2am. I guess I'll try and fix it tomorrow unless you have any bright ideas about what to try next now.

Thanks Steve you've been amazing.


ETA Task manager won't let me end crss as it says it's a critical process

[Steve]

No, I don't have any bright ideas - it will be a long and tedious process to clean this stuff off there. You will need to make use of Task Manager a lot to kill running processes (malicious ones) and repeatedly run Spybot and maybe also AdAware until you have prevented these processes from re-starting. I heard somebody speaking very highly of an anti-spyware program yesterday. I'll have a look and see what it was called.

[Steve]

Okay, it was called Avast!. I haven't used it myself yet but I think I'll download it now and check it out.

Edit: I think Avast!4 is a full anti-virus program, similar to AVG. I'm happy with AVG so I won't download that, but the Avast! Virus Cleaner would probably be worth having. I'll download that one.

Edit: It only seems to be able to check for a limited number of viruses at the moment so it probably it isn't worth spending time on, unless you want to try the full Avast!4 product. The free version runs for 60 days. I don't know how useful it would be though. Maybe you should just stick with AVG / Spybot / AdAware.

[SpyMaster]

You said to kill running processes. How will I know which ones to remove and which ones are vital system processes that will crash my PC if ended? Also what about the ones like crss which won't be stopped?

I'm running AVG, that Avast and Ad Aware and then I'm going to bed. I've got what appears to be a java / open stream virus according to AVG which is concerning me as doesn't that mean information is being constantly sent? Like keystrokes and what have you?

How could one file cause so much trouble?

ETA. You said that my mp3 should be alright even though it was plugged in at the time. I just realised I didn't make it clear that I use it like a removable hard disk. In which case is it infected?
Also if worse comes to worse and I need to reinstall windows (lets hope and pray it doesn't come to this) can I plug removeable hard discs in or burn discs prior to doing that to get data off or would that copy the virus with it?

[Steve]

-------------------------------------------------------------------------

To determine if a running process is legitimate or not, use a reference list such as this one:

www.tasklist.org

and this one:

www.answersthatwork.com/Tasklist_pages/tasklist.htm

To check if a startup program is legitimate or not, use this list:

www.sysinfo.org/startuplist.php

There is a lot of useful info about startups on this page:

www.pacs-portal.co.uk/startup_content.php#THE_PROGRAMS

The most convenient way to see what is in your startup list is to run HijackThis and look at the '04' items but you won't able to do that right now, so go to Start - Run - and type msconfig into the text box. Then click on the Startup tab.

-------------------------------------------------------------------------

... what about the ones like crss which won't be stopped?

For running processes like crss.exe which refuses to be stopped, you will need to reboot into safe mode and delete the exe file (crss.exe) manually. If you prefer, you can rename them, e.g. from filename.exe to filename.exe.old

Then after everything is cleaned up and you are sure they are not required, you can do a search for files named *.old and then delete them.

-------------------------------------------------------------------------

It's safe to copy files to another hard-drive or burn to CD, because you would only be transferring data files. It will be system files that are infected, not data files.

-------------------------------------------------------------------------

Your mp3 player won't be infected. The 'operating system' (such as it is) will be stored in ROM (read-only memory), so even if some kind of infection got into the data area, it wouldn't be able to write to the system area because it's almost certainly read-only and it would be a physical impossibility. Actually it may not be read-only; it may be an upgradeable flash memory but even so it's highly unlikely to have been targetted.

-------------------------------------------------------------------------

Lastly, are you sure that you have no system restore points available? Was the feature really turned off? it might be worth booting into safe mode and seeing if it still says the same thing. If so then you're stuck and you'll have to fix everything manually but before I did that I'd check out safe mode first.

-------------------------------------------------------------------------

Oh yes, one more thing. You were worried that you might have a keystroke logger running. If you do, it would have to get past your firewall first, so go into your firewall settings and remove any applications which you don't recognise. If it later turns out that you have removed something which was required, it will just ask for access again next time it runs and you can allow it through. I'm running Zone Alarm Pro and I can do that here, but I think the basic version allows you to do that too.

-------------------------------------------------------------------------

[Mongoose]

I formatted my hard disk because a) new computer and b) it was such a mess because i downloaded so much rubbish and it left loads of viruses

[SpyMaster]

Well today has been exhausting. I've spent all day trying to get this fixed. I followed what you said about renaming the crss files

For running processes like crss.exe which refuses to be stopped, you will need to reboot into safe mode and delete the exe file (crss.exe) manually. If you prefer, you can rename them, e.g. from filename.exe to filename.exe.old

Then after everything is cleaned up and you are sure they are not required, you can do a search for files named *.old and then delete them.

I did that and logged out of safe mode for booting into normal mode and it wouldn't let me into anything. Not normal windows, not safe mode, nothing. I phoned up ABT (my grandfather has a subscription) and had to recover the operating system off the disc. I then still had the viruses. It wouldn't let me connect to the internet, it wouldn't let me use hijack this or msconfig. I've been working on getting rid of them all day.

I don't even think I have it fixed now I still have 3 running processes which symnatec lists as bad.
SMSS, CSRSS, LSASS and I can't end them as the task manager says this is a critical system process and that it can't end it. It says that in safe mode as well.

What can I do? I would not bother you again as you've been kind already but ABT aren't open till monday.

Also are you totally 110% sure that my mp3 player won't be infected. It's an iriver which means files can be copied to it like any flash drive. It's completely plug and play. I also have data files (video, pictures, html etc) stored on there in addition to music. Now I need those files but I'm too scared to plug it into my laptop incase it's infected or something and it screws up my laptop too. That's the one and only good thing about my laptop it's not got malicious stuff on it, it just doesn't have any files either.

