|
|
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Try now! |
 %WinDir%\csrs.exe - Dangerous
csrs.exe is used to hide files, processes and registry. csrs.exe is a kernel mode rootkit. Rootkit contacts remote hacker server using HTTP session. csrs.exe spreads via open network shares. csrs.exe opens a back door on IRC channels. csrs.exe created new system drivers: service name: "wservtime" display name: "Windows Time Sync" Adds the value: HKLM\SYSTEM\CurrentControlSet\Services\wservtime\ to the Windows startup registry keys. rdriv.sys created new system drivers: service name: "rdriv" display name: "rdriv" Added to registry: HKLM\SYSTEM\CurrentControlSet\Services\rdriv\ Related files: %WinDir%\csrs.exe %SysDir%\rdriv.sys Adds the value: HKLM\SYSTEM\CurrentControlSet\Services\Messenger Start 4 HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry Start 4 HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr Start 4 to the Windows startup registry keys. Added to registry: HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotAllowXPSP2 1 HKLM\SOFTWARE\Microsoft\Ole EnableDCOM N HKLM\SYSTEM\CurrentControlSet\Control\Lsa restrictanonymous 1 HKLM\SOFTWARE\Microsoft\Security Center\ HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\ HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\ More info: <http://www.sophos.com/virusinfo/analyses... Removal: %WinDir%\csrs.exe is removed by RegRun.
Read more... Removal instructions...
Recommended software: RegRun Security Suite - removal and protection. http://www.regrun.com RegRun Reanimator - free removal tool. greatis.com/reanimator
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: September 1 2008
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
