System Restore says computer has not been changed

  • Thread starter Thread starter Lee
  • Start date Start date
L

Lee

My computer has apparently been hit be a virus. When I do a search on
Google and click on a result an ad page comes up. Also, I'm having trouble
creating some queries in Microsoft Access. Also, when I boot the computer
I get 2 messages saying a file is missing.

So I tried to do a system restore. It keeps telling me that it can't do
the restore because the computer has not been changed. I've tried it using
several different dates going back weeks. How can I fix this? I'm using
Windows XP Professional.
 
System Restore will only detect and able to restore changes to the SYSTEM
(the system part of the registry & system files) and any unwanted changes
that occur to the CURRENT USER's profile will not be included.

So perhaps it might be a suggestion to re-post here the details of what you
were trying to achieve with System Restore (i.e - what changes exactly were
you hoping to return to their former state?).

==

Cheers, Tim Meddick, Peckham, London. :-)
 
Lee said:
My computer has apparently been hit be a virus. When I do a search on
Google and click on a result an ad page comes up.
Click to expand...

All searches, or just a specific one? What are you searching for?
Also, I'm having trouble creating some queries in Microsoft Access. Also,
when I boot the computer I get 2 messages saying a file is missing.
Click to expand...

What file?
 
There are 2 messages:
"Windows cannot find C:\DOCUME~1\User\LOCALS~1\Temp\csrss.exe. ..."
and
"Could not load or run C:\DOCUME~1\User\LOCALS~1\Temp\csrss.exe. ..."
 
I'm not trying to restore changes. I'm trying to repair the system.
My computer has apparently been hit be a virus. When I do a search
on Google and click on a result an ad page comes up. Also, I'm
having trouble creating some queries in Microsoft Access. Also, when I
boot the computer I get 2 messages saying csrss.exe is missing.
 
Since the partial restore the csrss.exe messages have gone away. I'm
still having problems with Access and Google.
 
Since the partial restore the csrss.exe messages have gone away. I'm
still having problems with Access and Google.
 
Lee said:
There are 2 messages:
"Windows cannot find C:\DOCUME~1\User\LOCALS~1\Temp\csrss.exe. ..."
and
"Could not load or run C:\DOCUME~1\User\LOCALS~1\Temp\csrss.exe. ..."
Click to expand...

That's odd; I'd not expect anything to be trying to use a file in

...\Temp\...

as you log in, unless - say - you'd been uninstalling a product and it

a) told you you needed to reboot (so it could perhaps do some
file renames or deletes as the system is rebooted), and

b) set up (in the registry) a command to run that program next time
you booted, and

c) before rebooting, you manually, or some program that clears up
temporary files etc, deleted something from \Temp\

If you know how to look at the eventlogs, is it possible to find out what
task/process was looking for csrss.exe ?

Google suggests that csrss.exe is part of Windows, provided it's the copy in
C:\WINDOWS\system32. Perhaps the one in \Temp\ is infected?


Do you have antivirus software?

Have you run anti-malware scans?
 
That's right! - Alarm bells should start to ring if you find any file wants
to be run from a TEMP directory (except for in the midst of a program's
installation 'setup', perhaps).

The normal location for [CSRSS.EXE] in the [system32] folder.

It was probably a virus which switched the correct path in the registry for
[csrss.exe] to it's own bogus version residing in the TEMP directory...
The 'real' [csrss.exe] file probably didn't go anywhere - it was just that
it's registered path had been altered.

You have tried, of course, running a *full* scan with your installed
Anti-Virus Software?

==

Cheers, Tim Meddick, Peckham, London. :-)
 
The csrss.exe messages are gone now even though the restore supposedly
wasn't done. I have AVG and Malaware and have scanned both several
times (before the phantom restore). I'm still having a problem with
Access and Google. I'll try scanning again.


That's right! - Alarm bells should start to ring if you find any file
wants to be run from a TEMP directory (except for in the midst of a
program's installation 'setup', perhaps).

The normal location for [CSRSS.EXE] in the [system32] folder.

It was probably a virus which switched the correct path in the
registry for [csrss.exe] to it's own bogus version residing in the
TEMP directory... The 'real' [csrss.exe] file probably didn't go
anywhere - it was just that it's registered path had been altered.

You have tried, of course, running a *full* scan with your installed
Anti-Virus Software?

