DIGIT-ARC read-only archive · snapshot: July 23, 2026

Virus trouble (VERY weird stalker virus)

10 posts · originally from https://geek.digit.in/community/threads/virus-trouble-very-weird-stalker-virus.45131/

M
mightyboosh Original post #1
Dec 30, 2006 at 3:45 PM
Hello,

i'm just writing this quick thread to see if anyone here knows about this problem and if they can suggest ways to cure my computer. My computer was very badly screwed for long because of some unrecognisable reason; i did scan it with AVG free but it didn't detect anything and i was convinced that my computer doesnot have a virus and it's just some hardware trouble that's causing the problem.

However, i was just double checking using pcpitstop.com to see if it could detect any more problems and i discovered that my computer had a virus (called csrss.exe) and i think there's a system file named that. i knew the location of the file (it was in a hidden 'application data' folder) but i couldn't open folder options for some reason. Then i searched for the folder and tried deleting the file but it just reappeared when i clicked on 'refresh' and when i checked in the tasks (ctrl + alt + delete) i couldn't end process (it sais it was an important system process and cannot be ended)

This is the weirdest part, whenever i google search the virus name, no matter what browser it is, it shuts down and shortly after that my system reboots. I haven't a clue what to do to get rid of it now. Please help!
Should i just reformat my drive because i kept updating my AVG and this thing was right under it's nose..

If possible could you google search the name and forward me the links or the applications which i can use to get rid of this.

Thanks for reading,
- MCW
Kiran.dks
Dec 30, 2006 at 4:42 PM
Your system is infected with W32/Brontok worm. It spreads through mails. When infected it copies itself to <User>\Local Settings\Application Data\csrss.exe

There exists csrss.exe, which is a critical Windows process. It runs in C:\Windows\System32 and not Application Data.

:arrow: Download:BitDefender Removal tool

Start windows in safe mode and scan entire system.
anandk
anandk #3
Dec 30, 2006 at 6:54 PM
Sample infectors that use the name CSRSS.EXE are...

C:\CSRSS.EXE
W32/Buchon.c@MM -- *vil.nai.com/vil/content/v_130857.htm

%WinDir%\MSAGENT\WIN32\CSRSS.EXE
W32/Sober.l@MM -- *vil.nai.com/vil/content/v_131869.htm

%WinDir%\CSRSS.EXE
W32/Melare@MM -- *vil.nai.com/vil/content/v_100306.htm

%WinDir%\CSRSS.EXE
W32/Netsky.ab@MM -- *vil.nai.com/vil/content/v_124873.htm

%WinDir%\CSRSS.EXE
MultiDropper-JW -- *vil.nai.com/vil/content/v_101115.htm

%WinDir%\CSRSS.EXE
Downloader-MC -- *vil.nai.com/vil/content/v_126644.htm

fruitful discussion here at CSRSS.EXE Virus That Won't Go Away
X-300 Hawk
Aug 21, 2007 at 7:19 PM
That is a bit creepy and do exactly what Kiran Tech Mania said immediatly.
RCuber
RCuber #5
Aug 21, 2007 at 7:25 PM
^^^ WTH !!! You bumped a year old thread .

Reporting to lock this thread.
RCuber
RCuber #7
Aug 21, 2007 at 7:55 PM
^^ This is a year old thread . Look at the data anandk had last posted ( just above the username )

30-12-2006, 06:54 PM
M
Aug 22, 2007 at 4:39 PM
I'd posted this a long long time ago, when i still used windows all the time. Who bumped it, and why?
spironox
Aug 22, 2007 at 11:06 PM
heheh things are getting bumperry here hhehe lolz :D
RCuber
RCuber #10
Aug 22, 2007 at 11:34 PM
Mods .. Where are you ?