Geek Speak — HabitableZone

Geek Speak » in reply to re: those sneaky bastards

re: those sneaky bastards
Moby — (archived)

From what I've been able to see, smss.exe isn't the only file involved. There's also csrss.exe. I did a little googling on smss.exe and found some sites that relate it to a worm that's been around for a lot longer than these popups. It appears the worm has been adapted. Here's one site worth checking:

http://www.avp.ch/avpve/worms/win32/ladex.stm

I found both smss.exe and csrss.exe in my system and have renamed them both with the .old extension. The site mentioned a third file, lady.exe, but I did not find that because it's probably related to the previous use of the worm.

I'd mentioned before the game Fishy from Xgen Studios as one of the sources of infection. I have not played the game since I decided it was a culprit, and I have not had any popup problems since.

Btw, read that information on the site, especially the part about invisibility. The worm seems smart enough to be able to hide itself if you run RegEdit.

My advice at this point: look for smss.exe, csrss.exe and lady.exe. Rename them if you find them. If nothing's messed up after a reboot, delete them. And if you play any Java-based games, look for the ConfigSys folder after playing them, then get it out of your system.

Log in or register to post.

The whole thread (44 posts)