winmsrv32.exe - Dangerous

winmsrv32.exe

Jeff's Story:

My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.

I sought a solution on the Internet and discovered your product and tried out the trial.

You quickly found the rootkit and SAVED my PC!

I haven't had any problems since, and I'm extremely grateful.

Free Download

Manual removal instructions:

winmsrv32.exe
W32.Gaobot.AFJ is a worm that spreads through open network shares, backdoors that the Beagle and Mydoom worms install, and several Windows vulnerabilities.
The worm can also act as a backdoor server program and attack other systems.
Additionally, the worm attempts to stop the process of many antivirus and security programs.

Copies itself as one of the following:
%System%\msiwin84.exe
%System%\Microsoft.exe
%System%\WinMsrv32.exe
%System%\soundcontrl.exe
%System%\msawindows.exe

Adds one of these values:
"Microsoft Update"="msiwin84.exe"
"Microsoft Update"="Microsoft.exe"
"WinMsrv32"="WinMsrv32.exe"
"soundcontrl"="soundcontrl.exe"
"Microsoft Update"="msawindows.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Copies itself and executes on any remote shares to which it successfully authenticates.

Use RegRun Startup Optimizer to automatically remove this worm.

Remove winmsrv32.exe now!