Morning folks...my trusty wee Lenovo idea pad has become virused!! First time ever on this machine. I have the Interpol virus and I am trying to delete the process from the task manager in safe mode, only problem is that csrss.exe file is listed twice and each time I delete one and restart another process appears! I can only delete one item at a time in task manager so its a bit of a vicious circle....Any ideas that a NON IT bod like me can follow?

 

Cheers

 

Kit

Use something like this.

Boot into safe mode by pressing F8 on startup. Run something like malware bytes and then your anti virus software.

Find the file, not the process.

 

Now use task mangler on the process, and then delete the file.

csrss.exe is also a valid windows process that will restart if terminated. You need to make sure you are dealing with the right one.

Cheers guys:)

 

I've tried running Malware bytes in safe mode but it hasn't detected anything...nothing!! Seems suspicious to me!! At the moment I can't download anything else as the machine wont connect to my network and I cant plug it in with the Ethernet cable at the mo. Would trying to restore it to a previous date help then run Malware bytes?

 

Kit

The only way I've ever managed to get rid of this virus is a reinstall of Windows...

 

Probably not what you want to hear but this is a particularly nasty one and damn near impossible to get rid of.

I had some "nasty" infect my system the other day - I couldn't get it killed out the task manager.

 

Download Trojan Killer - although the trial version won't delete the software, it did manage to find it and terminate the process. Once terminated, I re-ran Malware Bytes and this found it to delete.

The only way I've ever managed to get rid of this virus is a reinstall of Windows...

 

Probably not what you want to hear but this is a particularly nasty one and damn near impossible to get rid of.

This. I never waste time trying to clean a virus infected computer or one that is 'running like a dog'. Its more or less impossible. I go direct to copy away data and reformat, since that is where you will end up anyway.

This. I never waste time trying to clean a virus infected computer or one that is 'running like a dog'. Its more or less impossible. I go direct to copy away data and reformat, since that is where you will end up anyway.

If I went down this route where would I start? My machine came with a preinstalled copy of windows and I don't think I have the key code for it. Id rather not go down that route I would be well out of my depth!!

 

K:)

Pre-Windows 8(8.1) Laptops/PC should have a sticker either on the base or under the battery cover with a 25 character key which is for activation.

 

Windows 8(8.1) have the Serial key hashed into BIOS, just put the correct version disk into the optical drive and force it to boot from it. It will find the key in BIOS and go through to install on which HDD or partition.

 

Windows 8(8.1) also has the ability to do a refresh back to stock from within windows.

Well Trojan killer found 167 items and i'm now running malware bytes again but it still hasn't found anything yet!!  If I go down the route of an uninstall is there a link to somewhere that will give me a step by step guide of how to do it? remembering I will have no clue !!!

 

Cheers

 

Kit

combofix is another good tool for removing hard to get at malware and viruses, it can be destructive so only use as a last resort.

http://www.bleepingcomputer.com/download/combofix/

Well Trojan killer found 167 items and i'm now running malware bytes again but it still hasn't found anything yet!!  If I go down the route of an uninstall is there a link to somewhere that will give me a step by step guide of how to do it? remembering I will have no clue !!!

 

Cheers

 

Kit

Which version of windows do you have?

If MWB isnt detecting anything, then it might have been damaged. Uninstall it and download and transfer over a new version (it has been recently updated).

 

Have you been using the full paid for of MWB, or the free version?? Most modern viri and trojans attempt to subvert the ACTIVE AV/AM programs, which is why I keep it as an "on demand" program only.

 

Spybot S&D is another good one to keep handy.

 

+1 for Combofix as well, but as mentioned, it can destroy your system, so back up valuable data first; really you should only use it under supervision from somewhere like Bleeping Computer - Computer Help and Discussion

Well managed to restore to an earlier date then run a bought version of Malware Bytes as I just couldn't get a free one to work!! So all good now But really think I should buy a new one!! This one was recommended on here by someone who said they were going cheap, think I only paid £220 for it and its served me well but think its time for something new....any ideas, this one is a Lenovo idea pad S12, so something similar would be good

 

Cheers for all the help folks

 

Kit

Most malware infects system restore points as it's the first thing most people try so use with caution.

Most malware infects system restore points as it's the first thing most people try so use with caution.

Normally the first thing I turn off if trying to disinfect a computer (and delete all restore points).

Well so far so good...machine seems to be fine now after restoring to earlier date...hope it lasts!!

 

Cheers

 

Kit