Backdoor.Bot reported by Malwarebytes in regsvr.exe

I just ran Malwarebytes Anti-Malware software on a Windows 2003 server that was severely out-of-date with Windows updates.  This server is not even running SP2 or SP2.  This software found and deleted (quanantined) the file "C:\Windows\system32\Regsvr.exe" and removed the registry key "C:\Windows\system32\Regsvr.exe" in "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs\".
Now I am concerned as I believe this is a required system file but don't know the best method of replacing.
Any help?
wwITmanAsked:
Who is Participating?
 
farazhkhanConnect With a Mentor Commented:
Hi,

For me this is a real bot go ahead and delete it.

If you want you can take registry backup and other.

Regards,
Faraz H. Khan
0
 
farazhkhanCommented:
Hi,

Open malwayre byte go to quarantine section and undelete this file.

Regards,
Faraz H. Khan
0
 
wwITmanAuthor Commented:
Yes, I realize I can un-quarantine but that would be assumming that is was a false positive.
0
Improved Protection from Phishing Attacks

WatchGuard DNSWatch reduces malware infections by detecting and blocking malicious DNS requests, improving your ability to protect employees from phishing attacks. Learn more about our newest service included in Total Security Suite today!

 
wwITmanAuthor Commented:
But isn't "regsvr.exe" a required system file?  I think it is... my question was what is the best method to replace the deleted with a ligitimate one...
0
 
farazhkhanCommented:
Hi,

Apply the latest service packs and patches by running windows update. or you can repair Windows to replace the file.

Regards,
Faraz H. Khan
0
 
kennyhenaoConnect With a Mentor Commented:
No, it is not a system file. The correct file is regsvr32.exe
You can remove this file.
0
 
wwITmanAuthor Commented:
Well, that is good to know.  I assumed it was legit as another server on the same network also had this file.
I will be do a SFC scan to check this server.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.