v8000

If you have a ton of "cssrrh.exe" processes running on your machine, you have fallen prey to a nasty little rootkit. Most anti-virus tools will remove this file for you, but it tends to pop up again after the next time you reboot.

To get rid of it *permanently* follow these steps:

1.) open regedit and remove all references to cssrrh.exe and sysload32vl.dll
(use the find command, and delete the entire keys that you find.)

2.) get yourself this handy little tool: http://www.gmer.net/gmer.zip

3.) run it and use the "Safe.." button to restart it in GMER safe mode

4.) use the kill feature to delete:
- \program files\internet explorer\plugins\cssrrh.exe
- \windows\sysload32vl.dll

5.) reboot

6.) have a beer

Hi,

I had the cssrrh.exe phenomena as well. I suspect it comes from some infected porn sites. Anyways this is how I treated it: First: The moment windows boots I open the taskmanager right away and I delete the cssrrh processes as long as they pop up. Usually after about 15 - 20 times it's coming to an end with them popping up. After that I went into the folder "Internet Explorer/Plugins" and corrupted the cssrrh.exe by opening it in the editor and deleted random bits and wrote other stuff into it. Then I set the write protection to that file and it seems to work now. But I also have a very recent Image of my Systemdrive that I gonna write back. And You don't really want to risk anything these days anymore and have an image program to do an image at least once a week (and keep the last three till you are sure all is OK). Funny enough, I had it before and I just went straight back to my last image then, but this time I needed to keep my system the way it was for some time, so I found this solution till I know what it is. Let me know if you have further knowledge of that thing. Google finally shows some hits now, but the first time it happened there were only 9 and all in some foreign languages. rishi_vst@gmx.de