Shoutbox

quote:

---

Originally posted by mwe99
I would appreciate you not yelling at me or public discrediting me, believe it or not i know what to tool does, but thought of this? Who is gonna keep you on their list after they have blocked you.

---

you have a good point, though cookie is right too. the person who blocks you will not always delete you from their list...

check out this thread. i know it is not the best way to detect blocking, but considering that there is no other way, it is not SO bad ..though it is rather limited.
http://shoutbox.menthix.net/showthread.php?tid=46...d=476747#pid476747

I got this message from one of my friends earlier today, good thing I trusted my instincts. I'm probably gonna go to his house tonight and fix it up.

I think you should:
Delete the folder from the program files and the .INI files from the system folder, and then use MSCONFIG to remove it from startup. After that, open Add/Remove Programs, then click remove on the block checker, this would most likely detect the absence of the program and remove it from the list. Then virus and adware/spyware scan.

Anyone agree/disagree?

I'd say

ctrl+alt+del, kill the extra csrss.exe first and then block-checker.exe (if you don't know which csrss.exe it is, use Process Explorer from sysinternals to see its path)

Then delete the contents of C:\Program Files\Block Checker and edit startup to stop block-checker.exe attempting to start.

Try find the ini files in the system directory, if you can't find them there then do a Windows search and see if they're located anywhere else for some reason.

It's probably not really needed, but I guess an adware/spyware scan can't hurt.

quote:

---

Originally posted by Fergy
(...) and then use MSCONFIG to remove it from startup.

---

MSCONFIG does NOT remove it completely from the registry, it creates a backup of it when you "delete" it...

Go directly to your registry (regedit.exe) and delete it yourself or use a decent 3rd party program...

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

For more info on MSCONFIG and this issue, see:
CookieRevised's reply to Start-up Programs

Thanks for the advice, unfortunatley i couldn't go to my friend's house today (I was sick) so i'd probably go there sometime this weekend.

quote:

---

Originally posted by CookieRevised
eg: you don't want to be disturbed for a while, yet you want to be able to answer that oh-so-important question from that special someone....

---

I know the feeling, do it all the time

i knew that was a virus from the begging just the wired shit that they would alwasy say the same shit over and over again lol and the they started to give me winks lol

I've finally had time to remove one of these suckers from someones computer (over remote assistance too). The problem is that the CSRSS.EXE process can't be killed by windows task manager because it thinks it's a proper windows progress

Anyways i have written up how to remove the virus, i've tried to make it as simplistic as possible.

--------------------------------------------------------------------
Steps for removing the "Block Checker" Virus

• Download a copy of Sysinternals Process Explorer Here
  
• "Un-Install" the block checker from Add/Remove Programs
  
• Open Process Explorer and kill the "csrss.exe" process that is not run by "SYSTEM" or "NT AUTHORITY" or similar (usually the fake is run by your username or computer name)
  
• Once you have killed the process csrss.exe find the process "blockchecker.exe" and kill that one
  
• Go into C:\Program Files and delete the folder labelled "Block checker" (where C:\ is the drive you installed Windows on)
  
• Open The Registry Editor (Start > Run > regedit.exe) and navigate through to
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and delete the value named "BlockChecker"
  (For help on this section, go to this site, for a wrong move in here could damage your computer)
  
• Delete the "exclusion_AOL.ini", "exclusion_MSN.ini" and "exclusion_Yahoo.ini" located in the windows syetm folder (C:\Windows\System)
  
• Enjoy your "Block Checker" Virus free system

thanks to segosa and CoookieRevised for their help
PS: Make sure you empty your Recycle Bin

quote:

---

Originally posted by Fergy
Open Process Explorer and kill the blockchecker.exe and csrss.exe processes that are next to each other

---

they aren't always "next to eachother" though...

To avoid killing the wrong csrss.exe process, look at the "user name" field which started the process.

If it is "SYSTEM" or "NT AUTHORITY" or the likes then it means it is the legit windows process.

If it is your username/computername then it means the csrss.exe has started up as a normal program and thus the process is not legit and a fake. This is the one you need to kill...

You could also check out the path of the csrss.exe in Process Explorer (right click on it and choose properties). If it is "c:\program files\block checker" or the likes, then you got the right one also...

---------------------------

Good compiled list though ...
Though I would also suggest to move the "uninstall blockchecker" step further down, after you've killed the processes.

thanks cookie. When i did it, blockchecker.exe was a branch of the fake csrss.exe, perhaps i killed the blockchecker.exe process first and the csrss process restarted it.

*added that in to the steps*