Running Services: iass.exe, crss.exe, Constant writes?

**martinr121** · 28th February 2005

Hi All, maybe somebody can enlighten me on this one. I noticed that my hard drive light blinks constantly, about 1 or 1 1/2 times per second forever. As far as I know this is a relatively new behavior.

When I look at running services in task manager, I see constant reads/writes for two services, iass.exe and crss.exe whose tally changes with each HDD blink. I also see svchost.exe, doing reads and writes, but not at the magnitude of the others.

Also, without foreground programs running, performance tab shows the cpu usage constant at 5-7%% and system idle process at 0.

I did a search for those two, including hidden and system fileas, and as far as Windows is concerned, there are no such files on this machine.

Any information would be appreciated.

Take care,

Martin

surferdude2 · 28th February 2005

Sounds like malware to me martin. Run AdAware and Spybot to clean it up. Use good ol' HiJackThis also. Delete the files manually if you must. (Safe Mode)

**Bmoore1129** · 28th February 2005

I have lsass.exe and csrss.exe running in my processes but they are not causing cpu usage. They are in C:\Windows\system32 and in the DLL cache. Are these the things you see?

Do you have windows indexing turned on? That will cause your HD to hunt and peck incessantly.

surferdude2 · 28th February 2005

Martin, you need to update your worms. You're running an older version and you may be missing some of the misery.

Agbot Worm

**TonyT** · 28th February 2005

Quote:

Originally Posted by surferdude2

Martin, you need to update your worms. You're running an older version and you may be missing some of the misery.

Agbot Worm

**martinr121** · 28th February 2005

Mea Culpa, Mea Culpa:

Correct service names:

csrss.exe
isass.exe

Both are merrily writing and reading, after several hours of uptime. Windows will not allow service shutdown, claiming them to be "Critical Processes"

Ad Aware, Norton AV, SpyBot, PestPatrol, MSFT's anti spyware all come up empty.

Dude, maybe if you send me a link for the Worm update, those programs could find the updated version!

Tale care,

Martin

surferdude2 · 28th February 2005

isass.exe is still a virus.

http://www.iamnotageek.com/a/isass.exe.php

Sometimes these keyloggers and such escape detection. Do an on-line with HouseCall maybe just for style points.

**Steve R Jones** · 28th February 2005

"The pages below are from our in-house database and provide guidance on the usefulness or not of these programs, and removal procedures when recommended."

http://www.answersthatwork.com/Taskl...s/tasklist.htm

**martinr121** · 1st March 2005

Gulp!

From: www.answersthatwork.com

Quote:

Isass
isass.exe

(???)
You have the Backdoor.Futro virus.

Note – do not confuse this with LSASS which will most times show as “lsass” in your Task List where the first letter is in fact a lowercase “L” rather than an “i”.

Well, it looked like an i to me.

I will be in hiding for the next 24 hours.

Martin

surferdude2 · 1st March 2005

Well, that settles it..You either need to run an on-line scan or run to the optometrist.

Not to worry martin, I drop my candy in the sand once in a while too. We'll let you slide.

**noahdfear** · 1st March 2005

Hi Martin!

Suspicious activity and very odd CPU numbers. Lets have a closer look at your processes. Download Process Explorer, unzip and open, then click file>save as and put on your desktop. Open and copy/paste it here.

**martinr121** · 1st March 2005

Hi Dave, Darn HDD, blink, blink, blink.

Here's the file:

**noahdfear** · 1st March 2005

This one doesn't look good to me.
INSTAN~1.EXE 2952

Please download the List Installed Programs script from here, run it and post it's log.

**TonyT** · 1st March 2005

INSTAN~1.EXE = scanner software.

possible baddies:
cookie.exe:
http://vil.nai.com/vil/content/v_99083.htm

**noahdfear** · 1st March 2005

HeHe, you may be right Tony. I figured the cookie.exe is the Cookie Wall program, and I think I've been seeing too much of the Instant Access infection lately.

Gonna crawl into the corner and keep Martin company.