I need to remove some malware from my computer. It is a trojan, and very annoying. It blocks access to Google and search sites. The trojan, with its name spelled out on each line cause it seems to block sites when i reference it in a url, is

a r t (some text to mess it up) e m (more text i s

First off, what is it, what does it do? Second, why can't I access google or yahoo or any other search sites at all?

Third, can it be removed via McAffee? It says it quarantined it when I scanned

I found a suspicious process "c"s"r"s"s".exe and it will not let me terminate it, and this is what Mcaffee says it is. Why on earth isn't Mcaffee getting rid of it? I even blocked internet access for this program.

Thanks so much, I get kinda freaked out with things like this...

Here is my entire Hosts file:   go.mail.ru   nova.rambler.ru   google.ad   www.google.ad   google.ae   www.google.ae   google.am   www.google.am   google.com.ar   www.google.com.ar   google.as   www.google.as   google.at   www.google.at   google.com.au   www.google.com.au   google.az   www.google.az   google.ba   www.google.ba   google.be   www.google.be   google.bg   www.google.bg   google.bs   www.google.bs   google.com.by   www.google.com.by   google.ca   www.google.ca   google.ch   www.google.ch   google.cn   www.google.cn   google.cz   www.google.cz   google.de   www.google.de   google.dk   www.google.dk   google.ee   www.google.ee   google.es   www.google.es   google.fi   www.google.fi   google.fr   www.google.fr   google.gr   www.google.gr   google.com.hk   www.google.com.hk   google.hr   www.google.hr   google.hu   www.google.hu   google.ie   www.google.ie   google.co.il   www.google.co.il   google.co.in   www.google.co.in   google.is   www.google.is   google.it   www.google.it   google.co.jp   www.google.co.jp   google.kg   www.google.kg   google.co.kr   www.google.co.kr   google.li   www.google.li   google.lt   www.google.lt   google.lu   www.google.lu   google.lv   www.google.lv   google.md   www.google.md   google.com.mx   www.google.com.mx   google.nl   www.google.nl   google.no   www.google.no   google.co.nz   www.google.co.nz   google.com.pe   www.google.com.pe   google.com.ph   www.google.com.ph   google.pl   www.google.pl   google.pt   www.google.pt   google.ro   www.google.ro   google.ru   www.google.ru   google.com.ru   www.google.com.ru   google.com.sa   www.google.com.sa   google.se   www.google.se   google.com.sg   www.google.com.sg   google.si   www.google.si   google.sk   www.google.sk   google.co.th   www.google.co.th   google.com.tj   www.google.com.tj   google.tm   www.google.tm   google.com.tr   www.google.com.tr   google.com.tw   www.google.com.tw   google.com.ua   www.google.com.ua   google.co.uk   www.google.co.uk   google.co.vi   www.google.co.vi   google.com   www.google.com   google.us   www.google.us   google.com.pl   www.google.com.pl   google.co.hu   www.google.co.hu   google.ge   www.google.ge   google.kz   www.google.kz   google.co.uz   www.google.co.uz   bing.com   www.bing.com   search.yahoo.com   ca.search.yahoo.com   ar.search.yahoo.com   cl.search.yahoo.com   co.search.yahoo.com   mx.search.yahoo.com   espanol.search.yahoo.com   qc.search.yahoo.com   ve.search.yahoo.com   pe.search.yahoo.com   at.search.yahoo.com   ct.search.yahoo.com   dk.search.yahoo.com   fi.search.yahoo.com   fr.search.yahoo.com   de.search.yahoo.com   it.search.yahoo.com   nl.search.yahoo.com   no.search.yahoo.com   ru.search.yahoo.com   es.search.yahoo.com   se.search.yahoo.com   ch.search.yahoo.com   uk.search.yahoo.com   asia.search.yahoo.com   au.search.yahoo.com   one.cn.yahoo.com   hk.search.yahoo.com   in.search.yahoo.com   id.search.yahoo.com   search.yahoo.co.jp   kr.search.yahoo.com   malaysia.search.yahoo.com   nz.search.yahoo.com   ph.search.yahoo.com   sg.search.yahoo.com   tw.search.yahoo.com   th.search.yahoo.com   vn.search.yahoo.com   images.google.com   images.google.ca   images.google.co.uk   news.google.com   news.google.ca   news.google.co.uk   video.google.com   video.google.ca   video.google.co.uk   blogsearch.google.com   blogsearch.google.ca   blogsearch.google.co.uk   searchservice.myspace.com   ask.com   www.ask.com   search.aol.com   search.netscape.com   yandex.ru   www.yandex.ru   yandex.ua   www.yandex.ua   search.about.com   www.verizon.net   verizon.net
  • 2
    assuming those "'s are to break it up, that process is the Client Server Runtime Process, and you can't kill it because it's vital to windows' continued living. – Phoshi Oct 1 '09 at 21:40
  • It is to break it up, and that is the infected file. Thanks, that makes sense.. – Cyclone Oct 1 '09 at 21:42
  • Well, if I were a virus engineer, hijacking a vital process would be a nice start. System restore? – Phoshi Oct 1 '09 at 21:43
  • @phoshi I don't have a backup of my files, it is imperative that they are not lost. What is this virus and what does it do? – Cyclone Oct 1 '09 at 21:45
  • I'm afraid I've no idea what it does. Any files you have that aren't .exe should be entirely safe to back up without fear of possible reinfection, but any that are should be treated with suspicion until you can verify their integrity. Got an external HDD handy? :/ – Phoshi Oct 1 '09 at 21:48

