Hello,
I have encountered some type of worm on two of my main server which are running Windows NT 4.0.
After doing some online research it appears that my servers are infected with a variant of WORM_AGOBOT.ADG. This Worm uses all of the CPU resources and makes it virtually impossible for the server to perform any other tasks.
I removed the crcss.exe application from the System32 folder, removed it from HKLM/Software/Microsoft/Windows/CurrentVersion/Run, and deleted the crcss.exe process. This seems to temporarily stop the problem however; the application keeps reinstalling somehow.
No virus software, Antispyware, or other tools are picking anything up. I have checked the scheduled tasks and nothign appears to be out of the norm.
Can anyone tell where else I am likely to find some hidden application running responsible for re-installing this malware application?
Any help would be greatly appreciated….I am just weeks away from a migration to 2003..Murphy’s Law I guess.
Thanks
