CNS
-
Hello, we have solved this problem the last time. However, i found this file cns.dll, csn.dat, cns.exe in C:/Winnt/system32
My scanner found cns.dll
I deleted it many times using the avg spyware but it still comes back... -
Last time helped you to remove CNSMin... and it's back again?
-
If you have HijackThis with you, run a scan and paste the log here.
-
Well not really BACK again...
Pls dont get the wrong impression..
It has been in my com for a very long time(half a year),everytime i scan using adaware or avg, this cns would appear.... and it is only now that i want to ask you about the situation...... my hijackthis log will be like the previous one which you verified as clean.
the loads of entries you wanted me to check the last time are not visible in my com. Like i have mentioned i only have cns exe, dll and dat in my c/winnt/system32 folder... -
del all ur files in ur 'temperory internet files'?
-
hmm it would be troublesome to find out which file is actually executing that file which keeps appearing in your anti virus program over and over again.Originally posted by davidche:Well not really BACK again...
Pls dont get the wrong impression..
It has been in my com for a very long time(half a year),everytime i scan using adaware or avg, this cns would appear.... and it is only now that i want to ask you about the situation...... my hijackthis log will be like the previous one which you verified as clean.
the loads of entries you wanted me to check the last time are not visible in my com. Like i have mentioned i only have cns exe, dll and dat in my c/winnt/system32 folder...
you can try hijacking the file instead.
create a file(cns.dll) using notepad.
mark it as "read only"
and then put ( or replace) in your system32 folder.
scan system32 folder again. if it found cns.dll, dont worry its safe.
if it appears cns.dll[1], then tell me again. -
Hmm... where is the exact location?Originally posted by davidche:Well not really BACK again...
Pls dont get the wrong impression..
It has been in my com for a very long time(half a year),everytime i scan using adaware or avg, this cns would appear.... and it is only now that i want to ask you about the situation...... my hijackthis log will be like the previous one which you verified as clean.
the loads of entries you wanted me to check the last time are not visible in my com. Like i have mentioned i only have cns exe, dll and dat in my c/winnt/system32 folder...
Is it something like C:\Recycler or something?
If yes, clear your system restore points. Your system restore is INFECTED. Also, if those cns files are in C:\Winnt or C:\Winnt\System32, delete them.
Turn reset system restore, do this:
Right click on My Computer and select Properties
Select the System Restore tab
Tick the Turn off system restore on all drives box
Click OK and restart the PC.
After you restart, repeat it. Except that now you untick Turn off system restore on all drives box -
My com's had been turned off system restore last time since it saves memory usage.Originally posted by ndmmxiaomayi:Hmm... where is the exact location?
Is it something like C:\Recycler or something?
If yes, clear your system restore points. Your system restore is INFECTED. Also, if those cns files are in C:\Winnt or C:\Winnt\System32, delete them.
Turn reset system restore, do this:
Right click on My Computer and select Properties
Select the System Restore tab
Tick the Turn off system restore on all drives box
Click OK and restart the PC.
After you restart, repeat it. Except that now you untick Turn off system restore on all drives box
Also, the exact location is at C:\WINNT\system32
==
am i supposed to do manyu's way?
side track a little, there any chance that this cns file may be from part of the com? -
Generally, we don't it manyu's way. We will locate the file, right click and select Rename. Then type in .old or .bak at the end of the file.Originally posted by davidche:My com's had been turned off system restore last time since it saves memory usage.
Also, the exact location is at C:\WINNT\system32
==
am i supposed to do manyu's way?
side track a little, there any chance that this cns file may be from part of the com?
For example, infected file = cns.dll
Renaming it will be cns.dll.old or cns.dll.bak
This is a rather effective method in disabling most viruses and spywares.
As cnsmin is spyware, there's hardly any chance of it being part of the computer. cnsmin also affects Yahoo related programs, so it's wise to uninstall them as well and use a similar product, say Google.
Just delete the infected files found. Since system restore is not on, it isn't a problem. -
mayi u are wrong liao... i dont know how to explain but then i think this pic shows it all.Originally posted by ndmmxiaomayi:Generally, we don't it manyu's way. We will locate the file, right click and select Rename. Then type in .old or .bak at the end of the file.
For example, infected file = cns.dll
Renaming it will be cns.dll.old or cns.dll.bak
This is a rather effective method in disabling most viruses and spywares.
As cnsmin is spyware, there's hardly any chance of it being part of the computer. cnsmin also affects Yahoo related programs, so it's wise to uninstall them as well and use a similar product, say Google.
Just delete the infected files found. Since system restore is not on, it isn't a problem.
