Windows cannont find 'C:WINDOWS\system32\wcrsbxulj\csrss.exe'

OK, this has been checked over and should now work properly. <crosses fingers>

 

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum]
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "=dword:00000001
"{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} "=dword:40000021
"{0DF44EAA-FF21-4412-828E-260A8728E7F1} "=dword:00000020

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername "=dword:00000000
"legalnoticecaption "=" "
"legalnoticetext "=" "
"shutdownwithoutlogon "=dword:00000001
"undockwithoutlogon "=dword:00000001

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters]
"ServiceDll "=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,\
33,32,5c,69,70,6e,61,74,68,6c,70,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall "=dword:00000000
"DoNotAllowExceptions "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "= "%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019 "
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe "= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0 "
"C:\\Program Files\\MSN Messenger\\msncall.exe "= "C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall "=dword:00000000
"DoNotAllowExceptions "=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "= "%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019 "
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe "= "C:\\Program Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail "
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe "= "C:\\Program Files\\IncrediMail\\bin\\IMApp.exe:*:Enabled:IncrediMail "
"C:\\Program Files\\Updates from HP\\137903\\Program\\BackWeb-137903.exe "= "C:\\Program Files\\Updates from HP\\137903\\Program\\BackWeb-137903.exe:*isabled:BackWeb-137903 "
"C:\\Program Files\\Messenger\\msmsgs.exe "= "C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger "
"C:\\WINDOWS\\system32\\rtcshare.exe "= "C:\\WINDOWS\\system32\\rtcshare.exe:*isabled:RTC App Sharing "
"C:\\Program Files\\NetMeeting\\conf.exe "= "C:\\Program Files\\NetMeeting\\conf.exe:*isabled:Windows® NetMeeting® "
"C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe "= "C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*:Enabled:TrueVector Service "
"C:\\Program Files\\Grisoft\\AVG Free\\avginet.exe "= "C:\\Program Files\\Grisoft\\AVG Free\\avginet.exe:*:Enabled:avginet.exe "
"C:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe "= "C:\\Program Files\\Grisoft\\AVG Free\\avgemc.exe:*:Enabled:avgemc.exe "
"C:\\Program Files\\Skype\\Phone\\Skype.exe "= "C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype "
"%windir%\\system32\\ccapp.exe "= "%windir%\\system32\\ccapp.exe:*:Enabled:System Process "
"C:\\Program Files\\IncrediMail\\bin\\ImLc.exe "= "C:\\Program Files\\IncrediMail\\bin\\ImLc.exe:*:Enabled:IncrediMail "
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe "= "C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail "
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe "= "C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk "
"C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe "= "C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe:*:Enabled:Remote Assistance - Windows Messenger and Voice "
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe "= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0 "
"C:\\Program Files\\MSN Messenger\\msncall.exe "= "C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone) "

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
"DefaultLaunchPermission "=hex:01,00,04,80,64,00,00,00,80,00,00,00,00,00,00,00,\
14,00,00,00,02,00,50,00,03,00,00,00,00,00,18,00,01,00,00,00,01,01,00,00,00,\
00,00,05,12,00,00,00,00,00,00,00,00,00,18,00,01,00,00,00,01,01,00,00,00,00,\
00,05,04,00,00,00,00,00,00,00,00,00,18,00,01,00,00,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00,01,05,00,00,00,00,00,05,15,00,00,00,a0,5f,84,1f,\
5e,2e,6b,49,ce,12,03,03,f4,01,00,00,01,05,00,00,00,00,00,05,15,00,00,00,a0,\
5f,84,1f,5e,2e,6b,49,ce,12,03,03,f4,01,00,00
"EnableDCOM "= "Y "
"MachineLaunchRestriction "=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\
14,00,00,00,02,00,34,00,02,00,00,00,00,00,18,00,1f,00,00,00,01,02,00,00,00,\
00,00,05,20,00,00,00,20,02,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,\
00,01,00,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,\
00,00,00,00,05,20,00,00,00,20,02,00,00
"MachineAccessRestriction "=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\
14,00,00,00,02,00,30,00,02,00,00,00,00,00,14,00,03,00,00,00,01,01,00,00,00,\
00,00,05,07,00,00,00,00,00,14,00,07,00,00,00,01,01,00,00,00,00,00,01,00,00,\
00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\ActivationSecurityCheckExemptionList]
"{A50398B8-9075-4FBF-A7A1-456BF21937AD} "= "1 "
"{AD65A69D-3831-40D7-9629-9B0B50A93843} "= "1 "
"{0040D221-54A1-11D1-9DE0-006097042D69} "= "1 "
"{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3} "= "1 "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\NONREDIST]
"System.EnterpriseServices.Thunk.dll "=" "

REGEDIT4

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa]
"Authentication Packages "=hex(7):6d,73,76,31,5f,30,00,00
"Bounds "=hex:00,30,00,00,00,20,00,00
"Security Packages "=hex(7):6b,65,72,62,65,72,6f,73,00,6d,73,76,31,5f,30,00,73,\
63,68,61,6e,6e,65,6c,00,77,64,69,67,65,73,74,00,00
"LsaPid "=dword:0000027c
"SecureBoot "=dword:00000001
"auditbaseobjects "=dword:00000000
"crashonauditfail "=dword:00000000
"disabledomaincreds "=dword:00000000
"everyoneincludesanonymous "=dword:00000000
"fipsalgorithmpolicy "=dword:00000000
"forceguest "=dword:00000001
"fullprivilegeauditing "=hex:00
"limitblankpassworduse "=dword:00000001
"lmcompatibilitylevel "=dword:00000000
"nodefaultadminowner "=dword:00000001
"nolmhash "=dword:00000000
"restrictanonymous "=dword:00000000
"restrictanonymoussam "=dword:00000001
"Notification Packages "=hex(7):73,63,65,63,6c,69,00,00
"ImpersonatePrivilegeUpgradeToolHasRun "=dword:00000001