Thanks
Spy_Master

[SpyMaster]

Ok it's letting me run everything now. Hijack this, msconfig, everything. So maybe it is fixed. It's not showing me the please wait screen or the windows start up screen anymore. I'm hopeful. Anyway here's my hjackthis logfile. I'm not entirely sure what it means although I know that some months ago you did explain it.

------------------------------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 22:31:46, on 12/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
D:\WINDOWS\System32\Ati2evxx.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\ZONELABS\vsmon.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\VERITAS Software\Update Manager\sgtray.exe
D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
D:\Program Files\Microsoft Hardware\Mouse\point32.exe
D:\program files\u-storage tools1.0\ustorage.exe
D:\Program Files\iRiver\iHP100\iHPDetect.exe
D:\Program Files\VoyagerTest\fts.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\Program Files\Common Files\AOL\ACS\AOLDial.exe
D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
D:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
D:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\RSSoft\RSEDNClient.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\Belkin\Bluetooth Software\BTTray.exe
D:\Program Files\AOL 9.0\aoltray.exe
D:\Program Files\AOL\Broadband CheckUp\bin\mpbtn.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\AOL 9.0\waol.exe
D:\Program Files\AOL 9.0\shellmon.exe
D:\Program Files\Common Files\AOL\aoltpspd.exe
D:\Documents and Settings\JEN\My Documents\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.rewnpqnieyechn.com/D0hYSWVJIzf580hvclwDefY16kl9r2PUKNEwiOlXDZnZGzZJZv9O_hs1bcf0x/aZ.php
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [MVRescue] C:\MVRescue\mvrescue quit
O4 - HKLM\..\Run: [StorageGuard] "D:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [UStorage] d:\program files\u-storage tools1.0\ustorage.exe sys_auto_run D:\Program Files\U-Storage Tools1.0
O4 - HKLM\..\Run: [iHP-100] D:\Program Files\iRiver\iHP100\iHPDetect.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "D:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [AOLDialer] D:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] D:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] D:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Red Swoosh EDN Client] D:\Program Files\RSSoft\RSEDNClient.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: csrss.lnk = ?
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: AOL Broadband Check-Up.lnk = D:\Program Files\AOL\Broadband CheckUp\bin\matcli.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = D:\Program Files\AOL 9.0\aoltray.exe
O8 - Extra context menu item: &AOL Toolbar search - res://D:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - D:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1F83F95-63BC-4837-96DA-102065815B5A}: NameServer = 205.188.146.145
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - D:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - D:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZONELABS\vsmon.exe

------------------------------------------------------------------------------


Thanks ;D

[Steve]

Leaving the mp3 player issue to one side for the moment, I'm sure I saw csrss last night while I was checking out crss - I seem to recall that csrss was a legitimate system file. I'll check again.

I ran your log through this analyser:
hijackthis.de/index.php
and it didn't like this entry:
D:\Program Files\RSSoft\RSEDNClient.exe

I don't think it's a major problem right now though so I'd leave it to one side for while.

It wasn't sure about this IP address: 205.188.146.145 but I checked it and it belongs to AOL so that's okay.

[Steve]

This page: www.answersthatwork.com/Tasklist_pages/tasklist_c.htm says that it's a legitimate system file, but it can also be a trojan element. The way to tell the difference would be by its location - I'll try to find out which folder the legitimate one should be in. Also, by right-clicking and looking at the file properties of csrss.exe you should be able to see which one originates from Microsoft. If you search your hard-drive for csrss.exe does it tell you that you have two of them in different folders?

[Steve]

According to this page: www.neuber.com/taskmanager/process/csrss.exe.html
csrss.exe should be located at c:\windows\System32 - if you have another instance of it in a different location it's likely to be part of a trojan.

[SpyMaster]

admin said:

Leaving the mp3 player issue to one side for the moment,

Sorry to be insistant but this is what I'm worried most about. If I'd had to wipe my hard drive I wouldn't have minded, all the files I use are on there. That way I don't need one copy on my PC and another on my laptop for when I need both.

Anyway is it clean or not? I tried googling it to see if mp3 players could be infected by attackers and all I got were articles about some creative mp3 players that had been shipped with a virus in them. While that wasn't reassuring it also wasn't what I needed to know.

I ran your log through this analyser:
hijackthis.de/index.php
and it didn't like this entry:
D:\Program Files\RSSoft\RSEDNClient.exe

I ran my logfile past that (I remember using that now) and I followed the instructions it gave me to fix it. I didn't recognize that rsssoft and from googling it I think it's probably nasty. I have a backupfile if not. I don't have any red exclaimation marks now and the orange question marks I know about. Well except for the fts thing but that's in the same folder as my modem drivers and I seem to remember needing it.

If you search your hard-drive for csrss.exe does it tell you that you have two of them in different folders?

I have it in 2 locations. System32, $NTServicePackUninstall$ and ServicePackFiles so I presume it's legit.

[SpyMaster]

I decided to bite the bullet and plugged my mp3 player in. I virus scanned it and scanned it with ad aware and they both pronounced it clean. So (touch word) I think I have a completely clean system now.

Steve I can't thank you enough. Reading back through my first posts and indeed probably up until now I think I was rude. I mean the topic title says it all. I was worried but that's no excuse and I'm sorry for that. Nothing I can say can properly convey my gratitude but thanks. You've really saved my bacon on this one.