Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


I Got A Virus

  • Please log in to reply
1 reply to this topic

#1 PwnZorz


  • Members
  • 8 posts
  • Local time:08:07 AM

Posted 25 September 2008 - 08:36 PM

It made my PC slow down. What Should i do?

The virus is named rs32net.exe

I dunno where i got that, because I share my computer with my brothers and sisters.

Can you please trace where I got this virus and the removal instructions?

Btw here's the processes based on Process Explorer

System Idle Process 0 93.85
Interrupts n/a Hardware Interrupts
DPCs n/a Deferred Procedure Calls
System 4
smss.exe 660 Windows NT Session Manager Microsoft Corporation
csrss.exe 712 Client Server Runtime Process Microsoft Corporation
winlogon.exe 736 Windows NT Logon Application Microsoft Corporation
services.exe 780 0.77 Services and Controller app Microsoft Corporation
svchost.exe 956 Generic Host Process for Win32 Services Microsoft Corporation
MPAPI3s.exe 316 Mobile Phone API Nokia Corporation
hprblog.exe 2416 Hewlett-Packard Product Assistant Hewlett-Packard Co.
svchost.exe 1024 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1120 Generic Host Process for Win32 Services Microsoft Corporation
wuauclt.exe 2528 Automatic Updates Microsoft Corporation
InCDsrv.exe 1140 incdsrv Nero AG
svchost.exe 1344 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1452 Generic Host Process for Win32 Services Microsoft Corporation
spoolsv.exe 1728 Spooler SubSystem App Microsoft Corporation
alg.exe 644 Application Layer Gateway Service Microsoft Corporation
svchost.exe 1780 Generic Host Process for Win32 Services Microsoft Corporation
ServiceLayer.exe 412 ServiceLayer Module Nokia.
svchost.exe 3044 Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 3060 Generic Host Process for Win32 Services Microsoft Corporation
lsass.exe 796 LSA Shell (Export Version) Microsoft Corporation
explorer.exe 584 Windows Explorer Microsoft Corporation
krag.exe 1368
rs32net.exe 1384
TaskSwitchXP.exe 1432 TaskSwitchXP Pro 2.0 Alexander Avdonin
RtWLan.exe 1844 2.31 RtWLan (ASRock) Application AzureWave.com
WiFi-80211n.exe 1840 ASRock WiFi-802.11n Utility ASRock Inc.
hpqtra08.exe 2028 HP Digital Imaging Monitor Hewlett-Packard Co.
hpqste08.exe 2224 HP CUE Status Hewlett-Packard Co.
firefox.exe 3424 1.54 Firefox Mozilla Corporation
procexp.exe 1540 1.54 Sysinternals Process Explorer Sysinternals
Ymsgr_tray.exe 2252 Yahoo! Messenger Tray Yahoo! Inc.
lsass.exe 3744 LSA Shell (Export Version) Microsoft Corporation
lsass.exe 3764 LSA Shell (Export Version) Microsoft Corporation
lsass.exe 3296 LSA Shell (Export Version) Microsoft Corporation
jhv132.tmp 3324
.tt13C.tmp 2804
svchost.exe 3808 Generic Host Process for Win32 Services Microsoft Corporation
rs32net.exe 4044
svchost.exe 3376 Generic Host Process for Win32 Services Microsoft Corporation

Process: Procexp Pid: -2

( I got many svchost.exe, dunno why.)

Please help

BC AdBot (Login to Remove)


#2 Budapest


    Bleepin' Cynic

  • Moderator
  • 23,579 posts
  • Gender:Male
  • Local time:11:07 PM

Posted 25 September 2008 - 09:58 PM

Please download Malwarebytes Anti-Malware and save it to your desktop.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users