sean said:
i am behind a netgear router... my laptops' Win MCE had been updated to
XP service pack three... before it travelled thru an airport and worked
in a hotel wifi three weeks ago... for us, its a basic e'mail and surf
the web computer...
It should have be fine behind the Netgear router, perhaps you caught
something when you traveled with it. Of course being behind a firewall
means that uninvited guest can't come in but it doesn't mean that you
can't download pests or get them in your email, the router doesn't stop
user initiated actions. You seem to be a cautious user so it might just
be bad luck that got you infected.
my main computer in the home network shows no infection... i don't play
with limewire or download music... Avira-Anti Vir helped us get rid of
the Antivirus 2009 malware last fall when Spybot, MalwareBytes and AVG
thought it was part of the security suite... so all of those are now
gone... but Avira obviously isn't working either...
Does Service Pack three introduce more copies of csrss.exe into the
system? or put it in the task manager? its my understanding its not
supposed to appear there... nor winlogon.exe... ?
More copies? Meaning that you have (or had) more than one of these
showing in the Task Manager? If you have multiple instances of these
services running then you almost certainly have malware at play on your
machine.
There are six critical NT system services, Windows XP needs these
services to start and run porperly. Trying to kill these critical
services will end the Windows session:
- Csrss.exe (Client/Server Runtime Server Subsystem)
- Lsass.exe (Local Security Authority Subsystem Service)
- Smss.exe (Session Manager Subsystem)
- Winlogon.exe (Windows logon process)
- services.exe (Windows Service Controller)
- RpcSs (Remote Procedure Call Server Service)*
* Runs inside one of the SVChost.exe. RpcSs is not critical in its own
right but hardly anything runs without it.
These are the 6 critical NT processes, without these 6 items things
don't work too well! Along with that the Task Manager would show:
- System (the kernel or kernel-mode threads)
- System Idle Process (Not a process or service but a single thread that
runs on each processor, its sole task is to account for processor idle
time or time spent doing nothing.)
There you have it, the minimum 8 items that will or should always show
in the Task Manager, add the Task Manager itself to the list and it will
give you 9 processes.
at this point i'm considering replacing the hard drive... but don't
know if i should even attempt to retrieve files off the old one... i'd
thought about putting compromised one in an enclosure and using my copy
of "recover my files" on it... but don't want to retrieve the malware
which keeps reappearing somehow...
If you think that the drive is faulty then go to the manufacturers web
site and download the diagnostic utility for the drive and run it.
These utilities run in DOS, you download the utility and make a DOS boot
CD (or floppy) and use it to boot the computer and test the drive. If
the diagnostic utility tells you that the drive is OK then there is
probably no need to replace the drive, you will be spending money for
nothing. The disk diagnostic utility will probably have a zero write
function, this will wipe your drive clean of any virus which may be on
the drive, after you zero write it I assure you there will be nothing
left on the drive!
You should be able to put the drive in a USB enclosure and retrieve your
personal files before you wipe it clean.
thanks for letting me sound off...
You're welcome.
John
