Virus/Spyware Popups

[thomas__hb]

My friends computer has popups while not connected to the internet, in the guise of a windows dialog box. They are obviously malware of somesort. When they do popup, i have, in the Task Manager, right clicked on the prog ( called Messenger Service) and clicked, go to process. This then shows "csrss.exe" apparently a critical system process that cannot be closed. I did a search and this .exe comes up in the System32 folder in c:\Windows. I don't want to delete it in case it causes other problems, but AdAware with the latest update doesnt detect it.

Any Ideas?

[EzyStvy]

You need to go into services and look for whatever it is that's on the system and stop it there first.


CSRS.exe

Windows NT4//2000/XP/2003 only. CSRSS is the Client Server Runtime SubSystem. CSRSS is started by SMSS. When the user application makes a Win32 API call, it is usually CSRSS which communicates with the operating system’s Kernel to execute the API call. CSRSS is also known as the Win32 Subsystem.

Recommendation :
An integral part of the operating system, leave alone.


"The pages below are from our in-house database and provide guidance on the usefulness or not of these programs, and removal procedures when recommended."


http://www.answersthatwork.com/Taskl...s/tasklist.htm

[thomas__hb]

I've disabled a service called "alerter", which is apparently created by Microsoft.

I'll wait and see what happens as to whether or not these popus continue...

[Markoman01027]

if your friend has internet access on the computer, tell your friend to download spybot search and destroy, aswell as Adaware and update both programs first before your friend scans for spyware.

wouldn't hurt to do a virus scan at www.trendmicro.com or you can always get AVG if you do a google search for it

[thomas__hb]

I've been here 12 hours and while they used to occur every 10 minutes, they havent since my last post. Thanks for your help.

[Heyjude04]

Go to ad-aware.com and download ad-aware. It should get rid of any spyware that is present on the computer. Just make sure you update.

[thomas__hb]

Originally Posted by Heyjude04 Go to ad-aware.com and download ad-aware. It should get rid of any spyware that is present on the computer. Just make sure you update.

Please see first post, i clearly pointed out i had updated definitions...
You would also have noticed, had you read the thread thoroughly, that AdAware didn't fix the problem, and that the problem has, separate of Adaware, been fixed, and i hope you realise that posting for the sake of posting does nothing to make you appear knowledgable...

[Redfallon]

I would still recommend spybot in addition to the updated adaware you currently use. The two programs search for/remove different things, and one may find alot when another finds none. You are correct, the alerter service is the one some spyware exploits to send pop ups, however shutting it down doesn't remove all the spyware from the computer. Does the computer have a hardware or software firewall? I beleive alerter allows incoming "msgs" via an unblocked port, does the computer have a broadband connection?