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\AccessProviders]
"ProviderOrder "=hex(7):57,69,6e,64,6f,77,73,20,4e,54,20,41,63,63,65,73,73,20,\
50,72,6f,76,69,64,65,72,00,00

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath "=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,6e,74,6d,61,72,74,61,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Audit]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Data]
"Pattern "=hex:7c,50,d3,71,3c,20,52,f9,d9,5b,54,62,1f,a0,e4,18,36,38,62,38,65,\
35,33,64,00,00,00,00,01,00,00,00,b4,01,00,00,b8,01,00,00,34,ca,06,00,45,9d,\
bf,71,04,00,00,00,10,00,00,00,00,00,00,00,21,ea,06,56

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\GBG]
"GrafBlumGroup "=hex:da,17,3c,11,27,79,ec,63,f8

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\JD]
"Lookup "=hex:58,0a,c6,df,49,88

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Domains]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\SidCache]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\msv1_0]
"ntlmminclientsec "=dword:00000000
"ntlmminserversec "=dword:00000000

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Skew1]
"SkewMatrix "=hex:13,f6,01,60,71,ef,a5,10,c7,ee,0d,96,02,10,46,af

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SSO]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SSO\Passport1.4]
"SSOURL "= "http://www.passport.com "

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache]
"Time "=hex:06,eb,c6,ce,f1,38,c5,01

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache\digest.dll]
"Name "= "Digest "
"Comment "= "Digest SSPI Authentication Package "
"Capabilities "=dword:00004050
"RpcId "=dword:0000ffff
"Version "=dword:00000001
"TokenSize "=dword:0000ffff
"Time "=hex:00,d9,4a,94,f8,79,c4,01
"Type "=dword:00000031

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache\msapsspc.dll]
"Name "= "DPA "
"Comment "= "DPA Security Package "
"Capabilities "=dword:00000037
"RpcId "=dword:00000011
"Version "=dword:00000001
"TokenSize "=dword:00000300
"Time "=hex:00,d9,4a,94,f8,79,c4,01
"Type "=dword:00000031

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\SspiCache\msnsspc.dll]
"Name "= "MSN "
"Comment "= "MSN Security Package "
"Capabilities "=dword:00000037
"RpcId "=dword:00000012
"Version "=dword:00000001
"TokenSize "=dword:00000300
"Time "=hex:80,6f,e3,94,f8,79,c4,01
"Type "=dword:00000031

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify "=dword:00000000
"FirewallDisableNotify "=dword:00000000
"UpdatesDisableNotify "=dword:00000000
"AntiVirusOverride "=dword:00000001
"FirewallOverride "=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center]
"FirstRun "=dword:00000001

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun "=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
"DisableRegistryTools "= "1 "
"NoAdminPage "= "1 "



 

OK, lets run this registry fix and get a new HJT logfile please.

Also thanks for sticking with me as I fumble thru this.

Code:

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\policies\System]
 "DisableRegistryTools "=-
 "NoAdminPage "=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile\AuthorizedApplications\List]
 "%windir%\\system32\\ccapp.exe "=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
 "csrss "=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
 "Cryptographic Service "=-
 "BlockChecker "=-
 "csrss "=-

Also, once that is run, reboot your system then delete the BlockChecker folder from 'Program Files' and give me a fresh HJT log file please.

Also, let me know if regedit runs ok now.

 

OK, after examing the reg fix, a mistake was found, please do not run the last bit of code, instead, run this below, along with the other instructions.

Code:

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
 "DisableRegistryTools "=00000000
 "NoAdminPage "=00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Standard Profile\AuthorizedApplications\List]
 "%windir%\\system32\\ccapp.exe "=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
 "csrss "=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
 "Cryptographic Service "=-
 "BlockChecker "=-
 "csrss "=-

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\sr]
 "Start "=dword:00000000

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\srservice]
 "Start "=dword:00000002

 

Firstly.. How do i get a new HJT logfile?

And i also had a look for the BlockChecker folder and could not find it in 'Program Files'..

 

Just run HijackThis as you would normally.

Don't worry too much about BlockChecker, the fix did have some info for that.

 

Couple of questions Tammy had:

• Did you happen to have Combo fix ruining when you created the log from the reg search?
• Do you still have so much outgoing activity on those ports to those sites?

Let us know, thanks.

 

So just run HJT and scan the files, which then creates a log file? But, you wanted me to run the code.. How do i do that?

To answer the questions:

Did you happen to have Combo fix ruining when you created the log from the reg search?
- No i didnt..

Do you still have so much outgoing activity on those ports to those sites?
- i have no idea..

 

Yes on HJT, I think you have done it at least once already.

For the code:
Create a new folder on the desktop.
Copy the contents of the code box to Notepad.
Name the file inspect.bat
Save as Type: All files
Save in that new folder on the desktop.

Double click on inspect.bat and let it run.
When finished it will open a file in Notepad.
That file will be named lsa.txt
Please post the contents of lsa.txt into your next reply here.

OK, please let us know about the activity.

 

ok.. thanks..

I followed your instructions but when i opened the file named inspect.bat and let it run, this time it didnt open a file in Notepad

 

OK, I'm not sure why it didn't work, I'll have Tammy check the code.

 

My bad, that was a fix to merge info, not to produce a logfile.

Can we now get a fresh HJT log file and also let me know if any other problems persist.