How to remove manually

[kpmsivachand]

My friend's system affected by virus. I found there were duplication of system process(1.csrss.exe 2.winlogon.exe 3.services.exe 4.lsass.exe 5.smss.exe) and also i found these .exe are located in the (C:\Documents and Settings\Ramesh\Local Settings\Application Data). When i try to open that location the system going to restrat and not even to install new things.... When i try to run the script also its going to restart.... What to do now? Any suggestions?

 

[gaurav_indian]

Try to remove those in safe mode.

 

[kpmsivachand]

Thxs for quick reply.... I tried in the safemode and wrote the script for deleting these files... But won't work... Any other suggestions???

 

[saqib_khan]

Try to scan with a good antivirus & antispyware, in safe mode.

 

[kpmsivachand]

Try to scan with a good antivirus & antispyware, in safe mode.

if I try install new things it become restart

 

[adi007]

Try ending the process using processxp..
technet.microsoft.com/en-us/sysinternals/bb896653.aspx
^^It's a freeware

Now if ends the process remove the startup entries of these file by using msconfig
run--> msconfig
some times these will exhibit as services so make sure to remove these services from msconfig...

 

[kpmsivachand]

Thank you dude

 

[adi007]

^^Did it worked...

 

[ravi_9793]

@adi007 has given you good link.
You can also use unlocker to find what programs are using that file.

 

[kpmsivachand]

^^Did it worked...

Tomorrow only i am going to check it with my friend system.... Thanks for the link....