Help With Spywares! They Are Killing Me!

[citrus]

The past 4 days have been hell with spywares on my PC(Windows XP Pro). I installed 4 anti-spyware programs and 1 spyware scanner and they all did nada! The spywares kept reinstalling themselves anytime I restart my comp. Ok, I finally removed all of them manually except one stubborn one that copies the name of a legitimate Windows .exe file - csrss.exe, I've tried to remove this unsuccessfully. But now that I've even removed the rest, I'm still afraid to restart my computer for fear that all the ones I've removed will come back. My computer has been on since the day b4. I don't want to shut it down cos they might all come flooding back. Plssssssssss how do I remove them permanently...I mean FOREVER! These spywares are killing me!!!

[citrus]

Sorry, I forgot to add. Are these files legitimate files or spywares?
msnappau.exe
mortmled.exe

Thank you.

[gibbonsl]

might want to post this in here

http://www.short-media.com/forum/forumdisplay.php?f=57

[Trogan]

Hi!

About the two files you mentioned:

msnappau.exe - This is some MSN app and it may be legit. You need to find what location it is at.
mortmled.exe - This IS spyware.

Go here (http://short-media.com/download.php?dc=69), download Ad-Aware and SpyBot. Check for updates and scan your computer with them if you havn't already.

Also, downlaod HijackThis v1.99.1, get a log from it and post it in the SVT Forum (http://www.short-media.com/forum/forumdisplay.php?f=57) and someone will help you out.

Hope that helps

[citrus]

Thanks. I finally removed the csrss.exe and mortmled.exe. The only problem now is restarting my computer without spyware boomerang!!! I have Spybot, Ad-aware, Microsoft Anti-spyware Beta1 and Webroot Spysweeper. None of them could sweep these spywares until I removed them myself.

[Trogan]

You shouldn't have delete csrss.exe. Read Here: http://www.liutilities.com/products/wintaskspro/processlibrary/csrss/

Download HijackThis and post the log in the SVT forum if you want to make sure your computer is clean.

[citrus]

You mean I shouldn't have deleted csrss.exe? It's a Spyware!!! Actually there are 2 csrss.exe, One is real and one is fake...according to my spyware scanner. It uses the same name so that it won't be deleted. The real one is in %SystemDir% and the fake one is in %WinDir%. I'll post my log now. Actually, I've restarted my computer and nothing came up again..looks like I've finally kicked them all out!! ;D