I have infected files that are essential to
the WindowsXP pro operating system.

These are:
C:\Windows\Config\csrss.exe
C:\Windows\Config\supdate.exe

Therefore I ask: can I delete these two
infected files, and then just copy the
original clean ones from the original
WindowsXP installation disks?

Please advise how this should be done.

Please help, Frank

Frank Martin wrote:
> I have infected files that are essential to
> the WindowsXP pro operating system.
>
> These are:
> C:\Windows\Config\csrss.exe
> C:\Windows\Config\supdate.exe
>
> Therefore I ask: can I delete these two
> infected files, and then just copy the
> original clean ones from the original
> WindowsXP installation disks?
>
> Please advise how this should be done.
>
> Please help, Frank

Neither of those files are in my C:\Windows\Config folder. Supdate is
nowhere on my HD. Rename or delete them. If there are problems,
replace from the Windows\System32 folder or the Windows CD.


--
Joe =o)

What you *should* do is to attend a Security Forum that specializes in these
things and have them help you determine the *exact* nature of your infection
and then follow their instructions for removal. Meanwhile, just rename those
files and see what happens. Change the extensions, not the rest of the name.
Even something so simple as *.virus. See if they come back, as well, and not
necessarily in the same folder.

Here's one good forum:
http://www.castlecops.com/forums.html

And another good one:
http://www.castlecops.com/forums.html (scroll part way down for the Security
forums.

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

"Frank Martin" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
>I have infected files that are essential to the WindowsXP pro operating
>system.
>
> These are:
> C:\Windows\Config\csrss.exe
> C:\Windows\Config\supdate.exe
>
> Therefore I ask: can I delete these two infected files, and then just copy
> the original clean ones from the original WindowsXP installation disks?
>
> Please advise how this should be done.
>
> Please help, Frank
>

"Elmo" <(E-Mail Removed)> wrote in
message
news:(E-Mail Removed)...
> Frank Martin wrote:
>> I have infected files that are essential
>> to
>> the WindowsXP pro operating system.
>>
>> These are:
>> C:\Windows\Config\csrss.exe
>> C:\Windows\Config\supdate.exe
>>
>> Therefore I ask: can I delete these two
>> infected files, and then just copy the
>> original clean ones from the original
>> WindowsXP installation disks?
>>
>> Please advise how this should be done.
>>
>> Please help, Frank
>
> Neither of those files are in my
> C:\Windows\Config folder. Supdate is
> nowhere on my HD. Rename or delete them.
> If there are problems,
> replace from the Windows\System32 folder or
> the Windows CD.
>
>
> --
> Joe =o)

Thanks. I cannot find them on the Windows CD.
Where should I look for them.

Does that mean that you need them, or are you just being a good Boy Scout?

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

"Frank Martin" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
>
> "Elmo" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Frank Martin wrote:
>>> I have infected files that are essential to
>>> the WindowsXP pro operating system.
>>>
>>> These are:
>>> C:\Windows\Config\csrss.exe
>>> C:\Windows\Config\supdate.exe
>>>
>>> Therefore I ask: can I delete these two
>>> infected files, and then just copy the
>>> original clean ones from the original
>>> WindowsXP installation disks?
>>>
>>> Please advise how this should be done.
>>>
>>> Please help, Frank
>>
>> Neither of those files are in my C:\Windows\Config folder. Supdate is
>> nowhere on my HD. Rename or delete them. If there are problems,
>> replace from the Windows\System32 folder or the Windows CD.
>>
>>
>> --
>> Joe =o)
>
> Thanks. I cannot find them on the Windows CD. Where should I look for
> them.
>
>

They're in the i386 folder but they're compressed and have an underscore in
place of the last letter of the filename. Here's the instructions for
getting individual files off the installation CD, but if you couldn't boot,
you'd have to do it from a recovery console.
http://www.winxptutor.com/expand.htm

Most relevant to this procedure is what version of XP you're running now.
Original, SP1 or SP2 or SP3? (Look in Control Panel>System on the General
tab. It will tell you what SP, if any, you have.

But the usual thing would be that they're replaced from the DLLCACHE. If
every copy of those files on that machine are infected, I would be very
surprised.

Anyway, enough of this NG, get thee to a proper Security forum, please!

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

"Frank Martin" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
>
> "Elmo" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Frank Martin wrote:
>>> I have infected files that are essential to
>>> the WindowsXP pro operating system.
>>>
>>> These are:
>>> C:\Windows\Config\csrss.exe
>>> C:\Windows\Config\supdate.exe
>>>
>>> Therefore I ask: can I delete these two
>>> infected files, and then just copy the
>>> original clean ones from the original
>>> WindowsXP installation disks?
>>>
>>> Please advise how this should be done.
>>>
>>> Please help, Frank
>>
>> Neither of those files are in my C:\Windows\Config folder. Supdate is
>> nowhere on my HD. Rename or delete them. If there are problems,
>> replace from the Windows\System32 folder or the Windows CD.
>>
>>
>> --
>> Joe =o)
>
> Thanks. I cannot find them on the Windows CD. Where should I look for
> them.
>
>

Thanks, I went thru this and expanded the
file from the original WindowsXP CD,
converting csrss.ex_ to csrss.exe which I
then copied into C:WINDOWS\Config.

When I restarted the computer I get an error:

"C:\Windows\Config\csrss.exe application
cannot be run in win32 mode."

Also, the new csrss.exe file is much smaller
than the corrupted one.




