Yishay Mor: Professional: TickTalk

--- Thursday, June 19, 2003 ---

 

How Knoppix saved my Windows

Yesterday our home machine wouldn't boot.
You turn it on, it goes through all the pains of the Win2k boot sequence, then, just when you think the logon window is finally about to show - wham! it restarts itself.

Yes, of course I tried safe mode. I tried safe mode with cmd line, I tried boot logging, I tried restore last good, I tried singing "when the saints come marching home" while holding F9. nothing doing.

No worries. I say, I have just the right thing in the office. I'll bring it tomorrow.

Now, what is that "just the right thing" to save our Win box? Exactly. A CD-bootable Linux, aka Knoppix.

And it boots. boots? it rocks!

So, now I comb my disk for log files, error reports, event msgs, the works. Can't find a thing. (oh yes, Knoppix has no problem handling the Win file system).

Then I remember. Ever since we upgraded to 2k, our computer persistantly pops up stupid porn adds. So, the day before last I decided to nail the dumb thing. I tracked it down to one csrss.exe, and renamed it. Cool.

So, if that's the last thing I changed, change it back. Found it, politly asked Knoppix to let me write to the Win filesys (defult is read only), and renamed.

Reboot.

Yee-haa!!! The ugly face of MS Win is back!

It turns out that csrss is the "Client Server Runtime Process", which The Windows Client Server Runtime Subsystem handles Windows and Graphics.

The annoying porn msgs it sends are a known issue, and happen to be a symptom on the dalbug worm.

So there. Now all I need is to remove the worm.

and next time, I guess I should ask google before I rename system files..


Hey!! wait a minute!

re: csrss advetising problems
Saturday, February 22, 2003 at 3:07 pm
Windows XP Annoyances Discussion Forum
Posted by triplate [find other messages by triplate]

it's not a virus or a worm. it's spam. csrss.exe has a bug in it that can be exploited to utilize NT/XP's built-in Messenger service. it's being used to broadcast ads and such. Disable Messenger Service.......

Thanks, guys!


posted by Yishay 12:13 AM

--- Monday, June 16, 2003 ---

 
Duh! It looks like a Cow called rose the 2nd may determine the fate of the world! or, at least the fate of open source software, if there's any difference between the two..
posted by Yishay 1:44 PM