cssrss creating HQS Trojan at startup - Page 2

Ried · 06-19-2008, 10:06 PM

I'm not seeing anything new. Have you tried to reset AutoUpdate?

Click Start>Control Panel>Security Center

calvin333 · 06-19-2008, 10:10 PM

I just did that.
I didn't before because sometimes I get update messages from Adobe, Java etc. and I just don't trust auto updates very much...

By the way I did the DSS with internet connection open, but no other running application, is that OK?

Ried · 06-19-2008, 10:11 PM

Yes, that was fine.

Is AutoUpdate working now?

calvin333 · 06-19-2008, 10:13 PM

Yes
Internet connection showing getting stuff in... shield is yellow not green

Oh just found out because it found 2 new Windows updates and ask me if I want to install ... should I?

Ried · 06-19-2008, 10:16 PM

What did you set AutoUpdate to do? If you 'ticked' any circle other than 'Automatic (Recommended)' the shield will be yellow.

calvin333 · 06-19-2008, 10:21 PM

I believe the yellow is because I have updates not yet installed, I didn't set anything with AutoUpdate and may be it's default set to "prompt before installation".

I just checked... it's set to "automatic (recommended)."

Ried · 06-19-2008, 10:22 PM

Then yes, that's why it's yellow. Go ahead and update now.

You can feel free to set it to Automatic - this AutoUpdate feature only applies to Microsoft Updates - nothing else on your system.

Ried · 06-19-2008, 10:27 PM

You edited while I was replying.

What updates haven't you installed? If they are 'optional' or don't apply to your system, then check the box that says 'don't ask me again' when it shows up.

calvin333 · 06-19-2008, 10:33 PM

I updated two things...
first is KB898461
second is Windows Installer 3.1, then .... system prompt reboot to enable update ... so I reboot and now it's transmitting another update, but it's Windows stuff and not application.

Ried · 06-19-2008, 10:37 PM

That is as it should be. AutoUpdate is exclusive to Microsoft updates.

After it has finished updating, go ahead and carry out these final steps:

Delete SDFix.exe and it's folder located at C:\SDFix

-------------------

Create a new System Restore point

Click Start >> Run - type SYSDM.CPL & press Enter
* Select the System Restore Tab
* Tick on the checkbox - "Turn off System Restore on all drives"
Click Apply
* Then untick the same checkbox & click OK
This will flush out previous restore points (which contain the infections) and create a new restore point.

**************************************************************************************

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad.

SpywareBlaster 4.0 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.

It will block any bad ActiveX from running in Internet Explorer and Firefox if it's listed in their database (which you should update frequently). To view their database and list of restricted sites, launch the program and click on each of the tabs on the main display page.

IESpyAD Zoned Out to block access to malicious websites so you cannot be redirected to them from an infected site or email. This severely impairs attempts to infect your system as it basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.

Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released.

In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:

PC Safety and Security--What Do I Need?
Think Prevention

HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein
MAKING INTERNET EXPLORER SAFER
Understanding and Using Firewalls

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

-----------------------------------------------------

Follow the list above and the potential for infection will reduce dramatically.

**Kindly respond one more time and let me know if we may consider this thread resolved.

calvin333 · 06-19-2008, 10:42 PM

Thanks, will flush System Restore Points when update complete (it's going pretty slow).
Will also get the preventive processes running.

Go Buckeyes!

Ried · 06-19-2008, 10:44 PM

I'll leave this thread open until you're through. Let me know how everything went for you.

calvin333 · 06-19-2008, 11:15 PM

Hi Ried
I've removed SDFix from system and flushed System RPs.
I'll also get the preventive processes, and I already have NOD32 which would automatically update. I think I'm somewhat safe now...

Thanks for your help and kudos to the team, I see that you guys are getting lots of new reports.

If I go to OH I'll let you know so I can buy you a cup of coffee, unless of course you live in Toledo (last time I told the joke abut Toledo NOBODY in HK got it).

Thanks again!

Ried · 06-19-2008, 11:23 PM

No worries about Toledo jokes - I'm near Cleveland.

Bear in mind the operative word here is 'near', so should you have any jokes about Cleveland - no offense would be taken.

You're quite welcome, and you're good to go, Chris. Take care.

06-19-2008, 10:06 PM	#21 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,578 OS: WinXP and Vista	Re: cssrss creating HQS Trojan at startup I'm not seeing anything new. Have you tried to reset AutoUpdate? Click Start>Control Panel>Security Center __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

06-19-2008, 10:10 PM	#22 (permalink)
calvin333 Registered User Join Date: May 2008 Posts: 27 OS: xp	Re: cssrss creating HQS Trojan at startup I just did that. I didn't before because sometimes I get update messages from Adobe, Java etc. and I just don't trust auto updates very much... By the way I did the DSS with internet connection open, but no other running application, is that OK?

