Go Back   Cyber Tech Help Support Forums > Operating Systems > Older Windows Versions > Windows 98
Reload this Page regsvcr32 problem...
Register Blogs FAQ Calendar Search Today's Active Topics Mark Forums Read

Notices
If you are experiencing difficulties posting your question please read our FAQ, or visit our site help that has adobe flash tutorials illustrating the question/reply process.

Reply
 
Topic Tools
  #1  
Old March 14th, 2004, 10:01 PM
tRustyK5 tRustyK5 is offline
New Member
  
Join Date: Mar 2004
Posts: 4
regsvcr32 problem...
Picked up regsvc from God knows where. Unfortunately my 4 year old daughter clicked on OK to download it (Doh!)

Anyways, I downloaded AdAware and HijackThis! and ran them both.

Here is the Scanlog after running Hijackthis!

Logfile of HijackThis v1.97.7
Scan saved at 12:45:48 PM, on 14/03/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WARNER\WARNER.EXE
C:\SUPPORTCENTER\AUAGENT.EXE
C:\WINDOWS\SYSTEM\PRINTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\TYPE32.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\WINDOWS\SYSTEM\REGSVC32.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\REMINDER.EXE
C:\PROGRAM FILES\IRIS\ANTIVIRUS\WIMMUN32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\LOGITECH\PROFILER\LWEMON.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free-popup-killer.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.free-popup-killer.com/ie/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.shaw.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free-popup-killer.com/ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.free-popup-killer.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.free-popup-killer.com/ie/?q=%s
F1 - win.ini: run=C:\windows\options\systools\cyxid98.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Warner] C:\Warner\Warner.exe
O4 - HKLM\..\Run: [AUAgent] C:\SupportCenter\AUAgent.exe
O4 - HKLM\..\Run: [SBWatchDog.EXE] C:\WINDOWS\SYSTEM\SBUtils\SBWatchDog.EXE /l
O4 - HKLM\..\Run: [CallControl 4.5] C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [IntelliType] "c:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [MSRegSvc] C:\WINDOWS\SYSTEM\REGSVC32.exe
O4 - HKLM\..\Run: [regsvc32] C:\WINDOWS\SYSTEM\REGSVC32.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\System\reminder.exe
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwtest.exe" /detect /quiet /launch "C:\Program Files\Logitech\Profiler\lwemon.exe /noui"
O4 - Startup: AntiVirus Active Monitor.lnk = C:\Program Files\iRiS\AntiVirus\WIMMUN32.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...031.6106134259
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: ChatSpace Full Java Client 4.0.0.301 - http://63.102.226.240:8000/Java/cfs40301.cab

I will not pretend to be computer savvy if you'll be patient in return

Rene
Reply With Quote
  #2  
Old March 15th, 2004, 01:19 AM
GretaP's Avatar
GretaP GretaP is offline
Cyber Tech Help Moderator
  
Join Date: Oct 2002
O/S: Windows XP Pro
Location: Ontario, Canada
Age: 47
Posts: 5,010
Hi Rene,

Have HiJack This fix these two entries:

O4 - HKLM\..\Run: [MSRegSvc] C:\WINDOWS\SYSTEM\REGSVC32.exe
O4 - HKLM\..\Run: [regsvc32] C:\WINDOWS\SYSTEM\REGSVC32.exe

Restart your computer, then use Windows Explorer to navigate to the C:\Windows\System folder. Delete the REGSVC32.EXE file in that folder. Be careful when you're looking for the correct file to delete, as there is a REGSVR32.EXE file that is a legitimate file.
__________________
Microsoft MVP
Windows Desktop Experience
Reply With Quote
  #3  
Old March 15th, 2004, 07:00 AM
tRustyK5 tRustyK5 is offline
New Member
  
Join Date: Mar 2004
Posts: 4
Quote:
Originally Posted by GretaP
Hi Rene,

Have HiJack This fix these two entries:

O4 - HKLM\..\Run: [MSRegSvc] C:\WINDOWS\SYSTEM\REGSVC32.exe
O4 - HKLM\..\Run: [regsvc32] C:\WINDOWS\SYSTEM\REGSVC32.exe

Restart your computer, then use Windows Explorer to navigate to the C:\Windows\System folder. Delete the REGSVC32.EXE file in that folder. Be careful when you're looking for the correct file to delete, as there is a REGSVR32.EXE file that is a legitimate file.
I had to re-read your reply a few times, but eventually I realized the difference between the two files. Good lord I feel dumb around here...

