Services.exe 3

[rodwf]

when booting an Xp computer i get the message:

'Windows cannot find '\services.exe'. Make sure you typed the name correctly, and then try again. To search for a file, click the start button, and then click search'

When i shut the computer down i get the blue screen of death stating windows encountered an error and is shutting down windows to save the computer from any corruption, although i was shutting it down anyway.

Done a search for services.exe and found it in:
c:\i386
c:\windows\ServicePackFiles\i386
c:\windows\system32\dllcache
c:\windows\system32

Can anyone help me out with why i'm getting this message and blue screen?

 

[Turkbear]

Hi,
Time for a full virus scan:

http://windowsxp.mvps.org/services.exe.htm

To Paraphrase:"The Help you get is proportional to the Help you give.."

 

[rodwf]

had a virus scan yesterday and it did find a trojan and was deleted. I've ran msconfig and found under run the \services.exe and unchecked it, rebooted and still got the same message.

 

[Turkbear]

Hi,
Follow the steps here to eliminate all registry entries that cause windows to try and start the 'phony' one. (msconfig only handles the ones shown in blue]

http://windowsxp.mvps.org/startup.htm

To Paraphrase:"The Help you get is proportional to the Help you give.."

 

[rodwf]

Looked up that site windowsxp.mvps.org, searched through the registry entries where the site had said and didn't find any entries for '\services.exe', also tried a search in the registry and that also came up with nothing.

 

[rodwf]

something else i've noticed, i thought i'd try a system restore but when clicking on next to start the restore nothing happens.

 

[linney]

Can you start the machine in Safe Mode and run your virus scans from within that? See if System restore works from Safe Mode too.

You might like to add these to your arsenal.

SuperAntispyware

http://superantispyware.com/

Malwarebytes' Anti-Malware

http://www.malwarebytes.org/mbam.php

Perhaps you might have encountered a rootkit infection, these things tend to hide from Windows and tend to replace infected files as soon as they are removed by anti malware software. I hope I am wrong.

RootkitRevealer v1.71

http://technet.microsoft.com/en-au/sysinternals/bb897445.aspx

Why does Task Manager, MSCONFIG, or REGEDIT disappear while opening?

http://windowsxp.mvps.org/ToolsQuit.htm

 

[rodwf]

Tried using RootkitRevealer and on install i get a popup message:

Unable to install RootkitRevealer service. This service did not respond to the start or control request in a timely fashion.

Any ideas what i'm doing wrong?

 

[BadBigBen]

Take a look at GMER:

http://www.gmer.net/

before you use GMER to delete anything that it thinks is a ROOTKIT, do a LOG and post it here for our discernment...

reason: some hooks that gmer detects are legit and killing these can kill a legit application...

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[linney]

Another problem with malware is that the payload often carries a list of programs that it prevents from running or installing. A way around this is to physically change the file name of the program you are wishing to install and or run.

If it all gets too hard, backup your valuable data, reformat, and reinstall XP. In future make sure you are not surfing on the Internet as an Administrator, a Limited User is the way to go for day to day running of a machine.

 

[rodwf]

Linney,

I was just going to post here that i'd installed malwarebytes anti-malware but it wouldn't run, also hijackthis wouldn't run. I booted to safemode and the same message popped up stating \services.exe couldn't be found, tried restore and that wouldn't work. is there a way to run an anti virus program before anything else boots?

 

[rodwf]

When you say physically change the file name of the program i wish to run, do you refer to renaming the exe of the program?

 

[linney]

Change the setup of MBAM.exe to Fred.exe, after it installs change the installed name MBAM.exe to Fred.exe in the program files folder, you get the picture, it is blocked if you use the official name. It will make life easier for you if you are not hiding known file extensions in Folder Options/ View.

Even if these programs eventually run, what usually happens is that they find the malware, say that they have removed it, but often it is back next scan. What I find helpful in that situation is that they at least identify the files concerned. Recently I have seen a lot of files like this that begin with "UAC" something or other. In those circumstances Windows is unable to see such files because they are super hidden from it. What I find works in such instances is to get out of the Windows environment (perhaps via BARTPE which sees the hidden files, usually in the System32 folder) and manually remove the offending files.

BartPE (a mini XP self contained on a bootable CD and run from CD).

http://www.nu2.nu/pebuilder/

 

[rodwf]

Excellent, Thanks Linney, i'll take a look at Bartpe.

 

[linney]

Your problem may be more serious if the malware payload is targeting Services.exe itself and preventing that from running. Hopefully it is not, and I'm not sure MalwareBytes or Hijack This have any need for Services to run, but I could be wrong there? God only knows what would happen if you start renaming Windows System files like Services.exe to Fred.exe.

 

[Turkbear]

Hi,
Just a note: Whenever cleaning out a virus/trojan/etc be sure you run the Anti-virus program with System Restore turned OFF....Otherwise the file may come back on the reboot.
( Turn it back on as soon as you know the bad guy is gone..)




To Paraphrase:"The Help you get is proportional to the Help you give.."

 

[linney]

If you do use BartPE in the end to delete malware, remember to hold the Shift key down otherwise they just get put into the Recycle Bin of the drive concerned. If they end up there they will show up in the next malware scan but should be more easily removed by the scanner program from the Recycle Bin.

 

[BadBigBen]

Two AntiViral Solutions that BOOT from CD/DVD (and leave the installed OS out of the picture):

Dr. Web LiveCD

http://www.freedrweb.com/livecd/

Avira AntiVir Rescue System

http://www.avira.de/en/support/support_downloads.html

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[rodwf]

Cheers BadBigBen, i'll take a look at those also and thanks Ben but i don't have a sledgehammer!

 

[Turkbear]

Hi,
You could try here:

http://www.homedepot.ca/webapp/wcs/...atchallpartial&Dx=mode+matchallpartial&s=true

To Paraphrase:"The Help you get is proportional to the Help you give.."