Is it a Virus?

Paul_Varjak

Some more info here:

http://forum.grisoft.cz/freeforum/read.php?4,28075,28081

especially as Goitster runs AVG!

Debt_Free_Chick

Paul_Varjak wrote:

Come on, surely someone can help Goitster!

If he had typed csnss.exe into Google, he would have found 155 hits, almost all of which are from anti-virus sites, which give full details of the worm involved and instructions for removal. All too often, the messages posted here about viruses, worms & trojans can be answered by a simple Google.

Better still, they can be avoided altogether by straightforward & simple security measures. He clicked on an attachment ... presumably from someone he did not know or recognise. That's a basic security breach. Never, never, never open an attachment unless you know exactly who sent it and why.

Personally, I find it incredibly frustrating that people expose themselves to such security threats. And even more frustrating that they can't or won't use Google as a first option for more information. Good though MSEers are at a wide range of PC problems, we certainly can't compete with the "big boys" when it comes to virus/malware detection and removal.

I've provided the solution for this particular problem, but the Goitster should dump MSN Messenger, which simply sends a lot of junk from people you don't know. It's an easy way to spread worms, trojans, viruses, spyware and malware. He also needs to implement a security strategy and there's plenty of advice on that here and out there - Google will help.

Debt_Free_Chick

Paul_Varjak wrote:

Some more info here:

http://forum.grisoft.cz/freeforum/read.php?4,28075,28081

especially as Goitster runs AVG!

Unfortunately, there's no help about removing it.

Goitster - use the Symantec link I provided earlier as it has a removal tool to strip the worm from your PC

Paul_Varjak

Debt_Free_Chick wrote:

Unfortunately, there's no help about removing it.

Yes there is, in the very first post! The guy removed it manually - which is what maybe what Goitster will have to do because he is seemingly offline and maybe cannot download removal tool!

Fran

I emailed your link Debt_Free_Chick when you first posted. Hopefully this will help!

Debt_Free_Chick

Paul_Varjak wrote:

Yes there is, in the very first post! The guy removed it manually - which is what maybe what Goitster will have to do because he is seemingly offline and maybe cannot download removal tool!

He removed some of it ... if you look at the Symantec link (the one YOU and I posted) you will see that there are a whole load of other files affected by this worm, including the HOSTS file.

Far better to use a specific removal tool to clean up all affected files.

Paul_Varjak

Debt_Free_Chick wrote:

He removed some of it ... if you look at the Symantec link (the one YOU and I posted) you will see that there are a whole load of other files affected by this worm, including the HOSTS file.

Far better to use a specific removal tool to clean up all affected files.

But can Goitster get on-line?

tru

How clever are these trojans? We had the same problem, I tried using a different computer to download trojan removers onto a cd then run it on the problem pc but it didn't work. I could get onto the internet but each time I went to the Panda or Housecall site the window closed, I'm sure the virus knew what I was looking for :rolleyes: In the end my sis-in-law printed off manual removal instructions (15 pages!!) from the TrendMicro site and brought it round to me, I had to go into the registry and delete loads of stuff.

Debt_Free_Chick

Paul_Varjak wrote:

But can Goitster get on-line?

Apparently yes, using his wife's laptop

Debt_Free_Chick

troo wrote:

How clever are these trojans? We had the same problem, I tried using a different computer to download trojan removers onto a cd then run it on the problem pc but it didn't work. I could get onto the internet but each time I went to the Panda or Housecall site the window closed, I'm sure the virus knew what I was looking for :rolleyes: In the end my sis-in-law printed off manual removal instructions (15 pages!!) from the TrendMicro site and brought it round to me, I had to go into the registry and delete loads of stuff.

The really clever ones identify all the common anti-virus/security products and terminate them. And they also modify the HOSTS file to block access to the common security sites.

In these situations, you need access to another PC to download the removal tool to a floppy, USB stick or CD (depends on size of removal tool) so you can then run it on your PC.

Better not to get this stuff in the first place. Most are spread from attachments. Be absolutely sure you know who sent you the attachment & why. Do NOT simply trust all the attachments from people you know. They could be the result of a trojan/worm infecting their system as they typically forward the problem to everyone in their address book. Don't be tempted to open an attachment unless you were expecting to recieve it. And look carefully at the file extension.