Thanks kindly for the help, I followed the instructions carefully and all should be well. I'll run Hijack once more and post the scan log.

Rene
Reply With Quote
  #4  
Old March 15th, 2004, 07:03 AM
tRustyK5 tRustyK5 is offline
New Member
  
Join Date: Mar 2004
Posts: 4
Scan saved at 9:59:33 PM, on 14/03/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WARNER\WARNER.EXE
C:\SUPPORTCENTER\AUAGENT.EXE
C:\WINDOWS\SYSTEM\PRINTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\TYPE32.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\REMINDER.EXE
C:\PROGRAM FILES\IRIS\ANTIVIRUS\WIMMUN32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\LOGITECH\PROFILER\LWEMON.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free-popup-killer.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.free-popup-killer.com/ie/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.shaw.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free-popup-killer.com/ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.free-popup-killer.com/ie/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.free-popup-killer.com/ie/?q=%s
F1 - win.ini: run=C:\windows\options\systools\cyxid98.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Warner] C:\Warner\Warner.exe
O4 - HKLM\..\Run: [AUAgent] C:\SupportCenter\AUAgent.exe
O4 - HKLM\..\Run: [SBWatchDog.EXE] C:\WINDOWS\SYSTEM\SBUtils\SBWatchDog.EXE /l
O4 - HKLM\..\Run: [CallControl 4.5] C:\Program Files\FaxTalk Communicator\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [IntelliType] "c:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\System\reminder.exe
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwtest.exe" /detect /quiet /launch "C:\Program Files\Logitech\Profiler\lwemon.exe /noui"
O4 - Startup: AntiVirus Active Monitor.lnk = C:\Program Files\iRiS\AntiVirus\WIMMUN32.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...031.6106134259
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab

Better?

Rene
Reply With Quote
  #5  
Old March 15th, 2004, 04:29 PM
GretaP's Avatar
GretaP GretaP is offline
Cyber Tech Help Moderator
  
Join Date: Oct 2002
O/S: Windows XP Pro
Location: Ontario, Canada
Age: 47
Posts: 5,010
You're very welcome for the help. And there's absolutely no reason to feel dumb around here. From what I can see, your log file looks pretty clean.....however, I don't know what this line is referring to:

F1 - win.ini: run=C:\windows\options\systools\cyxid98.exe

I know that it's not a Windows file, but that doesn't mean that it's not a legitimate file for another application.
__________________
Microsoft MVP
Windows Desktop Experience
Reply With Quote
  #6  
Old March 15th, 2004, 06:30 PM
tRustyK5 tRustyK5 is offline
New Member
  
Join Date: Mar 2004
Posts: 4
Is there any way to find out what that 'line' is all about?

Rene
Reply With Quote
  #7  
Old March 15th, 2004, 08:08 PM
GretaP's Avatar
GretaP GretaP is offline
Cyber Tech Help Moderator
  
Join Date: Oct 2002
O/S: Windows XP Pro
Location: Ontario, Canada
Age: 47
Posts: 5,010
Perhaps post your most recent HiJack This log, along with a question relating to that line, in the Cyber Safety forum. Hopefully someone who is more knowledgeable about safety and security (I'm not that "up" on the safety/security stuff) will know the answer.
__________________
Microsoft MVP
Windows Desktop Experience
Reply With Quote
  #8  
Old March 15th, 2004, 08:10 PM
caper2003 caper2003 is offline
New Member
  
Join Date: Mar 2004
Posts: 19
Quote:
Originally Posted by tRustyK5
Is there any way to find out what that 'line' is all about?

Rene
Do a Google search on "cyxid98.exe"

You may have a problem.


Good luck
Reply With Quote
Reply

Bookmarks

« Previous Topic | Next Topic »
Topic Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT +1. The time now is 11:41 PM.

[ RSS ]