"Gary S. Terhune" <none> wrote in message
news:%(E-Mail Removed)...
> They're in the i386 folder but they're
> compressed and have an underscore in place
> of the last letter of the filename. Here's
> the instructions for getting individual
> files off the installation CD, but if you
> couldn't boot, you'd have to do it from a
> recovery console.
> http://www.winxptutor.com/expand.htm
>
> Most relevant to this procedure is what
> version of XP you're running now. Original,
> SP1 or SP2 or SP3? (Look in Control
> Panel>System on the General tab. It will
> tell you what SP, if any, you have.
>
> But the usual thing would be that they're
> replaced from the DLLCACHE. If every copy
> of those files on that machine are
> infected, I would be very surprised.
>
> Anyway, enough of this NG, get thee to a
> proper Security forum, please!
>
> --
> Gary S. Terhune
> MS-MVP Shell/User
> http://grystmill.com
>
> "Frank Martin" <(E-Mail Removed)> wrote in
> message
> news:%(E-Mail Removed)...
>>
>> "Elmo" <(E-Mail Removed)> wrote in
>> message
>> news:(E-Mail Removed)...
>>> Frank Martin wrote:
>>>> I have infected files that are
>>>> essential to
>>>> the WindowsXP pro operating system.
>>>>
>>>> These are:
>>>> C:\Windows\Config\csrss.exe
>>>> C:\Windows\Config\supdate.exe
>>>>
>>>> Therefore I ask: can I delete these two
>>>> infected files, and then just copy the
>>>> original clean ones from the original
>>>> WindowsXP installation disks?
>>>>
>>>> Please advise how this should be done.
>>>>
>>>> Please help, Frank
>>>
>>> Neither of those files are in my
>>> C:\Windows\Config folder. Supdate is
>>> nowhere on my HD. Rename or delete them.
>>> If there are problems,
>>> replace from the Windows\System32 folder
>>> or the Windows CD.
>>>
>>>
>>> --
>>> Joe =o)
>>
>> Thanks. I cannot find them on the Windows
>> CD. Where should I look for them.
>>
>>
>
>

"Gary S. Terhune" <none> wrote in message
news:%(E-Mail Removed)...
>
> Anyway, enough of this NG, get thee to a proper Security forum, please!


Why have all your posts been deleted in the vista newsgroup, on the MS
newsserver?

They had been deleting all my posts a little while ago, even though I am not
a troll, and was helping a lot of people.

I find it rather amusing that they have started censoring their own MVPs
now. What do you think you did to deserve this?

ss.

You aren't listening, I can't help you.

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

"Frank Martin" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> Thanks, I went thru this and expanded the file from the original WindowsXP
> CD, converting csrss.ex_ to csrss.exe which I then copied into
> C:WINDOWS\Config.
>
> When I restarted the computer I get an error:
>
> "C:\Windows\Config\csrss.exe application cannot be run in win32 mode."
>
> Also, the new csrss.exe file is much smaller than the corrupted one.
>
>
>
>
> "Gary S. Terhune" <none> wrote in message
> news:%(E-Mail Removed)...
>> They're in the i386 folder but they're compressed and have an underscore
>> in place of the last letter of the filename. Here's the instructions for
>> getting individual files off the installation CD, but if you couldn't
>> boot, you'd have to do it from a recovery console.
>> http://www.winxptutor.com/expand.htm
>>
>> Most relevant to this procedure is what version of XP you're running now.
>> Original, SP1 or SP2 or SP3? (Look in Control Panel>System on the General
>> tab. It will tell you what SP, if any, you have.
>>
>> But the usual thing would be that they're replaced from the DLLCACHE. If
>> every copy of those files on that machine are infected, I would be very
>> surprised.
>>
>> Anyway, enough of this NG, get thee to a proper Security forum, please!
>>
>> --
>> Gary S. Terhune
>> MS-MVP Shell/User
>> http://grystmill.com
>>
>> "Frank Martin" <(E-Mail Removed)> wrote in message
>> news:%(E-Mail Removed)...
>>>
>>> "Elmo" <(E-Mail Removed)> wrote in message
>>> news:(E-Mail Removed)...
>>>> Frank Martin wrote:
>>>>> I have infected files that are essential to
>>>>> the WindowsXP pro operating system.
>>>>>
>>>>> These are:
>>>>> C:\Windows\Config\csrss.exe
>>>>> C:\Windows\Config\supdate.exe
>>>>>
>>>>> Therefore I ask: can I delete these two
>>>>> infected files, and then just copy the
>>>>> original clean ones from the original
>>>>> WindowsXP installation disks?
>>>>>
>>>>> Please advise how this should be done.
>>>>>
>>>>> Please help, Frank
>>>>
>>>> Neither of those files are in my C:\Windows\Config folder. Supdate is
>>>> nowhere on my HD. Rename or delete them. If there are problems,
>>>> replace from the Windows\System32 folder or the Windows CD.
>>>>
>>>>
>>>> --
>>>> Joe =o)
>>>
>>> Thanks. I cannot find them on the Windows CD. Where should I look for
>>> them.
>>>
>>>
>>
>>
>
>

I don't know. Don't really care. They're out there somewhere.

Two major possibilities come to mind: General Microsoft Incompetence when it
comes to news server maintenance crew, or 2. Carey Frisch.

--
Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com

"Synapse Syndrome" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> "Gary S. Terhune" <none> wrote in message
> news:%(E-Mail Removed)...
>>
>> Anyway, enough of this NG, get thee to a proper Security forum, please!
>
>
> Why have all your posts been deleted in the vista newsgroup, on the MS
> newsserver?
>
> They had been deleting all my posts a little while ago, even though I am
> not a troll, and was helping a lot of people.
>
> I find it rather amusing that they have started censoring their own MVPs
> now. What do you think you did to deserve this?
>
> ss.
>