Can you locate the executable? If so, boot into a linux LiveCD and blast it off the face of your filesystem. It may well recreate itself, if it's got hidden agents hiding around, so grab a copy of Autoruns and check what's loading behind your back.

edit: And have you checked your Hosts file?
That's where Pre-DNS level filtering happens, worth a look.

  • No, can't do it, don't have linux on a LiveCD – Cyclone Oct 1 '09 at 21:43
  • Everybody should have a linux liveCD! Can you boot into safe mode, then? – Phoshi Oct 1 '09 at 21:45
  • Idk lol, whats that? – Cyclone Oct 1 '09 at 21:51
  • I believe you tap F8 at some point during bootup. I tap it continually after POST, myself ;) Safe mode basically doesn't execute anything but what's necessary, so it's always worth a try. – Phoshi Oct 1 '09 at 21:59
  • AHA! My Hosts file has many things, all pointing to localhost – Cyclone Oct 1 '09 at 21:59

With out deeply inspecting your computer with a wide range of tools I doubt you will be able to manually remove the malicious software entirely. If you miss even a piece of it, as @ChrisF mentioned, it will probably try and undo any of your attempts to remove it. And in the age where viruses will not only hide themselves in system files but will corrupt your machine multiple instances of themselves and other viruses as well, it is almost impossible to manually clean a machine with any level of confidence that it is once again secure.

The only way to assure the virus is gone is to format the hard drive and do a clean reinstall of the OS. Now if you need to get your data off I would get a USB hard drive or some other external drive and an Ubuntu live CD (you can download an ISO and burn a copy to a CD).

  • Boot to the live CD and use Ubuntu to transfer your files to the external USB drive.
  • Once the files are backed up reformat the machine and reinstall the OS.
  • Once the computer is fully functional:
  • Plug in your backup drive and do a thorough virus scan of the drive to make sure none of your data is the source of the virus. It does no go to re-image when the source of the virus is a corrupted pdf, video, image, document, or other file.
  • Once the virus scan reports your backup as clean of infection move your files back over and reinstall your applications.

Good luck and good hunting.


The reason you can't get to Google and the other search sites is because the virus has added all those lines to your hosts file. The line: google.com

will mean that all requests to google.com will be redirected back to your machine, which obviously can't serve them.

As Phoshi says you should remove these lines from the hosts file. However, I would guess that the virus will try to recreate them the next time you boot the PC. By making the file read only it won't be able to update it again and you'll be able to connect to the sites previously blocked.

  • Done, read comments above. – Cyclone Oct 1 '09 at 22:47

Try Combofix It works well with problem such as this, best run it in safemode http://www.combofix.org/download.php


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.