Doubt Hello Sir, This is Umesh.. My system contains a virus effected file regsvr.exe which is effected by W32.Imaut virus ...After every scan it wont get deleted even if i try to do so... Please guide me how to remove the file ...

Dear Amartya,

Here is a solution for your problem.




What the regsvr.exe virus does?
• This worm creates folders and a registry entry to enable its automatic execution at every system startup.
• This worm also creates a scheduled task to enable its automatic execution at a specified date and/or time.
• It also creates Autorun.inf file for its auto execution.
Solution to fix the problem:
1. If the task manager and registry editor is disabled then we need to enable them first. Read this post.
2. Delete the Autorun.inf file created by the virus. Read this post to know how to do that.
3. Now type msconfig in the Run dialog and click on startup tab.
4. Look for regsvr and uncheck any options, click OK.
5. Now traverse to control panel -> scheduled tasks, and delete the At1 task that might be listed there.
6. Type regedit in the Run dialog to open the registry editor.
7. Click on Edit -> Find and search for regsvr.exe
8. Just delete all the occurrences of regsvr.exe virus (do not confuse it with regsvr32.exe which is not a virus).
9. Navigate to entry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and modify the entry Shell = "Explorer.exe regsvr.exe" to delete the regsvr.exe from it.


I think it helps.Let me know


Best regards
Chandrashekahr Bhat

TRY RUNNING SUPERANTISPYWARE i have used this program it works very well for removal of all varients and other little pesky varmint on your pc.

This is your problem i think: Windows cannot find 'regsvr.exe'.Make sure you typed the name correctly,and then try again.To search for file,click the start button,and then click search.
Most likely you had a virus that installed a Regsvr.exe reference into your Windows registry. If it shows as "missing" at start-up it's because your anti-virus software removed the program but not the reference. You need a registry cleaner tool like CCleaner. It's a free tool that can be used to clean both your registry and delete junk files from your hard drive.

I found a few things you can do: 1. http://tandt-u.blogspot.com/2008/11/remove-regsvrexe-virus.html
2. Just Google CCleaner - download and run it.
3. I found a site. just follow thes steps: http://amiworks.co.in/talk/how-to-remove-new-folderexe-or-regsvrexr-or-autoruninf-virus/
4. I found (maybe) the soultion.you got the error at startup say that regsvr.exe not found.
Plz find the process how to remove this error
Goto-> RUN-> Regedit->HKEY_LOCAL_MEACHINE->SOFTWARE->MICROSOFT->WINDOWS NT->CURRENT VERSION->WINLOGON->in the reght side panel u can see the key SHELL -> in that key u if u see the two names (Explorer.EXE Regsver.exe) plz delete only the regsver.exe(plz do not remove the explorer.exe) Just Press OK

PLZ BE CARE FUL WHEN UR DOING THIS UR PLAYING WITH SYSTEM FILES PLZ DO NOT REMOVE ANY OTHER KEYS
IF ANY SYSTEM CRASHES I AM NOT RESPOSIBLE
PLZ CREATE A SYSTEM RESTORE POINT BEFORE DOING THIS if you find it difficult, i found a site with the same steps but with screenshots: I found the soultion for the same. http://techrena.blogspot.com/2009/03/remove-windows-cannot-find-regsvrexe.html
I hope it works for you. And please rate

Hi there.
You have a virus on the PC!!

What the regsvr.exe virus does?
• This worm creates folders and a registry entry to enable its automatic execution at every system startup.
• This worm also creates a scheduled task to enable its automatic execution at a specified date and/or time.
• It also creates Autorun.inf file for its auto execution.
Solution to fix the problem:
1. If the task manager and registry editor is disabled then we need to enable them first. Read this post.
2. Delete the Autorun.inf file created by the virus. First go to cmd (start menu, run or search, type “attrib X:Autorun.inf –s –r –h” without quotes where X is your drive name which is having the problem. Now the file is visible and ready to delete. After deleting the file, close the explorer and open it again
3. Now type msconfig in the Run dialog and click on startup tab.
4. Look for regsvr and uncheck any options, click OK.
5. Now traverse to control panel -> scheduled tasks, and delete the At1 task that might be listed there.
6. Type regedit in the Run dialog to open the registry editor.
7. Click on Edit -> Find and search for regsvr.exe
8. Just delete all the occurrences of regsvr.exe virus (do not confuse it with regsvr32.exe which is not a virus).
9. Navigate to entry HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon and modify the entry Shell = “Explorer.exe regsvr.exe” to delete the regsvr.exe from it.
10. Now to actually delete the virus from the system go to system32 folder and delete the regsvr.exe virus file from there (you will need to uncheck the option of “Hide Protected System Files and Folders” in Folder Options to view the virus file).
Reboot the system for changes to take place.
If this is too much for you to understand please post back for an alternative.

Good luck

go to www.filehippo.com download spybot search and destroy. before installing, turn system restore off then install and run a scan.

Download and run this:

http://piyushlabs.googlepages.com/Heal_regsvr1.0.zip

BTW...it's a virus you have. It will get worse if you don't clean it or restore your computer.

Hai I am thangu I could not able to clean w32.imaut and New folder.exe. Plz Give me Removal tool for the above Virus. Now i have symantec corporate edition.It is not Supporting my system. Plz Help me

Hi priya

it may be a virus issue. be sure your antivirus is updated with latest pattern file and then scan your whole system. you can try a tria version of kaspersky anti virus to scan your system it is really good enough.

Umesh verma

W32/Sdbot-DIQ is a worm for the Windows platform.

When first run W32/Sdbot-DIQ copies itself to:

<Root>\Funny UST Scandal.avi.exe
<Windows>\Funny UST Scandal.exe
<Windows>\xmss.exe
<Root>\xmss.exe

The worm creates the following files:

<Root>\autorun.inf
<Windows>\autorun.inf

Make sure you Shift-Delete these files!