services.exe in Windows\etc

[Guest]

I was infected with a trojan over the weekend, which among other things
installed services.exe in Windows\etc. It's gone now (trojan was removed by
Norton AntiVirus, and services.exe is safely in Windows\System32, where it
belongs), but on startup I keep getting a message informing me that
Windows\etc\services.exe could not be found. This is a good thing, of
course, but the message is annoying. I'm assuming there is still something
in the registry which I need to remove or change, but not a clue what. Any
suggestions?

 

[Carey Frisch [MVP]]

Removing viruses alone does not undo the damage caused by the viruses.
I would suggest backing up your important files, then perform a clean install.

Clean Install Windows XP
http://www.michaelstevenstech.com/cleanxpinstall.html

--
Carey Frisch
Microsoft MVP
Windows - Shell/User

Enjoy all the benefits of genuine Microsoft software:
http://www.microsoft.com/genuine/default.mspx

------------------------------------------------------------------------------------------------------------

:

| I was infected with a trojan over the weekend, which among other things
| installed services.exe in Windows\etc. It's gone now (trojan was removed by
| Norton AntiVirus, and services.exe is safely in Windows\System32, where it
| belongs), but on startup I keep getting a message informing me that
| Windows\etc\services.exe could not be found. This is a good thing, of
| course, but the message is annoying. I'm assuming there is still something
| in the registry which I need to remove or change, but not a clue what. Any
| suggestions?

 

[David H. Lipman]

From: "msquire" <[email protected]>

| I was infected with a trojan over the weekend, which among other things
| installed services.exe in Windows\etc. It's gone now (trojan was removed by
| Norton AntiVirus, and services.exe is safely in Windows\System32, where it
| belongs), but on startup I keep getting a message informing me that
| Windows\etc\services.exe could not be found. This is a good thing, of
| course, but the message is annoying. I'm assuming there is still something
| in the registry which I need to remove or change, but not a clue what. Any
| suggestions?

You May be still infected with a Trojan !

At the very least, NAV might have removed the SERVICES.EXE file but not the pointer to run
it.

You can execute MSCONFIG.EXE and go to the StartUp tab.
Then search the line items for the line that loads; windows\etc\services.exe and disable
that line item.

Reboot and then perform the following.


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *

 

[Steven L Umbach]

Programs such as RegCleaner and CCleaner [under issues] can check and clean
your registry of orphaned settings and often will fix such problems. If you
try using one I recommend that you save changes before deleting just in case
a problem occurs. --- Steve

http://www.ccleaner.com/ --- CCleaner.