Antivirus detected "regsvr.exe", which is apparently a virus?

Discussion in 'Server & Client Support' started by Gregor De Gar, Dec 23, 2015.

  1. Gregor De Gar

    Gregor De Gar New Member

    Joined:
    Dec 23, 2015
    Messages:
    5
    Likes Received:
    0
    While installing the UO client my antivirus detected "regsvr.exe". Googling it revealed this page, among others: http://www.file.net/process/regsvr.exe.html

    What's up? Have you guys been hacked or something? Is this a false positive?
  2. Chris

    Chris Renaissance Staff
    Renaissance Staff

    Joined:
    May 14, 2012
    Messages:
    3,385
    Likes Received:
    6,195
    Regsrv32.exe is the registry service used by windows. This file exists in your windows installation and is not part of the Ultima Online installation. During the installation however the installer makes a few changes to your registry in order to allow the razor program to operate correctly.

    This is not a virus, just your AV program notifying you that your computer is being modified.

    Regsrv.exe could either be from an older version of windows, or an unrelated infection that was already on the computer.

    It is possible however that your computer is already infected and installing the UO Client caused it to access an infected file. The UO:Renaissance installer has not been modified since 2013 and can not contain any virus like activities.

    I would recommend doing a full scan of your computer with a program like Malwarebytes.
    Scynin and Kishember like this.
  3. Gregor De Gar

    Gregor De Gar New Member

    Joined:
    Dec 23, 2015
    Messages:
    5
    Likes Received:
    0
    This is definitely a virus, according to everything I've seen. Regsrv32.exe is indeed legitimate, but Regsvr.exe is not. I have since tested by running the installer on a clean system (just installed Windows 7 using the official OEM CD I bought from Fry's Electronics) and the same alert appears.

    The antivirus neutralized the issue, so my machine is not infected, but I would implore you to take a close look at this, if possible.
  4. AlexCCCP

    AlexCCCP Well-Known Member
    UO:R Donor

    Joined:
    Aug 27, 2012
    Messages:
    1,273
    Likes Received:
    904
    regsbr32.exe is not a virus, its actions can appear to be a virus.

    It is used to register certain ActiveX and DLLs, these actions can trip some antivirus scanners as it is a common method of sneaking in virus' as well.

Share This Page