Miata Turbo Forum - Boost cars, acquire cats.

Miata Turbo Forum - Boost cars, acquire cats. (https://www.miataturbo.net/)
-   Insert BS here (https://www.miataturbo.net/insert-bs-here-4/)
-   -   I think I have a virus.. or something? (https://www.miataturbo.net/insert-bs-here-4/i-think-i-have-virus-something-29154/)

ApexOnYou 12-12-2008 02:55 PM

I think I have a virus.. or something?
 
1 Attachment(s)
My internet started acting really weird last night. Random pages would not load, but others would load perfectly fine, and I knew that they were all available.

Today, whenever I search from my Google search bar, I get this weird pop up. Doesn't come up on any other pages, and doesn't come up if I go to Google and search from there.

Any ideas?

I know someone else posted recently asking about what programs to use to get rid of spy ware/viruses, but any recommendations? Key word - free. :)

ApexOnYou 12-12-2008 02:57 PM

Nvm now its doing it from the Google website itself, and my Gmail isn't working. Must be them.

Anyone feel like trying a Google search?

levnubhin 12-12-2008 03:03 PM

no problems here.
__________________
Best Car Insurance | Auto Protection Today | FREE Trade-In Quote

ApexOnYou 12-12-2008 03:05 PM

Yeah its me, a friend just confirmed Google is fine. Trying Malwarebytes..

naarleven 12-12-2008 03:29 PM

oh noes the notorious ruskie popup!!

ApexOnYou 12-12-2008 04:03 PM

I think I've tracked it down to csrss.exe, but it wouldn't delete.

Now whenever I search for it on yahoo/google, my search browser gets blocked. Sounds like that antivirus 2009 that someone else had.

WEAK!

Fireindc 12-12-2008 04:22 PM

Try this:

1. Backup all valuable files

2. Delete windows partition.

3. Create new partition.

4. Install Linux (Ubuntu ftw)

5. Never get a virus like that again.

ApexOnYou 12-12-2008 04:24 PM

Ok I am officially lost.

All but one of these were deleted

Malwarebytes' Anti-Malware 1.31
Database version: 1494
Windows 5.1.2600 Service Pack 2

12/12/2008 2:56:06 PM
mbam-log-2008-12-12 (14-56-06).txt

Scan type: Full Scan (C:\|)
Objects scanned: 84688
Time elapsed: 49 minute(s), 20 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 1
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
C:\Documents and Settings\All Users\Application Data\csrss.exe (Trojan.Agent) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\csrss7.dll (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\csrss (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\csrss7.dll (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Mike\Local Settings\Temp\csrss7.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Mike\Local Settings\Temp\jlw2rty7.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\Mike\Local Settings\Temp\e1ch3i5r.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\csrss.exe (Trojan.Agent) -> Delete on reboot.
Looked after reboot, and csrss.exe is still running. I'm assuming that means its still on my computer. My net problems are still here.

I saw this in the thread about antivirus 2009:

Originally Posted by Saml01 (Post 334102)
Easy as cake to remove.

Go to bleepingcomputer.com and download Combofix.exe. Run it, dont worry about recovery console, just run it. I cleaned 5 computers with it so far without a hitch.

Download MalwareBytes, run that after.

Download Spybot Search and Destroy, immunize your computer and run the scan.

DO ALL THIS IN SAFE MODE.

Install Avast Antivirus.

Done.

Does that apply to me? Do I really need to be in safe mode to get rid of these?

Braineack 12-12-2008 04:26 PM

you have to delete stuff while in safe mode...

Saml01 12-12-2008 04:33 PM


Originally Posted by Braineack (Post 340553)
you have to delete stuff while in safe mode...

Yea.

https://www.miataturbo.net/forum/t28522/#post334102
This should be a sticky in the archive.

Braineack 12-12-2008 04:37 PM

all I know is when i open this thread, my Acrobat 9 asks where my debugger is loaded.....odd.

RotorNutFD3S 12-12-2008 04:42 PM

In Soviet Russia, bear-porn f***s you.

If this is a recent change, you can do a System Restore to a earlier date. You will lose information saved between then and now, however, the bug will be gone too. Then get something like AVGFree or SpyBot Search and Destroy on your PC.

ApexOnYou 12-12-2008 04:56 PM

Tried running combofix but it just dumps right after I open it. I'm about to just have somene else do it, I have zero patience for computers!

hustler 12-12-2008 06:32 PM

I love the "K" bear. lolololoooool

adjemin 12-13-2008 07:48 PM

Sam and Apex, I went to bleepingcomputer and searched for combofix, to no avail. Would you mind posting a link? Thanks.

messiahx 12-13-2008 08:43 PM


Originally Posted by ApexOnYou (Post 340540)
I think I've tracked it down to csrss.exe, but it wouldn't delete.

