a nasty self copier

I've been trying to help my friend over the telephone, and not having much luck so far. He called a couple days ago, saying that when he turned his pc on, about 2 minutes later, he was getting all kinds of error messages, saying memory was full. Through some telephone troubleshooting with him, I've learned the problem is cssrrh.exe, which runs about 500 copies of itself within 2 minutes, completely consuming his memory. I've had him do everything I can think of, safe mode does not prevent this file from running. Removing it from the startup list in msconfig does not prevent it from running. And like I said, he only has about 2 minutes or less, and sometimes on startup, it's even less, so there's no way to run any kind of anti virus or any kind of scans. I've googled for this file cssrrh.exe, but not found much of anyting, I'm stumped.....any advice? He does not have HJT installed, and at this point, it's not looking like there's any way to get it, let alone do a scan, in less than 2 minutes.

If he cannot do any scans or you cannot delete it then only thing to do is the unfortunate thing and that is to reformat and re-install.

Not much else can be done.


One thing you might try and might not work is to rename the file(instead of exe at the end type old) from safe mode and try to delete it like that other then that... sorry and good luck

__________________
Stalking and killing Spyware

Have we helped you? Please consider a donation to help keep D-A-L free. Click on donate below



MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis Log __V2.0.2 _|



ASAP: promoting a high standard and quality of security support no matter where you seek help.

Not what I really wanted to hear, lol, but at the same time, I expected it. I was hoping maybe you'd heard of this exe file before, and knew of a trick to defeat it. Google shows very few hits for it, none of which provide much help. I've tried to walk him thru system restore, disabling things in startup, etc..., but it's the same thing every time, runs out of system memory before he can do anything. Trying to rename or delete the exe has not worked yet, because with 3 attempts so far, he's been unable to open the folders to get to it....I think it's about 9 folders deep, and as he opens them one by one, his memory slowly is running out, and he locks up before he can get to it. I'm going down to his house tomorrow afternoon, hoping maybe I can see something firsthand that he's not telling me over the phone, but as of right now, I'm pretty much stumped.

Two minutes isn't enough time to do anything that's for sure, good luck, that is a nasty one for sure.

If by some miracle he can get a hijackthis log, I will be happy to look at it.

__________________
Stalking and killing Spyware

Have we helped you? Please consider a donation to help keep D-A-L free. Click on donate below



MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis Log __V2.0.2 _|



ASAP: promoting a high standard and quality of security support no matter where you seek help.