Error msg - Windows cannot find C:\WINDOWS\inet20003\services.exe

[Guest]

Recently invaded by malware. After cleaning I get the above message. When I
click ok start getting trojan and spyware which are blocked, cleaned and
deleted by PC-cillin

 

[Ramesh, MS-MVP]

Sophos virus analysis: Troj/Krepper-Z:
http://www.sophos.com/virusinfo/analyses/trojkrepperz.html

- - - - -

The following registry entries are created to run Troj/Krepper-Z on startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
run
<Windows>\inet20003\services.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
xp_system
<Windows>\inet20003\services.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
xp_system
<Windows>\inet20003\services.exe
- - - - -

--
Ramesh, Microsoft MVP
Windows XP Shell/User

Windows XP Troubleshooting
http://www.winhelponline.com


Recently invaded by malware. After cleaning I get the above message. When I
click ok start getting trojan and spyware which are blocked, cleaned and
deleted by PC-cillin

 

[Guest]

How do I correct this?

 

[Ramesh, MS-MVP]

Do a complete virus scan to be safe. Then, remove the orphaned startup
entries by editing the registry or by using third-party startup manager.

How to manage Windows Startup?:
http://www.winhelponline.com/startup.htm

Common loading points of threats in Windows 2000/XP:
http://service1.symantec.com/SUPPORT/nav.nsf/docid/2001060517115206

Startup Program Loading:
http://aumha.org/a/loads.htm

Manually Disabling Startup Programs:
http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prmc_str_elqj.asp


Startup managers:

Sysinternals Freeware - Autoruns:
http://www.sysinternals.com/Utilities/Autoruns.html

Autoruns: Hunt down autostart programs wherever they hide
http://www.windowsitpro.com/Articles/Index.cfm?ArticleID=44089

Startup Control Panel
http://www.mlin.net/StartupCPL.shtml

How to use MSCONFIG: NetSquirrel.com:
http://netsquirrel.com/msconfig/


--
Ramesh, Microsoft MVP
Windows XP Shell/User

Windows XP Troubleshooting
http://www.winhelponline.com


How do I correct this?

 

[Guest]

Do a complete virus scan to be safe. Then, remove the orphaned startup
entries by editing the registry or by using third-party startup manager.

How to manage Windows Startup?:
http://www.winhelponline.com/startup.htm

Common loading points of threats in Windows 2000/XP:
http://service1.symantec.com/SUPPORT/nav.nsf/docid/2001060517115206

Startup Program Loading:
http://aumha.org/a/loads.htm

Manually Disabling Startup Programs:
http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prmc_str_elqj.asp


Startup managers:

Sysinternals Freeware - Autoruns:
http://www.sysinternals.com/Utilities/Autoruns.html

Autoruns: Hunt down autostart programs wherever they hide
http://www.windowsitpro.com/Articles/Index.cfm?ArticleID=44089

Startup Control Panel
http://www.mlin.net/StartupCPL.shtml

How to use MSCONFIG: NetSquirrel.com:
http://netsquirrel.com/msconfig/


--
Ramesh, Microsoft MVP
Windows XP Shell/User

Windows XP Troubleshooting
http://www.winhelponline.com


How do I correct this?