06-19-2008, 10:11 PM	#23 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,578 OS: WinXP and Vista	Re: cssrss creating HQS Trojan at startup Yes, that was fine. Is AutoUpdate working now? __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

06-19-2008, 10:13 PM	#24 (permalink)
calvin333 Registered User Join Date: May 2008 Posts: 27 OS: xp	Re: cssrss creating HQS Trojan at startup Yes Internet connection showing getting stuff in... shield is yellow not green Oh just found out because it found 2 new Windows updates and ask me if I want to install ... should I? Last edited by calvin333; 06-19-2008 at 10:14 PM.

06-19-2008, 10:16 PM	#25 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,578 OS: WinXP and Vista	Re: cssrss creating HQS Trojan at startup What did you set AutoUpdate to do? If you 'ticked' any circle other than 'Automatic (Recommended)' the shield will be yellow. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

06-19-2008, 10:21 PM	#26 (permalink)
calvin333 Registered User Join Date: May 2008 Posts: 27 OS: xp	Re: cssrss creating HQS Trojan at startup I believe the yellow is because I have updates not yet installed, I didn't set anything with AutoUpdate and may be it's default set to "prompt before installation". I just checked... it's set to "automatic (recommended)." Last edited by calvin333; 06-19-2008 at 10:22 PM.

06-19-2008, 10:22 PM	#27 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,578 OS: WinXP and Vista	Re: cssrss creating HQS Trojan at startup Then yes, that's why it's yellow. Go ahead and update now. You can feel free to set it to Automatic - this AutoUpdate feature only applies to Microsoft Updates - nothing else on your system. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

06-19-2008, 10:27 PM	#28 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,578 OS: WinXP and Vista	Re: cssrss creating HQS Trojan at startup You edited while I was replying. What updates haven't you installed? If they are 'optional' or don't apply to your system, then check the box that says 'don't ask me again' when it shows up. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

06-19-2008, 10:33 PM	#29 (permalink)
calvin333 Registered User Join Date: May 2008 Posts: 27 OS: xp	Re: cssrss creating HQS Trojan at startup I updated two things... first is KB898461 second is Windows Installer 3.1, then .... system prompt reboot to enable update ... so I reboot and now it's transmitting another update, but it's Windows stuff and not application.

06-19-2008, 10:37 PM	#30 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,578 OS: WinXP and Vista	Re: cssrss creating HQS Trojan at startup That is as it should be. AutoUpdate is exclusive to Microsoft updates. After it has finished updating, go ahead and carry out these final steps: Delete SDFix.exe and it's folder located at C:\SDFix ------------------- Create a new System Restore point Click Start >> Run - type SYSDM.CPL & press Enter * Select the System Restore Tab * Tick on the checkbox - "Turn off System Restore on all drives" Click Apply * Then untick the same checkbox & click OK This will flush out previous restore points (which contain the infections) and create a new restore point. ************************************************************************************ To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad. SpywareBlaster 4.0 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. It will block any bad ActiveX from running in Internet Explorer and Firefox if it's listed in their database (which you should update frequently). To view their database and list of restricted sites, launch the program and click on each of the tabs on the main display page. IESpyAD Zoned Out to block access to malicious websites so you cannot be redirected to them from an infected site or email. This severely impairs attempts to infect your system as it basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released. In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles: PC Safety and Security--What Do I Need? Think Prevention HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. ----------------------------------------------------- Follow the list above and the potential for infection will reduce dramatically. **Kindly respond one more time and let me know if we may consider this thread resolved. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

06-19-2008, 10:42 PM	#31 (permalink)
calvin333 Registered User Join Date: May 2008 Posts: 27 OS: xp	Re: cssrss creating HQS Trojan at startup Thanks, will flush System Restore Points when update complete (it's going pretty slow). Will also get the preventive processes running. Go Buckeyes!

06-19-2008, 10:44 PM	#32 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,578 OS: WinXP and Vista	Re: cssrss creating HQS Trojan at startup I'll leave this thread open until you're through. Let me know how everything went for you. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

06-19-2008, 11:15 PM	#33 (permalink)
calvin333 Registered User Join Date: May 2008 Posts: 27 OS: xp	Re: cssrss creating HQS Trojan at startup Hi Ried I've removed SDFix from system and flushed System RPs. I'll also get the preventive processes, and I already have NOD32 which would automatically update. I think I'm somewhat safe now... Thanks for your help and kudos to the team, I see that you guys are getting lots of new reports. If I go to OH I'll let you know so I can buy you a cup of coffee, unless of course you live in Toledo (last time I told the joke abut Toledo NOBODY in HK got it). Thanks again!

06-19-2008, 11:23 PM	#34 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,578 OS: WinXP and Vista	Re: cssrss creating HQS Trojan at startup No worries about Toledo jokes - I'm near Cleveland. Bear in mind the operative word here is 'near', so should you have any jokes about Cleveland - no offense would be taken. You're quite welcome, and you're good to go, Chris. Take care. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."