Warning New Server Virus

[JohnBarny]

There is a clever new backdoor trojan about it is a servertrojan it logs onto server pcs and accesses the internet
Took me and dad 2 hours to get rid ov it
Where it hides:c:/windows/csrss.exe
Its Name:csrss.exe
What it does:Every ten seconds it writes it self into the system registery so it is in possible to just take it out also it allows access to your pc
How to get rid of it:Reboot pc and boot up in dos mode or for u exp users safe mode comand prompt then when it boots upto into dos section type cd\ to get into c: drive then cd\windows then type ATTRIB -R -A -S -H Then type dir *.exe del csrss.exe then goto start, run, then type regedit then goto edit, find csrss then bk click and select edit binary code removing all refrenses to csrss.exe

Ok will mod sticky plz P.S This is y i cud not host MadDogz

 

[Oberon]

Excellently put. Just a point to remind people. Check the file you are deleting VERY carefully.

The file csrss.exe in c:\windows IS a virus, whereas the file csrss.exe in c:\windows\system32 is an IMPORTANT system file.

What is it?
csrss.exe - Client/Server Runtime Server Subsystem

What does it do?
This is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion). Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times. Csrss is responsible for console windows, creating and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment.

You will not be able to end this through task manager!

If you feel your security has been breached, there is a utilty that will check for and removes the csrss.exe virus, which is catagorised as a W32.Nimda.E@mm trojan, by following this url http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

 

[Ragnar]

Sorry but a sticky for each new virus would be too much. But a thread wich would include some more nasty viruse's and the removal guides/tools would actually be helpfull.

 

[urbanfox]

This has been around for some time...

 

[RoNeZ]

urban u just think u know evrything u fuking yank:ban: :clap:

 

[urbanfox]

urban u just think u know evrything u fuking yank:ban: :clap:

I don't know .00000000001% of everything, but excuse me if I don't piss my pants on a Virus warning that's quite old.

BTW, enjoy.

 

[Far]

this threads from last year. lockify.

 

[urbanfox]

this threads from last year. lockify.

It was already locked...