system
March 26, 2009, 6:05pm
1
Hi all, I just came back from a holiday to see my computer getting infected.
For some reason, regsvr32.exe is eating up my processor.
http://i369.photobucket.com/albums/oo133/dwcwei/misc/help.jpg
I ran scans with AVG/Avast/Ad-Aware and yeah, found some stuff, tried to repair, also did a boot-scan with Avast! but the problem still persist!
Are you currently running both A/V products (Avast and AVG)? You shouldn’t have more than one installed at any given time. They’ll step on each others toes.
So, pick which one you want to use and remove the other.
Then, if you could post a log as to where the viruses are and what their names are, we can help you further.
system
March 26, 2009, 6:11pm
3
Yeap! I just uninstalled AVG already, thanks for the advice! Was trying to post the hijackthis log file since my original post, haha.
Umm, maybe I did not really get you properly, where do I get the log you mentioned about? Sorry, I don’t really know much about in this area.
system
March 26, 2009, 6:11pm
4
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
system
March 26, 2009, 6:12pm
5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=105563 WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll
system
March 26, 2009, 6:13pm
6
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exehttp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
–
Doesn’t look like AVG’s gone…
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
still looking through your logfiles…
system
March 26, 2009, 6:17pm
8
Haha yeah, when I read your post I immediately went to uninstall it. Sorry! :-[
Bad:
O2 - BHO: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM..\Run: [el] “C:\WINDOWS\system32\regsvr32.exe” /u /s “C:\WINDOWS\system32\el32.dll”
O4 - HKLM..\Policies\Explorer\Run: [imapd] “C:\WINDOWS\system32\imapd.exe” -at
You should use the AVG Removal tool too. You can find it here: http://www.avg.com/download-tools
system
March 26, 2009, 6:21pm
11
Ah, thanks for the link. But I guess the virus doesn’t like me to go there…so I cannot access/download it from that site, but I’ll try find another link to download it.
Yes, it works a lot better than finding that stuff manually! ;D
system
March 26, 2009, 6:32pm
13
Okay, thanks for the tip. I just fixed the 4 files you mentioned.
I still cannot download the AVG Removal tool though, so I tried to follow this guy’s words.
Look if one (or more) of these regentries exist and delete them if they do: Enter the registry (Click start > run > type regedit and then click ok), in there simply follow the path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG7Uninstall and then check for the next one and the next etc etc.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG7Uninstall
But there’s no AVG registry under there…
Do you have another computer with internet access that you could download the AVG Removal tool, then copy it to your computer that needs it?
Maybe you could try to re-install it, then remove with the built-in utility, like so: http://www.pchell.com/virus/uninstallavg.shtml
system
March 26, 2009, 6:37pm
15
Yeah, I’m gonna do that tomorrow. Haha, already pass two in the morning in my area.
I cannot go into http://free.grisoft.com/doc/5390/us/frt/0 too.
Can you download malware bytes from http://www.malwarebytes.org and run a quick scan?
You are sure that the previous 4 entries that I have stated were bad have been removed?
It might be useful to use a rootkit removal program: http://www.antirootkit.com/software/index.htm
system
March 26, 2009, 6:50pm
17
Dang, I just ran the HijackThis scan again and the following one was still there,
O4 - HKLM..\Run: [el] “C:\WINDOWS\system32\regsvr32.exe” /u /s “C:\WINDOWS\system32\el32.dll”
I also have to download malware bytes from another computer but I can download a rootkit removal program.
I downloaded this one, http://www.antirootkit.com/software/Gmer.htm
I knew something had to be still there, otherwise you would have been able to access those sites.
Let us know what happens with the gmer program, hopefully it will get rid of that last pesky file.
system
March 26, 2009, 6:56pm
19
Okay, thanks for all the help so far. I am gonna go sleep now too, dead tired.
Really wanna get rid of the annoying problem…
Sounds good and good luck. I’m sure we’ll be able to get it fixed up for ya.