Now whenever I search for it on yahoo/google, my search browser gets blocked. Sounds like that antivirus 2009 that someone else had.

WEAK!

csrss.exe is a valid windows process, but some malware likes to use the same name.

LOLA - 92 12-13-2008 10:20 PM

CSRSS7.DLL removal instructions:

1. Temporarily Disable System Restore, Reboot computer in SafeMode.

2. Locate CSRSS7.DLL virus files and uninstall CSRSS7.DLL files program. Follow the screen step-by-step screen instructions to complete uninstallation of CSRSS7.DLL.

3. Delete/Modify any values added to the registry related with CSRSS7.DLL, Exit registry editor and restart the computer.

4.Clean/delete all CSRSS7.DLLinfected file(s):CSRSS7.DLL and related, or rename CSRSS7.DLL virus files.

5.Delete all your IE temp files with CSRSS7.DLL manually, run a whole scan with antivirus program.

I cannot verify that this will work, but it is worth a try.

Alexa virus = POPUPTRAF.RU

ApexOnYou 12-13-2008 11:40 PM

Thanks for the info, i'll give it one more try before I bitch out and re-format lol.

Its good to know the name of the virus at least. Crazy Russians!!

ChairFaceChippendale 12-15-2008 07:24 PM


Originally Posted by Fireindc (Post 340551)
Try this:

1. Backup all valuable files

2. Delete windows partition.

3. Create new partition.

4. Install Linux (Ubuntu ftw)

5. Never get a virus like that again.


after not playing with it for a few years i just reinstalled linux (ubuntu) on both of my computers. smartest thing i've done in a while. if i didn't need to run windows/ie for a select few things i'd be done with it entirely.

to the op:

ad-aware is pretty sweet

ApexOnYou 12-16-2008 02:35 AM

I haven't played with Linux since Middle school, tried a bunch of different forms of Linux OS but never got it set up 100%, ended up going back to Winblows. Is there still a lot of down falls for running Linux, as in product support/drivers for hardware? What about just browsing the internet, you tube/applications and what not.

18psi 12-16-2008 03:39 AM


Originally Posted by ApexOnYou (Post 340992)
Thanks for the info, i'll give it one more try before I bitch out and re-format lol.

Its good to know the name of the virus at least. Crazy Russians!!

:giggle:
we try
:fawk:

turbobluemiata 12-16-2008 03:48 AM

Yea viruses suck so bad... ubuntu is good for surfing and youtube, thats how I ended up fixing the antivirus 2009 that I had, just reinstalled windows and have it dual boot and just used ubuntu for surfing and windows for megatune since I cant and dont wanna learn megatunix

ApexOnYou 12-16-2008 08:22 AM

See, I'm such a computer n00b, I didn't know you can do that.

ChairFaceChippendale 12-16-2008 07:02 PM

i had to play a little bit with my desktop to get everything working perfectly, but i did an in-windows install on the laptop and that worked flawlessly.

if you're curious all you really need is 8 gigs free for an in windows install and you can give it a try. if you don't like it you can go back in through windows and uninstall ubuntu like any other application. it's all much more user friendly than it was even 5 years ago. they have a pretty kickass help forum too.

johndoe 12-16-2008 08:18 PM

I just got an Asus eeepc 900ha yesterday and within hours I had somehow gotten a virus which redirected all my google searches and wouldn't allow me to open an virus scanners...
Luckily Asus knows how dumb I am and pre-installed a recovery partition on the HD. All I had to do was press f9 when booting and it reformatted the drive and reinstalled windows. Good as new. I feel for you. Whatever i got was a bitch.

turbobluemiata 12-16-2008 08:39 PM


Originally Posted by johndoe (Post 342363)
I just got an Asus eeepc 900ha yesterday and within hours I had somehow gotten a virus which redirected all my google searches and wouldn't allow me to open an virus scanners...
Luckily Asus knows how dumb I am and pre-installed a recovery partition on the HD. All I had to do was press f9 when booting and it reformatted the drive and reinstalled windows. Good as new. I feel for you. Whatever i got was a bitch.

you had the antivirus 2009 exactly what mine did


All times are GMT -4. The time now is 08:30 PM.


© 2024 MH Sub I, LLC dba Internet Brands