Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am helping out a coworker with Winodws XP 32-bit, and took off a Trojan using Malwarebytes, Spy-bot Search and Destroy, and Trojan remover with total annihilation of the Trojan. I also had to find the folder and delete the folder that the Trojan was living in. There are four pops ups (below) that keep coming up when the user logs in though, all warning about not being able to find some crss.exe.

I checked in the run and runonce areas in the registry (both of them) to see for leftovers of the Trojan to no avail. I then made a backup of the registry and let CCleaner "try" to clean the registry (but we know how registry cleaners can be). This didn't help either. Does anyone know anything that could help remove these pop-ups. The computer runs perfect now (no more Trojan), other than these four pop ups. Once you lick "OK" they go away, but they are irritating.

Thanks in advance for the help!

Pop-up 1 Pop-up 2 Pop-up 3 Pop-up 4

share|improve this question
Have you searched the registry for csrss.exe? – ChrisF Dec 8 '10 at 20:18
I did not think you using find in the four main registry folders, I will try that now and let you know the progress. Thanks! – David Dec 8 '10 at 20:35
@ChrisF Can you please make your comment into an answer? That fixed it. I want to give you the proper credit. Thanks a lot! – David Dec 8 '10 at 20:44
@David, any chance you could add the name(s) of the trojan to your question and its title? That way this question is useful for Googlers too, which we like, being a Q&A site. Thanks! – Arjan Dec 10 '10 at 15:06
Hmm... I will do some research to figure out the exact name of the Trojan virus. I should have done that when I had the Trojan still on the computer for future reference. Sorry. I will research right now. – David Dec 10 '10 at 18:51
up vote 6 down vote accepted

Have you searched the registry for csrss.exe?

It could well be that there are entries that CCleaner left. A search and manual delete should remove the final vestiges of the trojan.

Having heard bad things about CCleaner I'd want to double check that it had gone completely myself.

share|improve this answer
As discussed in the comments of the question, I wanted this question to be made so that ChrisF could get the appropriate acknowledgment for fixing my issue. THANKS!!! – David Dec 8 '10 at 20:51

Step one:) back up computer.
Step two:) format
Step three:) reinstall

Only 100% sure way to kill a bad infection

edit: Despite kill joy calling me a quitter... There is no way I'd use a computer after it's been infected. Even after using multiple popular and trustworthy tools, you are still infected.

How can you ever be sure that your not infected now? 100% confident? Guaranteed that some kind of back-door hasn't been installed? Something small time that hasn't been found by the other tools?

Answer: You can't. Time to format and start over.

I'm all for trying to fix it to learn the guts. I've learned a lot trying to fix various issues. But the issue is that you CAN NOT trust a computer that's been infected.

share|improve this answer
100% wrong... Sorry but you are very very wrong... This is the way a quitter fixes a computer, not someone who is trying to help. – David Dec 9 '10 at 13:52
It's the only way to be sure. Once someone else has hidden stuff, you can never be sure there isn't a trace or a backdoor. Or do you have proof that shows a tool that removes 100% of everything, everytime without fail or delay? If it was THAT easy to clean your system, then forums wouldn't be full of questions like this where AFTER running MULTIPLE tools they still have some kind of infection. Quitter? I'm not entering bank info on a computer I can't trust... Just like a GF that cheats on you. Trust is broken, time to start over. – WernerCD Dec 9 '10 at 15:09
No. This is how a person with any sense of security fixes an infection. It's not quitting to do something correctly just because the correct was is also the faster way. – Chris Nava Dec 9 '10 at 22:13

Open up msconfig and go to the Startup tab. If they're not in there, check out autoruns from SysInternals.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .