[douglasdickel]

Peguei o vírus, a porra do csrss.exe. Consegui movendo-o da pasta system32 para a raiz do C, e então eu o renomeei para txt.




MZ�   ÿÿ ¸ @ à º ´ Í!¸
LÍ!This program cannot be run in DOS mode.

$ !»óžeÚ�ÍeÚ�ÍeÚ�ÍeÚœÍhÚ�ͦÕÀÍ`Ú�ͦՒÍfÚ�ͦÕÃÍdÚ�ͦÕÂÍcÚ�ͦÕÇÍdÚ�ÍRicheÚ�Í PE L
 |A à 


  £  hJ   


P  ¡ö
 0     < 0  @ ` @  p @ x 0  8 .text  
   `.data l   @ À.rsrc  0   @ B.reloc ” @   @ B”A ГA" ntdll.dll CSRSRV.dll ^0±u Žè�|gâ�|£è�|@z“|â�|Bô’|-æ�|0�|Ô‘|Æ0‘|^(’| |A  " ¸ ¸ ÿÿÿÿíhJñhJ H  hJàhJ RSDSmÄ×WÜ@ºpØf�5Ì
csrss.pdb ¤ Ì ‹ÿU‹ìQƒeü j�EüPjjÿÿ hJÉÃÌÌÌÌÌ‹ÿU‹ìQQV‹5 hJWj�EüPjjÿÇEü
ÿÖ3ÿWWjjÿÿÖ…À}�EøPj
WWWh7
ÀÿhJÿuÿuè— ‹ð;÷} VjÿÿhJè|ÿÿÿd¡ ‹@09¸Ô
u
WWj
ÿhJƒÄVjþÿhJ_3À^ÉÃÌÌÌÌÌ‹ÿU‹ìèv ]éR ÌÌÌÌÌjh`hJèŒ ƒeü º þ‹÷b¬Ð‰Eä‹M‹ÑÁê3Ð�âÿÿ ‰ë3À@Ëeèd¡ ‹M3Á‰
ƒMüÿ‹
…Àt=@» uÇ
A» èn ÃÌÌÌÌÌ¡ hJ…Àt=@» uh hJè{ÿÿÿ¡ hJY÷У hJÃÌÌÌÌÌh¤hJd¡ P‹D$‰l$�l$+àSVW‹Eø‰eèP‹EüÇEüÿÿÿÿ‰Eø�Eðd£ ËMðd‰
Y_^[ÉQÃVC20XC00U‹ìƒìSVWUü‹]‹E÷@ …« ‰Eø‹E‰Eü�Eø‰Cü‹s‹{Sèé
ƒÄÀt{ƒþÿt}�v‹D�ÀtYVU�k3Û3É3Ò3ö3ÿÿÐ]^‹]Àt?xH‹{Sè“ ƒÄ�kVSèá ƒÄ�vj
‹D�èl
‹�‰C‹D�3Û3É3Ò3ö3ÿÿЋ{�v‹4�댸 ë#‹EƒH¸
ëU�kjÿSèŽ ƒÄ]¸
]_^[‹å]ÃU‹L$‹)‹AP‹APèi ƒÄ] ÌÌÌÌÌÌÌU‹ìSVWUj j hÄhJÿuè* ]_^[‹å]ËL$÷A ¸
t(‹D$U‹h‹P(R‹P$Rè ƒÄ]‹D$‹T$‰¸ ÃSVW‹D$UPjþhÌhJdÿ5 d‰% ‹D$$‹X‹pƒþÿt5ƒ|$(ÿt;t$(v(�4v‹³‰L$‰Hƒ|³ uh

