Before this problem, i had another one ( but only that problem )
when i started my PC .. the mouse started to go like crazy !
and i MUST END a PROCCES called csmm.exe to STOP that .
after that i was bored to do that every time i start my PC .
so i looked in the MSCONFIG ( to find this file in START UP object's ,but i didnt find anything ..
so i searched for that file .. and i found it in windows/system32 i think .
then i deleted it....
after that, this problem is showing Sad
I tried to search my other PC to find this FILE ( so i could place it again in System32 .. but the other PC didnt have that file
i think this is kind of trojan or i dont know .
what should i do ?
what you should have done was to check what file csmm.exe is/was. unless your banned from google and/or your search button is boken, you would have found this:
ReplyDeletehttp://www.google.com/search?q=csmm.exe&hl=no&client=opera&rls=en&hs=3Ec&filter=0
update your virus engine a do a complete (full) scan, and see what happens. also, next time you get the urge to delete something you dont know what is - dont
u got a virus
ReplyDeletedropped files:
c:\WINDOWS\system32\csmm.exe Size: 41,050 bytes
c:\WINDOWS\system32\sxmm.dll Size: 25,088 bytes
startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"
old data: Explorer.exe
new data: explorer.exe C:\WINDOWS\system32\csmm.exe
u might wanna delete the registry key and the dll
It's Backdoor.Win32.VB.ays
ReplyDeleteDownload HijackThis
HijackThis current verison is v1.99.1
http://computercops.biz/zx/Merijn/hijackthis.zip
or here
http://www.spywareinfo.com/~merijn/
Make a new folder to put your HijackThis.exe into. Anywhere on your hard drive is fine other than your Desktop or the Temp folder. You can use C:\Programs\hijackthis (or anywhere as long it is on your hard).
Extract and save the Hijackthis download to the new folder you made. Then navigate to it and run HijackThis from there. (This is to ensure it makes the necessary backups for recovery if fixes are made.)
Then, doubleclick HijackThis.exe, and hit "Scan".
When the scan is finished, the "Scan" button will change into a "Save Log" button. Press that and copy & paste its contents here. Most of what it lists will be harmless or even essential, don't try to fix anything yourself if U aren't 100% sure about what U're doing.
I will be along to tell you what steps to take after you post the contents of the scan results.
All I could find about that prog is in Russian. Don't speak russian Very Happy
ReplyDeleteI don't see what and where its' exactly running. What I can't see I can't fix.
Let's do this:
Enable everything you have turned off in 'System Configuration Utility' (MSConfig.exe). This way your system will not hide any potential malware and hijackers.
Post a fresh HijackThis log. Afterwards you can turn off everything you had turned off. Do NOT restart your computer while everything is turned on
Please create a list of programs that can be removed using Add/Remove Programs
Start HiJackThis. Click "Config"->"Misc Tools"->"Open Uninstall Manager" ->"Save List".
Save the log to a convenient location, and copy it into this thread.