[EdC]

I am running Windows XP, my ram is 1GB, my CPU usage has just now spiked to 100% and seems to stay there. I have just ran a anti spy ware and removed spyware found. But my CPU is still running at 100%. I have noticed in the Windows Task Manager under process running I have approximately many duplicate processes such as devldr.exe. The devldr.exe must have 10 process running and many more items are more than dupicated. When I look under processes the whole area is constantly changing, like it is constantly updating and dupicating itself. What do I have? A virus. I am just running AVG anti virus and nothing appears to be there. Every process takes along time to complete with the high CPU usage. Please advise.

[SHAVED]

I am running Windows XP, my ram is 1GB, my CPU usage has just now spiked to 100% and seems to stay there. I have just ran a anti spy ware and removed spyware found. But my CPU is still running at 100%. I have noticed in the Windows Task Manager under process running I have approximately many dupicate processes such as devldr.exe. The devldr.exe must have 10 process running and many more items are more than dupicated. When I look under processes the whole area is constantly changing, like it is constantly updating and dupicating itself. What do I have? A virus. I am just running AVG anti virus and nothing appears to be there. Every process takes along time to complete with the high CPU usage. Please advise.

Dvldr.exe is installed by RBOT.MF Worm and its variants. If you find this process on your computer, you should immediately scan your computer with a good AV/Antispyware software to ensure your privacy and system security. As per your message you are running AVG Antivirus but this one is a spyware. It will be better you try with ZoneAlarm or xoftspy (Antispyware) to tackle it.

[benn11]

This procedure terminates the running malware process.

1. Open Windows Task Manager. CTRL+SHIFT+ESC, then click the Processes tab.

2. In the list of running programs*, locate the process: dvldr.exe

3. Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your system.

4. To check if the malware process has been terminated, close Task Manager, and then open it again.

5. Close Task Manager.

Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing at startup.

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.

2. In the left panel, double-click the following: HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>Curr entVersion>Run

3. In the right panel, locate and delete the entry: Windows Automatic Updates = "dvldr.exe"

4. In the left panel, double-click the following: HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>Curr entVersion>RunServices

5. In the right panel, locate and delete the entry: Windows Automatic Updates = "dvldr.exe"

6. In the left panel, double-click the following: HKEY_CURRENT_USER>Software>Microsoft>OLE

7. In the right panel, locate and delete the entry: Windows Automatic Updates = "dvldr.exe"

8. Close Registry Editor.

disable System Restore to allow full scanning of infected systems. Run a full scan with an up-to-date AVG anti-virus

Download patch from Microsoft

Microsoft Security Bulletin MS03-026
Microsoft Security Bulletin MS03-001
Microsoft Security Bulletin MS03-007