Posted by so on May 25, 2005, at 0:17:13
In reply to Re: green words in babble posts » so, posted by anastasia56 on May 24, 2005, at 22:46:08
> i tried your suggestions below and so far it is working. i deleted about five different programs. cvshost, osa and a few others. i tried to end program on csrss as it is listed in google as suspect but it isn't delete-able as it is considered a priority by windows.
>
> the selected green words are not medical in nature. they don't seem to follow any particular pattern, just nouns.
>
> thanks in advance for your help. i really appreciate it.
>
> ana
>Well, by golly, at least I helped one person.
googling must've told you cvshost.exe is added by the Gaobot.AO worm, which opens machines to exploits when you use IRC.
Problem with csrss.exe is, it is the process that drives Microsoft Client/Server Runtime Server Subsystem, but it is also a file name for a W32.Netsky.AB@mm worm, the W32.Webus Trojan, Win32.Ladex.a and more. It is a significant threat, which arrives as an attachment to e-mail and can e-mail itself to other people, steal passwords and other personal data.
OSA could be "office start-up assistant" a legit component of MS Office XP, but you don't need it to run. But exploits can use familiar names, as does csrss.exe. Important thing is to shut down as much as you can before cleaning up the system with AdAware and Norton or whatever. If you just shut them down but don't clean up, they can come back. Also, even the best freeware spyware-cleanups only go so far -- most offer segue's to "pro" versions that cost.
A manual, google-informed housecleaning with RegClean is still a good idea if your comfortable pruning that close to your vital system registry, but you have to watch out for exploits that mimick legit processes.
poster:so
thread:502255
URL: http://www.dr-bob.org/babble/admin/20050517/msgs/502589.html