That file csrss.exe should be running directly from the system32 folder not from a folder inside system32 folder, I am very suspicious of it. The legitimate file is a very very very important windows file and this is why I am so cautious with this.
Do me a favor and do these three things please.
1. Click start> click run and type in msconfig >click ok then click the startup tab and look in there and see if this is in there, don't do anything with it just look please:
C:\WINDOWS\system32\fovncuf\csrss.exe---should not be there
2. Then go to system32 folder and open it and look for this folder (fovncuf)
open the folder and see if the file csrss.exe is in it and if it is right click and select properties and tell me what it says everything.
3. Then go back to the system32 folder and look for the same file csrss.exe right click and select properties and tell me everything it says please.
Here's what I have in System Config Utility...it won't let me see the file path, no right click, etc. I took a screen shot for you to see and attached it here.
csrss.exe attached as well is the properties for this file in System32
Oh boy, I think we got it!!!!...well, you got it!!! Upon restart, I didn't get the 4 error messages. But when I tried to delete the file in Killbox, it said it didn't exist...is that okay??
Here's my HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 9:12:06 PM, on 11/6/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Very much appreciated...and yes, you are funny, my heart took off there for a beat or two! LOL I'll be sure to spread the news that issues like this are guaranteed to be fixed by DAL!!!!
If you are no longer having any more trouble here is some preventative measures for you.
Here are some preventive measures you can take to keep your computer from getting infected again. also keep all these and Ad-awareSE and SpybotS&D updated.
To reduce the re-infection potential for malware and protect yourself against spyware, here are a few helpful suggestions:
1. Keep Windows and Internet Explorer current with the latest critical security updates from Microsoft. This will patch many of the security holes through which attackers can gain access to your computer. You CANNOT complete this update using an alternate browser. http://v5.windowsupdate.microsoft.co....aspx?ln=en-us
2. Run your antivirus software regularly, and to keep its definitions up-to-date. If you are thinking about switching, there are a some good free Antivirus programs that are decent, including AVG and Avast!. AVG:http://free.grisoft.com/doc/1
5. Consider using an alternate free browser for general web surfing but you must use IE for windows update. Mozilla Firefox: www.mozilla.org/products/firefox/
6. Consider increasing your browser security by using these programs: SpywareGuard will protect your homepage from being hijacked: http://www.javacoolsoftware.com/spywareguard.html SpywareBlaster will increase browser protection by blocking Thousands of known malware sites by adding them to IE's restricted sites zone. Download it here:
If you use SpywareBlaster, you can also use a customblocklist to add even more entries into IE restricted sites zone. Go to this site for the current list and how to use instructions: http://customblockinglist.cjb.net/
*Remember just like your primary anti-virus software, it is important to keep all of these programs up-to-date and use them on a regular basis. It's Free
Junior Member