==

Cheers, Tim Meddick, Peckham, London. :-)




"Jeremy Nicoll - news posts" <[email protected]>
wrote in message
That's odd; I'd not expect anything to be trying to use a file in

...\Temp\...

as you log in, unless - say - you'd been uninstalling a product and
it

a) told you you needed to reboot (so it could perhaps do some
file renames or deletes as the system is rebooted), and

b) set up (in the registry) a command to run that program next time
you booted, and

c) before rebooting, you manually, or some program that clears up
temporary files etc, deleted something from \Temp\

If you know how to look at the eventlogs, is it possible to find out
what task/process was looking for csrss.exe ?

Google suggests that csrss.exe is part of Windows, provided it's the
copy in
C:\WINDOWS\system32. Perhaps the one in \Temp\ is infected?


Do you have antivirus software?

Have you run anti-malware scans?

--
Jeremy C B Nicoll - my opinions are my own.

Email sent to my from-address will be deleted. Instead, please reply
to (e-mail address removed) replacing "aaa" by "284".
Click to expand...
Click to expand...
 
"Lee" had asked you, in an earlier post ;
"All searches, or just a specific one? What are you searching for?"
Click to expand...

I would like to also ask ; What is this "Ad page" that you are referring
to?

You could be a little more specific; include the URL (web address) of this
"Ad page" for instance.

What should have come up instead of this "Ad page".


With so little information, it's difficult to speculate on the cause, but
it may be that your 'Hosts' file has been modified by the same virus that
has caused, at least, some of the other problems you have been
experiencing.

To check this theory out, locate the file :

C:\WINDOWS\system32\drivers\etc\hosts

....and open it in a simple text editor such as [edit.com] or Notepad.
Delete everything in this file except for the following line that should be
at the very beginning ;

127.0.0.1 localhost

....then save and close. There should be only this one line in your Hosts
file, unless you have either SpyWareBlaster or SpyBotSD installed on your
system.

Certain entries in the hosts file can have the unwanted effect of
re-directing any possible web address to one other than expected - it is
just one of the ways a virus may attack your computer.

==

Cheers, Tim Meddick, Peckham, London. :-)




Lee said:
The csrss.exe messages are gone now even though the restore supposedly
wasn't done. I have AVG and Malaware and have scanned both several
times (before the phantom restore). I'm still having a problem with
Access and Google. I'll try scanning again.


That's right! - Alarm bells should start to ring if you find any file
wants to be run from a TEMP directory (except for in the midst of a
program's installation 'setup', perhaps).

The normal location for [CSRSS.EXE] in the [system32] folder.

It was probably a virus which switched the correct path in the
registry for [csrss.exe] to it's own bogus version residing in the
TEMP directory... The 'real' [csrss.exe] file probably didn't go
anywhere - it was just that it's registered path had been altered.

You have tried, of course, running a *full* scan with your installed
Anti-Virus Software?

==

Cheers, Tim Meddick, Peckham, London. :-)




"Jeremy Nicoll - news posts" <[email protected]>
wrote in message
There are 2 messages:
"Windows cannot find C:\DOCUME~1\User\LOCALS~1\Temp\csrss.exe. ..."
and
"Could not load or run C:\DOCUME~1\User\LOCALS~1\Temp\csrss.exe.
..."

That's odd; I'd not expect anything to be trying to use a file in

...\Temp\...

as you log in, unless - say - you'd been uninstalling a product and
it

a) told you you needed to reboot (so it could perhaps do some
file renames or deletes as the system is rebooted), and

b) set up (in the registry) a command to run that program next time
you booted, and

c) before rebooting, you manually, or some program that clears up
temporary files etc, deleted something from \Temp\

If you know how to look at the eventlogs, is it possible to find out
what task/process was looking for csrss.exe ?

Google suggests that csrss.exe is part of Windows, provided it's the
copy in
C:\WINDOWS\system32. Perhaps the one in \Temp\ is infected?


Do you have antivirus software?

Have you run anti-malware scans?

--
Jeremy C B Nicoll - my opinions are my own.

Email sent to my from-address will be deleted. Instead, please reply
to (e-mail address removed) replacing "aaa" by "284".
Click to expand...
Click to expand...
Click to expand...
 
Tim Meddick said:
There should be only this one line in your Hosts file, unless you have
either SpyWareBlaster or SpyBotSD installed on your system.
Click to expand...

Well, not necessarily. I have a printer on my LAN which has its address
defined in my hosts file and I also use it to define symbolic names for my
router, cable-modem etc, eg with entries like:

127.0.0.1 localhost
192.168.1.91 myprinter
192.168.1.1 myrouter

so for example I can open the browser connection to the router by putting

http://router

in my browser.
 
