Is this a virus? Options

[£uke_®0na|do]

hey guys, another update on the block checker. The same contact who sent me" Did you know you can find out who blocked you on MSN? Check it out, it's free (URL here) sent me another message saying "I know who's blocking me on MSN because I use http"

Any thoughts??

[Natalie.]

Another new 1 again same link

Automessage : download the new MSN update here! URL

[alan18]

It sends out a few different ones.

[Natalie.]

It sends out a few different ones.
[right][snapback]82655[/snapback][/right]

Yeah I gathered. Basically what I think happened was that my friend downloaded it and then it shows the same message for so long and then changes. I accidentely clicked the linkw hen I was trying to copy and paste it into here but all it does is take you to page cannot be displayed and then teh download box where it says open, svae, cancel and of course I clicked cancel.

[CookieRevised]

hey guys, another update on the block checker. The same contact who sent me" Did you know you can find out who blocked you on MSN? Check it out, it's free (URL here) sent me another message saying "I know who's blocking me on MSN because I use http"

Any thoughts??
[right][snapback]82594[/snapback][/right]

please read the entire thread (before posting)...

I posted a very detailed message, including all possible texts which this so called "block-checker" can send...

I accidentely clicked the linkw hen I was trying to copy and paste it into here

Please do _not_ paste links of such programs on forums! There is a reason why each link is blanked out in all the posts here... Pasting such links only helps spreading the virus...

This post has been edited by CookieRevised: Aug 21 2005, 12:16 AM

[Natalie.]

please read the entire thread (before posting)...

I posted a very detailed message, including all possible texts which this so called "block-checker" can send...
Please do _not_ paste links of such programs on forums! There is a reason why each link is blanked out in all the posts here... Pasting such links only helps spreading the virus...
[right][snapback]82664[/snapback][/right]

I wasn't posting the link. I was posting the text before it hence why I've put URL in italics.

This post has been edited by natalzimayzi: Aug 21 2005, 12:18 AM

[CookieRevised]

I wasn't posting the link. I was posting the text before it hence why I've put URL in italics.

Oh, ok , my mistake

[sjoslin]

My daughter installed block-checker....uggghhhh! I uninstalled the program but it wouldn't delete the block-checker file in my program files. When I try to delete it, it tells me access to the file is denied, to make sure the disc is not full or write-protected and that the program is not in use. Can anyone give me step by step instructions on how to remove this from my computer? I have Windows Xp. I have read the other posts but am still unsure of what to do, I don't want to damage my computer! So I would appreciate any help or even direct me to which post would be most helpful with this! Thank you!

[Hoovey]

Welcome to Mess.be

You should try Cookie Revised's instructions on how to fully remove it. Also, to remove it, you'll need to find, and kill the process. I do reccomend trying Spybot Search and Destroy, it removes crap like that. (it removed that stupid shell.exe virus)

[littlemissx223]

heya - I have tried EVERYTHING to get rid of this block checker, I've downloaded all the programs that have been reccomended and still nothing has worked! and I've followed Cooke Revised's instructions and still I keep getting:

"cannot delete block-checker: Access denied make sure the disk is not full or write-protected and that the file is not currently in use" when I'm not even using the file!

I have also uninstalled msn messenger and re-installed it, and still I can't get rid of the damn block checker!!

I'm no good with computers and I've followed all the instructions on this forum to delete it and still I've not got rid of it! If anyone can help, I'd really love to get rid of it!

[alan18]

If you followed all the directions correctly I'm sure it would've worked.
As posted by Kapz and TheSteve:

1. go to http://www.sysinternals.com/Utilities/ProcessExplorer.html install that

2.start ->controll panel ->add or remove programs and remove all of these
BlockChecker
System Process
180search assistant
Media Gateway
CashBack

3.start up the program you downloaded from step 1 and find the process called csrss.exe right click and terminate it and its uninstalled

[Natalie.]