-
Nope, not wrong. It's just a renaming of file extension.Originally posted by manyu882:mayi u are wrong liao... i dont know how to explain but then i think this pic shows it all. -
.old.mp3 or .mp3.old
both the same effect. virus scan still be written on the same directory. maybe i dont quite understand u -
Windows have a funny way of recognizing extensions.Originally posted by manyu882:.old.mp3 or .mp3.old
both the same effect. virus scan still be written on the same directory. maybe i dont quite understand u
It only recognizes the last part. You can have a lot of extensions in front, but only the last part is recognized.
For example, you can name a file this way: whatever.txt.exe.dll.mp3.doc
Windows will read it as a .doc file
So if the virus reads a .dll file to infect, it needs to be renamed as whatever.dll.old or whatever.dll.bak
Because all these extensions are useless in Windows. But never rename it the other way round. Not .bak.dll. The virus will still run, because the part of the extension is .dll
Edit: missed out a word -
-_-.... isn't it like how anti-virus cure it too? rename it and put in vault ect ect...
the same virus kept appearing in his viruscan. and since after healing many times. its futile.
however, a virus cannot be written on a read-only file..
Correct me if wrong -
I think antivirus does more than renaming... because I can't find the files anywhere.
Read-only files can only be read, but not edited or deleted.... that's why called read-only...
They are able to execute though.
And Cnsmin is known to be a beast, hard to remove. -
the last time i deleted it thru my avg spyware IN SAFE MODE, it pops back again on my next startupOriginally posted by ndmmxiaomayi:Generally, we don't it manyu's way. We will locate the file, right click and select Rename. Then type in .old or .bak at the end of the file.
For example, infected file = cns.dll
Renaming it will be cns.dll.old or cns.dll.bak
This is a rather effective method in disabling most viruses and spywares.
As cnsmin is spyware, there's hardly any chance of it being part of the computer. cnsmin also affects Yahoo related programs, so it's wise to uninstall them as well and use a similar product, say Google.
Just delete the infected files found. Since system restore is not on, it isn't a problem. -
CNSMin is known to be very resistant against deletion.Originally posted by davidche:the last time i deleted it thru my avg spyware IN SAFE MODE, it pops back again on my next startup
If it doesn't affect you, then just let it be. -
its a damn hijacker file!!Originally posted by ndmmxiaomayi:CNSMin is known to be very resistant against deletion.
If it doesn't affect you, then just let it be.
I cant rename it.
It isnt marked as read only.
I deleted it but i couldnt find it in the recycle bin.
All deleted files are supposed to go to the recyle bin.
also, i just had this microsoft excel thingy open itself without my command as i was watching a movie. -
there are 2 types of delete(detele , and shift delete). the one u have deleted may have removed instead of going to recycle bin.Originally posted by davidche:its a damn hijacker file!!
I cant rename it.
It isnt marked as read only.
I deleted it but i couldnt find it in the recycle bin.
All deleted files are supposed to go to the recyle bin.
also, i just had this microsoft excel thingy open itself without my command as i was watching a movie. -
I delete file X, it goes to recyle binOriginally posted by manyu882:there are 2 types of delete(detele , and shift delete). the one u have deleted may have removed instead of going to recycle bin.
I delete cns.dll, it doesnt go recyle bin.
Hope you understand....I know there is a settings which says that all deleted files to be removed immediately. EVidently, i did not enable this, if thats what you are trying to say. -
ah ic, first time came accross this kind of behavior.
-
Here's my recommended tactic:
When I encounter files possibly left behind by an unknown program, and the anti-malware tools cannot do it, I forcefully erase the file from the computer permanently. I don't recommend working with the registry for this, unless you know what you're doing.
Use these tools:
Eraser
--------
www.heidi.ie/eraser
CCleaner
-----------
www.ccleaner.com
Use it and clear off the file.
Eraser setting to note:
Erasing preferences use the default 35 passes. Check all boxes.
CCleaner:
Main screen:
Check all boxes except Hotfix uninstallers, these are the uninstallers for windows updates. You may want to clear them out or not.
Applications:
Check all boxes.
Issues:
Check all boxes.
Please inspect the tools section of the program, under uninstall and startup, see if there's anything suspicious in there.
Options:
Settings: English, check the first 3 boxes off, enable ccleaner auto-check for updates, choose NSA 7 passes for secure deletion.
Cookies:
Up to you.
Custom:
Up to you.
Advanced:
Check boxes no. 4, 5, 6, 7. Box no. 7, save all settings to .ini file is for convenience. -
first time on my side too, as in your pm...Originally posted by manyu882:ah ic, first time came accross this kind of behavior.
WHatever the case may be, i thank you for your help. Right now, ill do your method and see how.
I am also going to scan again, do all those defrags stuffs in safemode..
shredder tool....hmm..... -
I found another place with this cns thingy. Its called cnsminkp(.dat)
anyway, under its properties i found this thing whcic looks useful -
Why is the image link non-clickable?
