Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Virus Crazy! Please Help!

  • Please log in to reply
1 reply to this topic

#1 caleman22


  • Members
  • 86 posts
  • Local time:03:26 PM

Posted 23 November 2005 - 09:07 PM

Hello everyone, I am in serious need of help. I am being forced to use my second computer. I have tried everything I could think of; nothing seems to help. Here's the story:

I run windows xp home, norton systemworks 2003, ad-aware professional, microsoft anti-spyware,spybot, stopzilla, registry mechanic and a couple other random pop-up spyware cleaner programs. I have ad-aware's ad-watch running 24/7, and run virus scans every few days, and spyware scans even more often.

About two weeks ago, norton told me that it found a hacktool virus called "csrss.exe" and was unable to remove it. I searched for the file and could not delete it. Even a full norton scan would not delete the file. Since then there were two "csrss.exe" processes running and they were too similar to tell apart. They were in the same folder and had the same dates. Although i was worried about this virus, it affected nothing about my computer. I searched the net for programs that would removeit with no luck.

2 days ago, norton was popping up with the warnings about the csrss.exe file, but it was also saying that there was a file called "ntsrv.exe" and that it was a trojan and could not be removed. So now i have two viruses, csrss.exe and ntsrv.exe. norton still does nothing to get rid of it. I even downloaded a trojan remover and it would not fix either problem. My computer is now running slower. I just don't know where to go or what to do now. Is it over?? will i have to erase everything and install XP again? is there any programs out there that will help?

BC AdBot (Login to Remove)


#2 tg1911


    Lord Spam Magnet

  • Members
  • 19,274 posts
  • Gender:Male
  • Location:SW Louisiana
  • Local time:02:26 PM

Posted 23 November 2005 - 10:55 PM

NTsrv.exe - Added by a variant of the SERVU-O TROJAN
SERVU-O TROJAN - a hacked version of a legitimate FTP server application.
The Trojan reads configuration data from a file called tcp_systemstart.sys.

csrss.exe - Microsoft Client Server Runtime Process (legitimate file) or any number of bad processes
Click on the Startup Programs link at the top of this page and search for this file, to see what else it could be.

What "trojan remover" did you download, and try?
I suggest you try:
ewido security suite - offers protection against urgently growing threats like Trojans, Worms, Dialers, Hijackers, Spyware and Keyloggers.

When installing ewido security suite, under Additional Options uncheck:
Install background guard
Install scan via context menu

How to remove a Trojan, Virus, Worm, or other Malware

If this doesn't help, I suggest you post a HijackThis log for examination.

Read How to post a HijackThis Log.
Please read, and follow, all directions carefully.

Then, run a log, and post it in the HijackThis forum, at this link. Do not, fix anything, yet.
A member, of the HJT Team, will help you out.
It may take a while to get a response, because the HJT Team are very busy. Please, be patient, these people are volunteers. They will help you out, as soon as possible.

Once you have made the post, please, DO NOT make another post in the HJT forum, until it has been responded to by a member of the HJT Team. The first thing they look for, when looking for logs to reply to, is 0 replies. If you make another post, there will be 1 reply. The team member, glancing over the replies, might assume someone is already helping you out, and will not respond. So, just make your post, and let it sit there, until a team member responds. This way you will be taken care of, in the most timely manner.

If you follow these instructions, you shouldn't have to reinstall Windows.
MOBO: GIGABYTE GA-MA790X-UD4P, CPU: Phenom II X4 955 Deneb BE, HS/F: CoolerMaster V8, RAM: 2 x 1G Kingston HyperX DDR2 800, VGA: ECS GeForce Black GTX 560, PSU: Antec TruePower Modular 750W, Soundcard: Asus Xonar D1, Case: CoolerMaster COSMOS 1000, Storage: Internal - 2 x Seagate 250GB SATA, 2 x WD 1TB SATA; External - Seagate 500GB USB, WD 640GB eSATA, 3 x WD 1TB eSATA

Become a BleepingComputer fan: Facebook

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users