Virus help?

[karohemd]

We are stuck here at work with an exe that sucks processing time, shuts down the internet connection and slows down everything.

They identified the culprit as a file called "csrsss.exe" (note three s) that sits in the Winnt/system32 folder and runs a process with the same name.

It's a nasty thing that probably sits somewhere in the network and is resurrected every time it's deleted from the folder and the registry.

Anyone familiar with it and able to suggest a remedy? Sophos doesn't recognize it (yet).

Comments

[martyrssmile.livejournal.com]

CSRSSS.Exe or CSRSS.exe

Csrss stands for client/server run-time subsystem and is an essential subsystem that must be running at all times.
Csrss is responsible for console windows, creating and/or deleting threads, and some parts of the 16-bit virtual MS-DOS environment.

However it has been targeted for modification by some viruses and spyware as I understand such.

[karohemd.livejournal.com]

three s. I even pointed it out in the orginal post.

I finally managed to get of rid after it reappearing time and again but it most likely still lurks on the network somewhere. Let's hope the sysop gets it fixed. I basically lost half a day's work, while being on a tight deadline...

[martyrssmile.livejournal.com]

three s. I even pointed it out in the orginal post.

Was hoping it had been a miscommunication of some sort. Cause otherwise boggled.

Good luck with eradicating the bastard from the network. We still have a few things like that on our work network theyhaven't been able to get rid of in 2 years.

[karohemd.livejournal.com]

It seems to be mostly removed now.
Thanks for trying to help, anyway.