‹D³è@ ÿT³ë¼d� ƒÄ_^[Ã3Àd‹
�yÌhJu‹Q‹R9Qu¸
ÃSQ» hJë
SQ» hJ‹M‰K‰C‰kUQPXY]Y[ ÌÌÌÌÌ‹ÿU‹ìƒì SV‹u‹^öÃud¡ ‰Ed¡ ‰Eü;]ür;]s3Àéæ
W‹~ƒÿÿu3À@éÔ
3Ò‰U‹Ã‹ƒùÿt;Êsdƒx tÿEBƒÀ;×väƒ} t‹Fø;EürE;ÆsA‹
hJ‹ó�æ ðÿÿ3À…É~94…( hJt+@;Á|ò�EPj�EàPj SƒÏÿWè~
…À||‹Eëy3ÀéW
…ÀŽsÿÿÿ3Ò»h hJB‹û‡…Ò…_ÿÿÿ94…( hJt*�Aÿ…À|94…( hJtHyô…À}ƒù}A‰
hJ�Aÿët3Ò…À|�•( hJ‹9B;Љ1‹÷~î3À‡éÿÿÿ3À…À„Û �}ø
…Î öEôÌtZ‹Mäf�9MZ…º ‹A<Á�8PE …© f�x
…� +Ùfƒx ·H�L
†ˆ ‹A;Ør‹QÐ;Ús
öA'€…ÿÿÿ3À@‹Èºh hJ‡
…Éu`‹
hJ…É‹Ñ~��$ hJ90tJƒè…Òô…Òu-j[;Ë‹Ù3Ò…Û|�•( hJ‹8B;Ó‰0‹÷~îƒù}A‰
hJ3À¹h hJ‡
é&þÿÿ‹Ç_^[ÉÃÌÌÌÌÌÌÿ%hJÌÌÌÌÌÌÿ%hJÌÌÌÌÌ‹ÿU‹ìƒì,‹ESVÿp3Û‰]üÿ0hJ‹ð3ÉA;ó�Eü‰u܉]ì‰]è‰Eà‰Eä‰Mð‰Mô‰]ø„~
�F@9Xtf9u�F8WQP�EÔPÿ,hJ‹}Ø;û‹Çt*Š:Ët$€ù @Š:ËuôŠ:ËtÿEô€ù ~@€8 úŠëØ‹Mô‹FHA;Ãtë
ÿEðf‹@@f…Òuöf9uî‹Uð‹FB‰Eìd¡ ‰˜ô Ê�� P‹ESÿpÿ(hJ‹ø;ûud¡ ëT�F@‰9X‰}àtf9u�F8j
P�EÔPÿ,hJ‹uØ;ó·MÔtmd¡ ƒÁQ‰˜ô ‹ESÿpÿ(hJ;ÃuHd¡ ‹€ô ;ÉEø|cÇEø ÀëZ:Ët,€ù FŠ:Ëuô8t‰ƒÇÿEèëˆ@FŠ€ù õˆ@ŠëЋE܉‹@HƒÇ;É}ät뉃Çf‹@@f…Éuöf9uì‰9]ì_tè? 9]ø|ÿuìÿuäÿuàÿuèè7øÿÿƒÄ‰EøÿuøjÿÿhJ^[É ÌÌÌÌÌÌÿ% hJÌÌÌÌÌÌÿ%$hJÌÌL ÿÿÿÿÿÿÿÿî  D ÿÿÿÿÿÿÿÿ6   Ä Ú – ø  ª | B R d „ 7
NtSetInformationProcess U
NtTerminateThread RtlSetProcessIsCritical T
NtTerminateProcess 
NtRaiseHardError ntdll.dll RRtlUnwind 
NtQueryVirtualMemory  CsrServerInitialization CSRSRV.dll  DbgBreakPoint Ž
RtlAllocateHeap ERtlUnicodeStringToAnsiString ËRtlNormalizeProcessParams ¿Dÿÿ@» “
  €

0 €
 H `0 œ œ4 V S _ V E R S I O N _ I N F O ½ïþ

 „(

 „(
?  
ü
S t r i n g F i l e I n f o Ø
0 4 0 9 0 4 B 0 L 
C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n d 
F i l e D e s c r i p t i o n C l i e n t S e r v e r R u n t i m e P r o c e s s r )
F i l e V e r s i o n 5 . 1 . 2 6 0 0 . 2 1 8 0 ( x p s p _ s p 2 _ r t m . 0 4 0 8 0 3 - 2 1 5 8 ) 4

I n t e r n a l N a m e C S R S S . E x e € .
L e g a l C o p y r i g h t © M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . <

O r i g i n a l F i l e n a m e C S R S S . E x e j %
P r o d u c t N a m e M i c r o s o f t ® W i n d o w s ® O p e r a t i n g S y s t e m @ 
P r o d u c t V e r s i o n 5 . 1 . 2 6 0 0 . 2 1 8 0 D
V a r F i l e I n f o $  T r a n s l a t i o n °  ` d0h0¬0°011N1h1ˆ1”1»1$242>2F2Q2¸34ƒ4�4¦4F5[5—5«5»5Ð5ä5y6…6’6¸6Ï6Ö6ð6ü67a7à7888ä8ö89