Administrative changes don’t apply to all users.

A little background first. We have had some serious problems with our user accounts. We have four currently and have had six total in the past. At one time all four of us had Administrative privileges. Because the computer had so many problems I took administrative privileges away from the kids and my Wife. I would like to get to the point where I am the only Administrator. The problem is that they can not access the things they want to do from there non administrator desktops, they get access denied messages when the try to access anything in their Documents and Settings folders under there user names. They also get a variety of different error messages. So I am letting them use my desktop or user name to use the computer. The same thing was true for my wife so I granted her Administrative privileges again. When I load my desktop I was getting a following error message.
Windows can not find "C:/Windows/System32/wbbspq/csrss.exeâ€make sure you typed the name correctly and then try again.
I used windows help and change the programs that run at startup and it prevented the error from loading when I start my desktop. But here is the kicker. When the others log on they do not get the same error and none of the changes that I made under startup loading took effect on any of their desktops. Why didn’t the change take place under there desktops? What can I do to make the changes take effect under all users? But wait there is more. One of the items I disabled at startup was MS messenger. It did not load at first but then later in the day it loaded. One of the kids did use it from my desktop and then logged off. Would this cause it to load again automatically? I hope someone can help me with these issues.
Thanks and Good Luck.

 

First thought is why windows is looking for csrss.exe in a subfolder of \system32. It should be in the \system32 folder NOT a subfolder. What is subfolder \wbbspq? Do a search and see how many and where csrss.exe is located. There should only be one. I suspect you may be infected with a virus or trojan. Have you scanned with a good virus program?

I may be wrong because I am definitey "network challenged" and will not only turn blonde, right before your eyes, but platinum blonde....

 

Thank You

Thank You both.

goddez1, I have a folder "Wbbspq" under C:\Windows\system32. The folder color is faded out, yesterday the folder would not open today it does and within there is a "csrss.ini ". Beneath all of the folders there is, among a million other doodads there is a "csrss.exe ". I searched "All Files and Folders" for "Wbbspq" twice, once with a capital W and once with a small w. No results either time, but holy cow they were there 'cause I saw 'em.
I am definitely computer challenged, but my eyesight is fine, you can turn any color you like.

Arie, I will try to follow your instructions to the "T ". It may be a while before I get the post into the suggested forum.

"I am not quite sure I understand everything I know about this stuff "

Good Luck to you both.

 

Arie, keep you updated here?

Would you like me to keep you updated here on things I think are important leading up to the new HJT post in "Removing Spyware and Viruses" forum?

Example, I ran my antivirus program and it did not find any viruses but it did give me several warnings. Would you like to see the notepad results? Here or in a new post? Is there a specific tittle you would like me to give this new post?

Thanks and Good Luck.

 

Hi again,
Background history, facts and errors added to your post in here may help and can be added, as a link, into your hijackthis.log, which should be posted in the security forum. The experts in that forum can understand more about what is going on from the Hijackthislog. Perhaps a short explanation including where csrss.exe was being looked for and the link from this post, will offer more of clue as to what is going on.

I am more curious in how you found yourself in this state and why csrss.exe is in the mysterious wbbspq folder. This is not really necessary at this point but more a point of curiosity as previously stated.

It is more important that you get that log in the correct forum so Trojan can be definitely confirmed or eliminated as your problem. A clean scan does not mean your clean. These critters, nowadays, are real sneaky.

____
I see Arie has responded ahead of me and has given instructions. It is best to follow his instructions.

 

Feel free to jump in.

godez1, by all means feel free to jump into the new post.

http://www.windowsbbs.com/showthread.php?t=61791

I am having one heck of a time trying to make things work the way TeMerc wants. Any additional advice is very much appreciated. Just keep in mind that the name fits. Actually I am not even a rookie, more like an infant when it comes to this stuff. Here is my famous quote.

"I am not sure I understand everything I know about this stuff "

That is sure to get ya in trouble.

It is off topic but maybe you can help me here one more time before heading over to the other forum. I have Word 2000 and for some reason all of a sudden, when I copy and paste these threads there, it no longer will copy the browser shortcuts, Huh? It just leaves a blank space where they should be in the text. It's like all of a sudden it acts different. I know it most likely has something to do with my infection but maybe you could point me to a fix.

Thank You and Good Luck.