services.exe

[live cross wire]

microsoft antispyware alert me about services.exe could be
a trojan but its a system file as windows xp pro will not
remove the file? it says it's a system file

Microsoft AntiSpyware has detected a possible Windows
Directory Trojan.

Name: Microsoft Services and Controller app
Description: Services and Controller app
Publisher: Microsoft Corporation
File name: services.exe
Path: C:\WINDOWS\services.exe

A common technique that spyware, adwares, viruses,
keyloggers etc use to hide from users is to drop files on
the system that use the same name as a legitimate file but
in a different folder.

Advise: You might want to analyse this file to verify it
is something that you really want on your system. Do not
delete this file unless you are 100% sure it is a threat.

So How can I feel that I can remove the file? Plus find a
way to replace the file ?

 

[Bill Sanderson]

This is a bad file.

If you do a search of your system for services.exe you will find that you
have one in \Windows and another in \Windows\system32.

The one in system32 is the genuine system file.

Restart your system in safe mode and do full deep scans with Microsoft
antispyware until a scan comes through clean. Allow Microsoft antispyware
to remove or quarantine this threat. If you are in doubt, choose
quarantine.

The difficulty you are having removing the file is not because it is a
system file, but because it is active (i.e. running in memory, doing Bad
Things) at the time you are trying to remove it. One of the attributes of
safe mode is that very few third-party services are run at startup--that
should allow removal of this file.

 

[mbacarra]

maybe this thread has been created long ago, but i'm currently experiencing the same problem as that of the poster of this thread. i just want to comment on the reply of the person above, saying that windows should be run on safe mode then should the microsoft antispyware be run... i've tried that but it didn't work. i've also disabled the system restore as adviced in antispyware websites and ran a full system scan using all of my antispyware and antivirus but still to no avail. right now, i'm hanging on the strength of microsoft antispyware to block the application from running, but i still need a true cure to this problem.

please help! i really need help on this one! i joined this forum in my desperation to find some answers on this problem...