That's neither here nor there! - The point I was making was that the Hosts
file can be used by malicious software to re-direct *any* typed URL request
on your PC to *anywhere* the said malicious software wants!

It CAN and IS used by Anti-Malware / Anti-Spyware utilities to re-direct a
selection of known disreputable website URLs back to the host address
(loop) and by so doing, save the user the vulnerabilities of visiting
possibly virus-infested websites!

However, as I have said, this is not the Hosts file's only possible use -
URLs included in the Hosts file can be associated with *any* dotted decimal
IP address - not just 127.0.01 (loop) - thereby re-directing (associating)
any alpha-numerical web address with *any* IP address.....

==

Cheers, Tim Meddick, Peckham, London. :-)




JD said:
Tim said:
"Lee" had asked you, in an earlier post ;
"All searches, or just a specific one? What are you searching for?"
Click to expand...

I would like to also ask ; What is this "Ad page" that you are referring
to?

You could be a little more specific; include the URL (web address) of
this "Ad page" for instance.

What should have come up instead of this "Ad page".


With so little information, it's difficult to speculate on the cause,
but it may be that your 'Hosts' file has been modified by the same virus
that has caused, at least, some of the other problems you have been
experiencing.

To check this theory out, locate the file :

C:\WINDOWS\system32\drivers\etc\hosts

...and open it in a simple text editor such as [edit.com] or Notepad.
Delete everything in this file except for the following line that should
be at the very beginning ;

127.0.0.1 localhost

...then save and close. There should be only this one line in your Hosts
file, unless you have either SpyWareBlaster or SpyBotSD installed on
your system.

Certain entries in the hosts file can have the unwanted effect of
re-directing any possible web address to one other than expected - it is
just one of the ways a virus may attack your computer.

==

Cheers, Tim Meddick, Peckham, London. :-)
Click to expand...

Some of us use the HOSTS file from here:

http://winhelp2002.mvps.org/hosts.htm
Click to expand...
 
...and open it in a simple text editor such as [edit.com] or Notepad.
Delete everything in this file except for the following line that should be
at the very beginning ;

127.0.0.1 localhost

...then save and close. There should be only this one line in your Hosts
file, unless you have either SpyWareBlaster or SpyBotSD installed on your
system.
Click to expand...


Or the MVP Hosts file (which I strongly recommend. See
http://winhelp2002.mvps.org/hosts.htm) and probably several other
similar programs or files.
 
Again - you also seem to have missed my point!

I was trying to explain the vulnerabilities of the Hosts file if altered by
malicious software.

The single line :

127.0.0.1 localhost

....is the only line that really should be there, and even that isn't needed
for any special purpose other than to make operations like <ping localhost>
easier to type than typing <ping 127.0.0.1> all the time....

My own begins :

127.0.0.1 localhost
127.0.0.1 self
127.0.0.1 me
192.168.1.1 loop
192.168.1.1 msloop
192.168.1.1 MyComp
178.33.255.46 www.wikileaks.org/

==

Cheers, Tim Meddick, Peckham, London. :-)
 
There are several pages which keep appearing. They look like something
you would get if a link was dead. Here is one:

http://63.209.69.107/search/web/Ms Access Pivot Chart/a53/riva-
2198/v5

This appears when I click on a Google search link. If I go back to
Google and do it all over again, I get the correct page.

hosts contains

127.0.0.1 localhost
# Start of entries inserted by Spybot - Search & Destroy

followed by a long list


"Lee" had asked you, in an earlier post ;
"All searches, or just a specific one? What are you searching
for?"
Click to expand...

I would like to also ask ; What is this "Ad page" that you are
referring to?

You could be a little more specific; include the URL (web address) of
this "Ad page" for instance.

What should have come up instead of this "Ad page".


With so little information, it's difficult to speculate on the cause,
but it may be that your 'Hosts' file has been modified by the same
virus that has caused, at least, some of the other problems you have
been experiencing.

To check this theory out, locate the file :

C:\WINDOWS\system32\drivers\etc\hosts

...and open it in a simple text editor such as [edit.com] or Notepad.
Delete everything in this file except for the following line that
should be at the very beginning ;

127.0.0.1 localhost

...then save and close. There should be only this one line in your
Hosts file, unless you have either SpyWareBlaster or SpyBotSD
installed on your system.

Certain entries in the hosts file can have the unwanted effect of
re-directing any possible web address to one other than expected - it
is just one of the ways a virus may attack your computer.

