Infected with consrv.dll

[AisleyP]

i am using the new avast and today i get some new when i am trying with the scan, and after the scan i found this consrv.dll and when i am trying with the removing this item at that time i get that i am not able to remove them. and for getting resolve this type of the problem, i also tried with the scanning with the MBAM but at that time i get that this not find anything. why this is happening?? please reply me back about this?? if here anyone have the suggestion about this then please reply me that what can i do now??

[RaaginiO]

yes, i am also having the same problem and i am thinking to use the other antivirus for that reason, but still with the different antivirus, i get the same problem?? why this is happening?? if here anyone have the recommendation about this problem then please post a reply about this. thanks in advance.

[Caelyn]

if you are getting this type of the probllem then for that reason i will suggest you to try with the downloading the mbam which you can download form the following::

MBAM download..

after the downloading finished at that time
and when you finished with that then try with the steps which are as::

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• Under the Custom Scan box paste this in:
• %SYSTEMDRIVE%\*.exe
• /md5start
• consrv.dll
• explorer.exe
• winlogon.exe
• Userinit.exe
• svchost.exe
• /md5stop

after this, i am sure that there you will not get this same problem again.

[AisleyP]

Ok, according to your suggestion, i tried with the disabling all the av's but there also i am sure that apparently there was something I did not able to do that things. and after doing this all things, i get the following logs which as::
when i finished with the combofix after that i tried with the restarted my computer but at that time there i get blackscreen problem and for resolving that i have to try with the force shutdown. but now, it is working very fine. and after that, i tried with the running the quick scans and there i get that they are not able to find the consrv.dll anymore. thanks for that. but now when i tried with the turn windows firewall on at that time i get that this is saying that the windows firewall is on and working. but stil i get the same problem when i tried with scanning with the Avast?? now what??

[Swiz]

ok, if you are getting that type of teh problem then for that you will need to try with the re-run OTL with the selecting all users and I will see if there are any remnants. please do that thing and reply me back about the changes.

[Rance]

If you have finished with the downloading of the OTL after that i will suggest you to run the OTL and hit the cleanup button. and after this i am sure that this wil help your system to remove all the programmed we have used plus itself. and also you can also confirm that your hidden files are set to that, this is because there are such a tools which can change that things. for checking for that you can also try with the steps which are given as::

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

try with this all things and hope that you will be able to resolve your problem. reply me back about the results of this.

[AisleyP]

Hey thanks for suggesting me about the steps. i tried with this all and i get that i am able to resolve all the problem related with this. thanks again for such type of the great suggestion.

[Hameeda-K]

Hi all, i am also having this type of the problem, my PC is Infected with consrv.dll, and for that i have tried with the so many suggestion but still i get that i am not able to remove the consrv.dll form my system. then i came to this forums and here i get the steps for resolving this problem. but when i tried with the downloading the MBAM download.., after that also i get the same problem that i am not able to remove the consrv.dll using the MBAM malware detector. what can i do now?? can here anyone else suggest me some other way for getting resolve this problem

[chaichai]

Make sure that consrv.dll is not in the quarantine of any antivirus program that you have installed as this will cause the computer to bootloop

There is a trip wire associated with this infection that is located in C:\Windows\Assembly
(This is relevant of 64-bit OSes)

Run KAV
http://www.kaspersky.com/downloads/ ->> Click onf free virus removal tools

Then select KAV and select the language for installation

Proceed with download.

Run KAV (I suggest with all AVs disabled)

As long as it detects consrv.dll then it will fix the registry key located in:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Sub Systems

The modified key is Windows

A clean copy of the key looks like this:

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

An infected key looks like this:

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=consrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

As long as KAV detects consrv.dll it will repair this key

I suggest making a system restore point prior to removal as this is the only way to recover from bootlooping.

If you have to do a system restore then it was due to an application quarantining consrv.dll prior to you running KAV

If KAV shuts down during the scan then you need to run a targeted scan at C:\Windows\Assembly to break the tripwire

Bitdefender is very effective at this

Overall this should successfully remove the infection, upon successful removal make sure you delete all prior system restore points.