regscan is running and 50% CPU

avast Home 4.7 ED, VPS 000731-0
WindowsXP Professional SP2, Multi boot system (Main-WinXP & Sub-WinXP)
Core2 Duo E6400, 2GB RAM, ASUS P5B, SATA HDD(320GB x 3)

At resent, regscan.exe have been running for a few minutes after PC startup. Then CPU utilization reaches at 50% without any application process.

So, I tried to scan memory and full local HDD. Nothing has been found out in chest llist. And any virus can not detect although tried avast virus cleaner too.
The regscan.exe is existing in C:\windows\system32\ indeed.

Could you please any advice on this trouble?

regards,
fuji

Hi fuji_m,

Please upload a copy of regscan.exe to Virus Total and post the results.

A google search for regscan,exe returns many hits, and it would appear to be a variant of W32.Rbot Trojan, here are a few:
http://www.liutilities.com/products/wintaskspro/processlibrary/regscan/
http://www.bleepingcomputer.com/startups/regscan.exe-8651.html
http://www.sophos.com/security/analyses/w32rbotha.html.

Check if any of the associated information matches, like location, any registry keys or files, etc.

What ever you do after confirmation at VirusTotal you need to submit the sample to avast.

If you are not getting a virus warning that you believe is a new, undetected virus then if you can zip and password protect (‘virus’, will do) the suspect file and send it to virus @ avast.com (no spaces). Or you can also add the file to the User Files (File, Add) section of the avast chest where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest.

Give a brief outline of the problem (possibly a link to this thread), the fact that you believe it to be an undetected virus and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.