CSC.SYS Backdoor.Tidserv.I!inf

[Daniel Bennett <dbennett () PCT EDU>]

Hello All,

Our Symantec console has been reporting a few machines across our campus as having a Backdoor.Tidserv.I!inf virus and 
always identifies CSC.SYS as the file (C:\Windows\System32\drivers\csc.sys).  However, I have come up empty with other 
malware scanners and can't identify where this is coming from because it is always tied to the SYSTEM account.

Has anyone see this recently or in the past?

Thanks,

Daniel Bennett
IT Security Analyst
Vice-Chair North Central PA Members Alliance
Pennsylvania College of Technology
P:570.329.4989
E:dbennett () pct edu