regwork.exe

[Buffalo]

Anyone have a good idea on how to get rid of it?
A friend on mine has it. He is running Vista.
I have searched the Internet, but the suggestions vary.
I had him dl and install and update MBAM and run it, but regwork.exe still
persists.
I will have him update MBAM and then run a complete scan in SafeMode to see
if it persists.
Perhaps his RegWork is not malware after all.
Thanks,
Buffalo
PS: He runs Symantec and Windows Defender.

[David H. Lipman]

From: "Buffalo" <Eric@nada.com.invalid>

> Anyone have a good idea on how to get rid of it?
> A friend on mine has it. He is running Vista.
> I have searched the Internet, but the suggestions vary.
> I had him dl and install and update MBAM and run it, but regwork.exe still
> persists.
> I will have him update MBAM and then run a complete scan in SafeMode to
> see
> if it persists.
> Perhaps his RegWork is not malware after all.
> Thanks,
> Buffalo
> PS: He runs Symantec and Windows Defender.
>

It is real hard to go by just a name. It is insufficient information. A
file can be named anything.

--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[Buffalo]

David H. Lipman wrote:
> From: "Buffalo" <Eric@nada.com.invalid>
>
>> Anyone have a good idea on how to get rid of it?
>> A friend on mine has it. He is running Vista.
>> I have searched the Internet, but the suggestions vary.
>> I had him dl and install and update MBAM and run it, but regwork.exe
>> still persists.
>> I will have him update MBAM and then run a complete scan in SafeMode
>> to see
>> if it persists.
>> Perhaps his RegWork is not malware after all.
>> Thanks,
>> Buffalo
>> PS: He runs Symantec and Windows Defender.
>>
>
> It is real hard to go by just a name. It is insufficient
> information. A file can be named anything.

Thanks, I will try to get more info from him but I am not sure on what
questions to ask.
He only contacted me because his PC was sending out emails that he had
nothing to do with.
Amazingly, Comcast prevented me from receiving those emails and it just
contained a URL with some advertising on it.
I will find out more before I post again.
Thanks,
Buffalo

[Virus Guy]

Buffalo wrote:

> Anyone have a good idea on how to get rid of it?
> A friend on mine has it.

Restart the system in DOS mode and do a file-find for regwork.exe and
delete it.

> He is running Vista.

Um, ya. Ok.

Put the computer in a box and place it at the curb the next time your
garbage is picked up.

[Buffalo]

Virus Guy wrote:
> Buffalo wrote:
>
>> Anyone have a good idea on how to get rid of it?
>> A friend on mine has it.
>
> Restart the system in DOS mode and do a file-find for regwork.exe and
> delete it.
>
>> He is running Vista.
>
> Um, ya. Ok.
>
> Put the computer in a box and place it at the curb the next time your
> garbage is picked up.

Deleting regwork.exe would not do it. A proper uninstall probably could.

Unfortunately he has to take his garbage to the dump himself, and, he just
can't stand the thought of parting with it. LOL
Buffalo

[Virus Guy]

Buffalo wrote:

> > Restart the system in DOS mode and do a file-find for regwork.exe and
> > delete it.
> >
> >> He is running Vista.
>
> Deleting regwork.exe would not do it.

While vista is running - no, it probably wouldn't.

That's why I said to restart in DOS mode.

What's that you say?

Did you say that the supposedly better NT-line of Windoze doesn't have a
true command-line DOS-like interface?

[Dustin]

Virus Guy <Virus@Guy.com> wrote in news:4FB456AD.355F811D@Guy.com:

> Buffalo wrote:
>
>> > Restart the system in DOS mode and do a file-find for regwork.exe
and
>> > delete it.
>> >
>> >> He is running Vista.
>>
>> Deleting regwork.exe would not do it.
>
> While vista is running - no, it probably wouldn't.
>
> That's why I said to restart in DOS mode.

Umm..

> What's that you say?
>
> Did you say that the supposedly better NT-line of Windoze doesn't have
a
> true command-line DOS-like interface?

LOL! Of course it doesn't. DOS is emulated on an NT machine. An NT
machine actually has security. It's not a 32bit GUI shell riding along
side DOS, like win9x.

You use a PE disc. (An NT version of your DOS boot disk if you will).



--
Character is doing the right thing when nobody's looking. There are too
many people who think that the only thing that's right is to get by, and
the only thing that's wrong is to get caught. - J.C. Watts

[FromTheRafters]

Virus Guy wrote:
> Buffalo wrote:
>
>>> Restart the system in DOS mode and do a file-find for regwork.exe and
>>> delete it.
>>>
>>>> He is running Vista.
>>
>> Deleting regwork.exe would not do it.
>
> While vista is running - no, it probably wouldn't.
>
> That's why I said to restart in DOS mode.
>
> What's that you say?
>
> Did you say that the supposedly better NT-line of Windoze doesn't have a
> true command-line DOS-like interface?

Yes, it (Vista) does.

[Buffalo]

Virus Guy wrote:
> Buffalo wrote:
>
>>> Restart the system in DOS mode and do a file-find for regwork.exe
>>> and delete it.
>>>
>>>> He is running Vista.
>>
>> Deleting regwork.exe would not do it.
>
> While vista is running - no, it probably wouldn't.
>
> That's why I said to restart in DOS mode.
>
> What's that you say?
>
> Did you say that the supposedly better NT-line of Windoze doesn't
> have a true command-line DOS-like interface?

It would be better to uninstall the program than to just delete the .exe, as
you are well aware.
I just thought that someone here may have had experience with that
particular program.
Thanks
Buffalo

[Buffalo]

Buffalo wrote:
> Virus Guy wrote:
>> Buffalo wrote:
>>
>>>> Restart the system in DOS mode and do a file-find for regwork.exe
>>>> and delete it.
>>>>
>>>>> He is running Vista.
>>>
>>> Deleting regwork.exe would not do it.
>>
>> While vista is running - no, it probably wouldn't.
>>
>> That's why I said to restart in DOS mode.
>>
>> What's that you say?
>>
>> Did you say that the supposedly better NT-line of Windoze doesn't
>> have a true command-line DOS-like interface?
>
> It would be better to uninstall the program than to just delete the
> .exe, as you are well aware.
> I just thought that someone here may have had experience with that
> particular program.
> Thanks
> Buffalo

Well, I had him uncheck regwork.exe in the msconfig and reboot. The program
did not restart and then I had him uninstall the program through the Control
Panel and all seems well. Perhaps, it was a legit program, but now his PC is
running faster, according to him. It might be that MBAM removed something
else that caused the speedup.
He even ran MBAM in Full Scan in Safe Mode and got rid of all it found (only
about 10 entries, most of them cookies) except for a few Symantec entries.

Thanks for the replies.
Buffalo