EventID 7023

[Phil]

Every time I restart winxp sp3, I get the following error:

"The System Support service terminated with the following error:
The specified module could not be found."

The source is the "Service Control manager."

I google for "The System Support service terminated with the following
error: The specified module could not be found" for a solution, but
could not find any exact match.

Could someone please help me? Thank you.

 

[Pegasus \(MVP\)]

Every time I restart winxp sp3, I get the following error:

"The System Support service terminated with the following error:
The specified module could not be found."

The source is the "Service Control manager."

I google for "The System Support service terminated with the following
error: The specified module could not be found" for a solution, but
could not find any exact match.

Could someone please help me? Thank you.

This could be a bogus service. Try this:
1. Click Start / Run / services.msc{OK}
2. Locate the "System Support Service".
3. Double-click it.
4. Post the command you see in the box labelled "Path to executable".
5. Post the text you see in the box labelled "Description".

 

[Phil]

This could be a bogus service. Try this:
1. Click Start / Run / services.msc{OK}
2. Locate the "System Support Service".
3. Double-click it.
4. Post the command you see in the box labelled "Path to executable".
5. Post the text you see in the box labelled "Description".

Many thanks for your help.

Here is more info:

1) Service Name = dipmopw

2) Description = "Enables starting processes under alternate
credentials. If this service is stopped, this type of logon access
will be unavailable. If this service is disabled, any services that
explicitly depend on it will fail to start."

3) Path to executable = C:\WINDOWS\system32\svchost.exe -k netsvcs

4) Startup type = set to Automatic

5)Status = Not started (blank space)

 

[Pegasus \(MVP\)]

Many thanks for your help.

Here is more info:

1) Service Name = dipmopw

2) Description = "Enables starting processes under alternate
credentials. If this service is stopped, this type of logon access
will be unavailable. If this service is disabled, any services that
explicitly depend on it will fail to start."

3) Path to executable = C:\WINDOWS\system32\svchost.exe -k netsvcs

4) Startup type = set to Automatic

5)Status = Not started (blank space)

I do not have such a service on my WinXP machine. It might have been
introduced by a flawed third-party application. Since the service does not
start, you might as well disable it in order to suppress the error message.
Run msconfig.exe via the Start/Run button, then untick dipmopw under the
Services Tab.

 

[Phil]

I do not have such a service on my WinXP machine. It might have been
introduced by a flawed third-party application. Since the service does not
start, you might as well disable it in order to suppress the error message.
Run msconfig.exe via the Start/Run button, then untick dipmopw under the
Services Tab.

This is getting weirder by the minute. When I entered into msconfig,
there's no "dipmopw" to be found there.

Then when I tried to changed the startup mode from automatic to either
manual or disabled via properties of "system support" listed in the
services table, I get an error which says, "Access is Denied."

 

[Malke]

This is getting weirder by the minute. When I entered into msconfig,
there's no "dipmopw" to be found there.

Then when I tried to changed the startup mode from automatic to either
manual or disabled via properties of "system support" listed in the
services table, I get an error which says, "Access is Denied."

A Google search for "dipmopw" produces nothing. When you don't get any hits
for a file name on Google, chances are high that it is a malware file. Have
you done the usual scanning for viruses/malware to make sure you've got a
clean base? If not, that would have been my first step and one you should
certainly take now.

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to do
all scans in Safe Mode. Please see the special Notes regarding using
Multi_AV in Vista.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://tinyurl.com/yoeru3 - download link and more instructions

You can also check to see if there are targeted removal steps for your
malware here:
Bleeping Computer removal how-to's -
http://www.bleepingcomputer.com/forums/forum55.html
Or here: Malwarebytes malware removal guides - http://tinyurl.com/5xrpft

When all else fails, get guided help. Choose one of the specialty forums
listed at the first link. Register and read its posting FAQ. PLEASE DO NOT
POST LOGS IN THE MS NEWSGROUPS.

Malke

 

[Pegasus \(MVP\)]

This is getting weirder by the minute. When I entered into msconfig,
there's no "dipmopw" to be found there.

Then when I tried to changed the startup mode from automatic to either
manual or disabled via properties of "system support" listed in the
services table, I get an error which says, "Access is Denied."

I would do this:
1. Click Start / Run / regedit.exe{OK}.
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Services
3. Press F3 (Function key F3).
4. Search for dipmopw.
5. Click File / Export.
6. Save the key to c:\dipmopw.
7. Click Start / Run / notepad.exe c:\dipmopw.reg.
8. Satisfy yourself that the data is there.
9. Back in regedit, delete the service that had the "dipmopw" string.

This will get rid of the error message while allowing you to backtrack if
necessary.

 

[Phil]

A Google search for "dipmopw" produces nothing. When you don't get any hits
for a file name on Google, chances are high that it is a malware file. Have
you done the usual scanning for viruses/malware to make sure you've got a
clean base? If not, that would have been my first step and one you should
certainly take now.

Can't agree with you more that it's very likely a malware/virus.
However, both Kaspersky or Superantispyware didn't pick it up for some
reason. Anyway, thank you for the several websites that you've posted
and I'll keep them for future reference.

 

[Phil]

I would do this:
1. Click Start / Run / regedit.exe{OK}.
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Services
3. Press F3 (Function key F3).
4. Search for dipmopw.
5. Click File / Export.
6. Save the key to c:\dipmopw.
7. Click Start / Run / notepad.exe c:\dipmopw.reg.
8. Satisfy yourself that the data is there.
9. Back in regedit, delete the service that had the "dipmopw" string.

This will get rid of the error message while allowing you to backtrack if
necessary.

okay, finally, got rid of the "System Support" service and Event is
now error free. Thank you. But it took me about two hours because when
I tried to delete the several registry keys with dipmopw in them, I
couldn't, access denied or something like that. After some more
googling I found that it had something to do with permissions.

I wish I knew how that "dipmopw" had ended up in my pc so that I could
warn others about it.

 

[Pegasus \(MVP\)]

okay, finally, got rid of the "System Support" service and Event is
now error free. Thank you. But it took me about two hours because when
I tried to delete the several registry keys with dipmopw in them, I
couldn't, access denied or something like that. After some more
googling I found that it had something to do with permissions.

I wish I knew how that "dipmopw" had ended up in my pc so that I could
warn others about it.

Congratulations for finding out about setting permissions in the registry!

With respect to your reply to Malke: The issue could well have been caused
by some malware that was removed by your virus scanner. However, a residual
reference remained in the registry, perhaps because of the permissions
problem. What you saw was the result of this reference: Nothing to worry
about but irritating nevertheless.