Hello,
OK, this is the first time I've posted at tomcoyote.
Here's the deal. Recently I've been assaulted with the strange appearance of a file called winserv32.exe. No BIG deal, another "virus". Rip it out of the registry, change the file name, move to the next one (or something like that). Thing is this seems to show up when I update the virus database for AVG7.0. Been using AVG for quite a while without any problems until about a week ago when I started installing the new version on several machines. It shown up 3 times in the last week, but not all the time, on every machine. So I work on several machines infected with the same thing, nothing new, if they were all infected with the same thing my life would be easier.
BUT.................this weekend I brought a machine home and reworked it to the bone. Wiped the hard drive clean and reinstalled all the software (was getting really bad performance). Kept a hijack this log of every registry change after uploading each program. winserv32.exe appearred immediately when I tried to upload the updated virus database!!! Microsoft told me it wasn't a windows file and that it was put there by a trojan. I think it is associated with Worm/Agobot.39.Q. I'm not sure if it is supposed to be a valid AVG file that just doesn't quite work the it is supposed to (once this thing starts running it sucks up all the CPU power running it).
Any ideas, suggestions, comments???