csrss.exe windows small business server 2003

  • Thread starter Thread starter Michael R
  • Start date Start date
M

Michael R

I have a Windows small business server 2003
it is running, and all users can access it.
When I go to the server I can not longer log in as
Adminstrator, it starts login in and immediately logs me
out.
I tried going into the server from a xp-pro workstation,
but no luck, at this time I get (at the server)
csrss.exe error file or directory corrupted.

I found out that it could be a virus

How can I get access to the server so that I can clean the
virus ??

help !!!!!!!
 
Michael R said:
I have a Windows small business server 2003
it is running, and all users can access it.
When I go to the server I can not longer log in as
Adminstrator, it starts login in and immediately logs me
out.
I tried going into the server from a xp-pro workstation,
but no luck, at this time I get (at the server)
csrss.exe error file or directory corrupted.

I found out that it could be a virus
Click to expand...

Which one?
How can I get access to the server so that I can clean the
virus ??
Click to expand...

First you say that this could be a virus, now you know that it is? Are you
sure you are not succumbing to the school of thought that says that, if
anything is not functioning as you expect, the only possible explanation is
that there must be a virus?

How are you attempting to access the server from the xp workstation, but
some sort of remote control or terminal services? Can you logon to the xp
system and map to the C$ share on the server? If so, run an antivirus
package on the mapped share, and look for indications that files such as
csrss.exe have been perhaps modified.


/Al
 
Thank you for answering.

I tried to log in from an XP-pro mapping the c$ but I get
the exacty same result as trying to logging at the server.
That is: it begging to login "loading your personal
profile ...." then begore it logs in "saving your personal
profile...." and it goes back into the pres CTRL ALT DEL
to log in screen.

When I do this from the XP, the server pops an error:
"CSRSS.EXE file or c:\windows directory corrupted"

I went to Norton, McCaffee, Microsoft, etc searching for
CSRSS.EXE and theo all say that it is a virus.

My problem is trying to log into the server so that I can
run the antivirus or follow Norton manual removal.

Thank you again

Michael
 
Michael R said:
Thank you for answering.
Click to expand...

You're welcome.
I tried to log in from an XP-pro mapping the c$ but I get
the exacty same result as trying to logging at the server.
That is: it begging to login "loading your personal
profile ...." then begore it logs in "saving your personal
profile...." and it goes back into the pres CTRL ALT DEL
to log in screen.
Click to expand...

I would have guessed that the profile of the account you are using has a
logoff.exe in the startup group, or the run key in HKCU, or this is being
done through a rogue GPO (which seems least likely).
When I do this from the XP, the server pops an error:
"CSRSS.EXE file or c:\windows directory corrupted"
Click to expand...

What is it you are doing from the XP when this happens, logging in or
attempting to map the share?
I went to Norton, McCaffee, Microsoft, etc searching for
CSRSS.EXE and theo all say that it is a virus.
Click to expand...

What virus? They would never say it is a virus if they did not know which
one it was. If they did not know which virus it was, they would likely only
say that it *might* be one.

Or did you just do a search on their site for "csrss.exe"? I just searched
the symantec site (Norton) and got 11 hits. This does NOT mean that the file
csrss.exe is a virus, just that there are some viral issues associated with
it (i.e. it is a target of some virii). I did a search for "cmd.exe" and got
120 hits - does that mean that that file is a virus?
My problem is trying to log into the server so that I can
run the antivirus or follow Norton manual removal.
Click to expand...

Well, since Norton says it is a virus, they will most certainly have
something to say about the procedures required to remove it, will they not?

Anyway, in case you missed my gist, the question that still needs an answer
is: "what is the name of the virus that has infected your computer"? We
won't be getting much farther without an answer to that.


/Al
 
Back
Top