==

Cheers, Tim Meddick, Peckham, London. :-)




Lee said:
The csrss.exe messages are gone now even though the restore
supposedly wasn't done. I have AVG and Malaware and have scanned
both several times (before the phantom restore). I'm still having a
problem with Access and Google. I'll try scanning again.


That's right! - Alarm bells should start to ring if you find any
file wants to be run from a TEMP directory (except for in the midst
of a program's installation 'setup', perhaps).

The normal location for [CSRSS.EXE] in the [system32] folder.

It was probably a virus which switched the correct path in the
registry for [csrss.exe] to it's own bogus version residing in the
TEMP directory... The 'real' [csrss.exe] file probably didn't go
anywhere - it was just that it's registered path had been altered.

You have tried, of course, running a *full* scan with your installed
Anti-Virus Software?

==

Cheers, Tim Meddick, Peckham, London. :-)




"Jeremy Nicoll - news posts" <[email protected]>
wrote in message

There are 2 messages:
"Windows cannot find C:\DOCUME~1\User\LOCALS~1\Temp\csrss.exe.
..." and
"Could not load or run C:\DOCUME~1\User\LOCALS~1\Temp\csrss.exe.
..."

That's odd; I'd not expect anything to be trying to use a file in

...\Temp\...

as you log in, unless - say - you'd been uninstalling a product and
it

a) told you you needed to reboot (so it could perhaps do some
file renames or deletes as the system is rebooted), and

b) set up (in the registry) a command to run that program next time
you booted, and

c) before rebooting, you manually, or some program that clears up
temporary files etc, deleted something from \Temp\

If you know how to look at the eventlogs, is it possible to find
out what task/process was looking for csrss.exe ?

Google suggests that csrss.exe is part of Windows, provided it's
the copy in
C:\WINDOWS\system32. Perhaps the one in \Temp\ is infected?


Do you have antivirus software?

Have you run anti-malware scans?

--
Jeremy C B Nicoll - my opinions are my own.

Email sent to my from-address will be deleted. Instead, please
reply to (e-mail address removed) replacing "aaa" by
"284".
Click to expand...
Click to expand...
Click to expand...
 
I am being blocked from proceeding from Google. But after 2 or 3 tries
it works. Could that problem possibly come from the hosts file?


Tim said:
"Lee" had asked you, in an earlier post ;
"All searches, or just a specific one? What are you searching for?"
Click to expand...

I would like to also ask ; What is this "Ad page" that you are
referring to?

You could be a little more specific; include the URL (web address) of
this "Ad page" for instance.

What should have come up instead of this "Ad page".


With so little information, it's difficult to speculate on the cause,
but it may be that your 'Hosts' file has been modified by the same
virus that has caused, at least, some of the other problems you have
been experiencing.

To check this theory out, locate the file :

C:\WINDOWS\system32\drivers\etc\hosts

...and open it in a simple text editor such as [edit.com] or Notepad.
Delete everything in this file except for the following line that
should be at the very beginning ;

127.0.0.1 localhost

...then save and close. There should be only this one line in your
Hosts file, unless you have either SpyWareBlaster or SpyBotSD
installed on your system.

Certain entries in the hosts file can have the unwanted effect of
re-directing any possible web address to one other than expected - it
is just one of the ways a virus may attack your computer.

==

Cheers, Tim Meddick, Peckham, London. :-)
Click to expand...

Some of us use the HOSTS file from here:

http://winhelp2002.mvps.org/hosts.htm
Click to expand...
 
My problem is that I am being blocked from proceeding from Google. But
after 2 or 3 tries it works. What could cause that?
 
Lee said:
There are several pages which keep appearing. They look like something
you would get if a link was dead. Here is one:
Click to expand...
http://63.209.69.107/search/web/Ms Access Pivot Chart/a53/riva-2198/v5

That looks to me like a search results page from a service called 'Scour'?

This appears when I click on a Google search link.
Click to expand...

Do you mean a link that's presented on a Google page AFTER you've done a
search via Google, or do you mean a link on someone-else's page which claims
that clicking it will search google for something or other?


Or are you using a browser search toolbar, perhaps with a 'google' label on
it, which is directing a search to somewhere else - Scour perhaps? (I
never use browser search toolbars, just go directly to the Google advances
search page).


What precisely are you using as a search argument?


If you're using Google to do the search, are you using the simple (one line
for parameters) Google search page, eg:


http://www.google.co.uk


or the advanced one (I always use the latter), eg:

http://www.google.co.uk/advanced_search?hl=en
 
Back
Top