(sorry for the huge paragraphs)
So, next, I decided to delete to file. I made a copy of it (labeled "Copy Of CSRSS.exe) (<--not sure about the capitalization here...)and tried to delete to file to see what would happen. The normal deletion way proved to be a waste of time; I kept the folder open. Instead, I used Sypbot's "Secure Shredder" and got rid of the program. But instead, It just replaced itself after I had deleted it. Now I was sure it was some sort of virus or spyware because I had never seen a system file replicate itself after deletion. I went back to the folder where it was (c:winnt\system32) and then I noticed that since the failed deletion attempt, another file had been created. (It had appeared at the bottom of the folder, out of line, along with the new csrss.exe file)
I used spybot to deleted BOTH of these. They appeared again. (BTW: The other file is nonsensical, it's just a randomly named file with about 8 letters and a seemingly random extension.) Agian, they both reappeared magically in the folder. I hit refresh (accident, I think) and all of the files were realigned. I found both files again. But I noticed two other files. Those too were deleted, and those too respawned.
So now I'm stuck. I can't delete these supicous(SP?) files and everytime I try, they spawn more files...
Hope someone can help...
Oh, and here are the file names involved:
Copy of csrss.exe
Copy of csrsrv.dll
Also, I just remebered, I can't delete the copies I made either; so this might just be normal windows crap.
Oh, and since I started, files in the system folder are popping up that seem to be authentic files except for the fact that they are in windows media palyer format. They're not media files, they're too small and will not run when clicked...
Hope this is just all in my head and not some virus, but if I am infected, than any help is appreciated.
EDIT: Oh, and I'm running windows 2000.
EDIT EDIT:Like the idiot I am, I just noticed the pinned threads. I'm trying those suggestions right now.
Edited by dementedsnake, 28 June 2006 - 06:44 PM.