Malware help...

[ajnineinchnails]

Im running Win7 professional edition and I believe I have some sort of malware though Avast, Malewarebytes, spybot search and distroy, and microsoft security essentials pic up nothing... the reason i know i have something is that regedit is running as a process and regedit 32 on occasion... any help finding out what I have?

 

[NinaJay]

Can you post what processes are running exactly so someone can determine if it is Malware and how to fix it?




BTW: I need maleware help regularly (he's called my husband and he wears me out )

 

[seekermeister]

I'm not sure what you mean by "running" regedit? You might try installing Regmon so that you can monitor registry activity. Also Filemon can be used for the same purpose with files.

EDIT: I misread your phraseology, but those two programs might still be of some use.

 

[ajnineinchnails]

here is a screenshot

http://i304.photobucket.com/albums/nn190/keybladewielder/Untitled-2.png

 

[ajnineinchnails]

Sorry, I just can't type for crap sometimes... But yeah regedit keeps showing up in the task manager then shutting off then restarting and... idk...

 

[seekermeister]

Have you tried using the Resource Manager in the Task Manager? If you checkmark regedit in the Process pane, it might give you a clue as to what is happening in the two panes below.

 

[ajnineinchnails]

Yeah, I looked at the resource manager and like i said it keeps stoping and starting... killing my processer.

 

[seekermeister]

I'm not speaking of whether it appears there or not, but whether it appears long enough for you to use the diagnostic panes? The goal is to determine exactly what is calling regedit into action.

 

[ajnineinchnails]

Yeah it doesn't come on long enough.

 

[seekermeister]

Then I would resort to the two programs that I mentioned in post #3. If you are unable to track the problem, then the only thing I can think of is a System Restore, assuming that this problem hasn't gone on too long, and you have a restore point that is conveniently dated to just prior to when it began.

 

[ajnineinchnails]

dExposE2.exe.... I uninstalled that though.... oh ballz...

 

[seekermeister]

Huh? Is that .exe what is causing regedit to run?

I've done a little Googling on the .exe, but it's function isn't clear to me yet. You have several choices, searching your folders for scraps of the program left behind, searching the registry for orphan keys, Googling for an uninstall method, restoring to a point before you installed it, backup from a prior image and the list could probably go on, if I were to think long enough.

You might consider buying Acronis True Image 2010, if you tend to experiement a lot with unknown programs, because it has a Try And Decide feature that permits a temp install that can be totally reversed, if you don't want to keep the program, or merged into the system if you do.

 

[ajnineinchnails]

Yup, I installed a program called dexpose2 that's an expose clone for windows and I uninstalled it and then i started to have problems... apparently the guy put maleware in it or something because that's what was running regedit... i booted into safe mode and wiped the folder where the .exe file was and sure nuff, booted back up and no problems whatsoever... *sighs*

 

[ajnineinchnails]

Yeah idk what maleware function it served but i do know that when installed it was a full fledged expose clone...