To anonymousjon:

I'm replying here not on that topic - no point of 2 topics for the same thing.
I really don't no about how to get rid fo it as no one has come up with a solution yet. I would have thought it would be similar to the block checker one. My friend has it and downloaded Microsoft anti-spy. It stopped it for a bit and then came back so he reinstalled MSN Messenger and it worked. The only thing that happened was that it opened up all the conversation windows but sent no message. He hasn't said anything about the problems you are having like with the task manager though but if I remember I will ask him.

This post has been edited by natalzimayzi: Aug 21 2005, 02:29 PM

[anonymousjon]

its a nasty little buger, nothing anti spyware/virus related wants to run anymore

I dont want to have to but, at the moment It looks like im gonna have to re-format

[Natalie.]

its a nasty little buger, nothing anti spyware/virus related wants to run anymore

I dont want to have to but, at the moment It looks like im gonna have to re-format
[right][snapback]82741[/snapback][/right]

Have you tried doing what my friend did to stop it sending those messages? Reinstall messenger? I don't know what to do about getting rid of it totally.

Edit: It's happening to him again. Any ideas on how to get rid of it because he's asking me to help. And by the way yet another new message.

LMAO, this is freaking me out!! URL

This post has been edited by natalzimayzi: Aug 21 2005, 02:47 PM

[littlemissx223]

I still can't get rid of block checker, the process explorer has been running for the last two hours. how long is meant to take?!

[CookieRevised]

I still can't get rid of block checker, the process explorer has been running for the last two hours.  how long is meant to take?!

As stated several times before, you are supposed to kill the process. Process Explorer isn't going to do anything on its own. It is just a program to show and handle your processes, just like the task manager. You need to right click on the process and choose "Kill Process"....

Note: The reason why you need to use a program like "Process Explorer" to do this is because the Task/process Manager of Windows itself refuses to kill "csrss.exe" as it always thinks it is a system process...

-----------------------------------

As some don't know how to remove it (even by reading some detailed posts in this thread), here is a step-by-step instruction guide....



How to remove the "Block Checker" malware correctly
Originally composed by Fergy at the Plus! forums and further modified by me

Step 1: Killing the processes

• Download Sysinternals' "Process Explorer" here and install it.
• Open Process Explorer and kill "csrss.exe" first.
  To avoid killing the wrong csrss.exe process, look at the "User Name" column which lists who has started the process.
  If it is "SYSTEM" or "NT AUTHORITY" or the likes, then it means it is the legit windows process started by Windows itself and shouldn't be killed. If it is your username/computername then it means the csrss.exe process has started up as a normal user program and thus is not legit and the fake one. This is the one you need to kill...
• While still in Process Explorer, kill "block-checker.exe" if it is still there.

Step 2: Removing the files

• Uninstall the block checker by going to "Add/Remove Programs" in the control panel.
• Go into "C:\Program Files" and delete the folder labelled "Block Checker" (where C:\ is the drive you installed Windows on) if it is still there.
• Delete the "exclusion_AOL.ini", "exclusion_MSN.ini" and "exclusion_Yahoo.ini" files located in windows' system folder (C:\Windows\System).
• Clean out your recycle bin to totally remove the files from your HDD.

Step 3: Fixing the registry

• Open your registry editor (Start > Run > regedit.exe) and navigate to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" and delete the key named "block-checker".
  (For a small tutorial on this, go to this site, because deleting the wrong keys could corrupt Windows).

This post has been edited by CookieRevised: Aug 21 2005, 05:28 PM

[Natalie.]

Does anyone have the solution to the other one though? Because it is really starting to bug me now as I can't talk to my friend.

[Phil]

Thanks for the clear removal instructions.. already helped my friend clear her virus.

This thread should be pinned? Hmm.. now where is a mod when you need them?!

Lazy buggers

[Natalie.]

Thanks for the clear removal instructions.. already helped my friend clear her virus.

This thread should be pinned? Hmm.. now where is a mod when you need them?!

Lazy buggers
[right][snapback]82818[/snapback][/right]

Yeah it helped mine too now I'm just trying to help the other one but there's no solution yet. And maybe it's not pinned because it's not a problem that will last forever?

[brianhanson37]

A while ago I saw a block checker on mess.be downloads and I was just wondering if anyone downloaded it and if someone did then did you notice any spyware type stuff?