SCMan, access is denied

[Guest]

I have a Limted account, that when logging in, I get a small warning "SCMan,
access is denied" followed by "Can't open Service Control Manager". If I
change the account to an Administrator account I no longer get the warning.
Any ideas of the cause and how to get rid of?

 

[Malke]

I have a Limted account, that when logging in, I get a small warning
"SCMan, access is denied" followed by "Can't open Service Control
Manager". If I change the account to an Administrator account I no
longer get the warning. Any ideas of the cause and how to get rid of?

According to TrendMicro, SCMan.exe is a worm. Here's the link to their
page:

http://tinyurl.com/5k777

Perhaps it can't run under a Limited Account. In any case, scan with a
current version av using updated definitions in Safe Mode. If you don't
have one, get TrendMicro's Sysclean as follows:

TrendMicro's Sysclean is an extensive antivirus tool which has the
advantage of not needing to be installed. It requires two parts - the
scanning engine and the virus pattern files.

1. Create a new folder on your Desktop or the C: drive named something
useful like "Sysclean".
2. Go here and download the two parts of the program to that folder:

http://www.trendmicro.com/download/dcs.asp - Sysclean
http://www.trendmicro.com/download/pattern.asp - virus pattern files

The pattern files will be zipped - extract them with your unzipper (like
WinZip) or if you have XP, you can just open the folder. You need to
put the extracted files in the Sysclean folder you made.

3. Restart your computer in Safe Mode. Get into Safe Mode by repeatedly
tapping the F8 key as the computer is starting up to get to the proper
menu.
4. Go to the Sysclean folder you made and double-click on sysclean.com.
Start the scan. After the scan is finished, look at the log. You may
need to make a note of where any viruses were found if they were not
able to be removed so you can manually delete them.

Then you can install a full-featured av, update its definitions, and
scan.

Malke

 

[Guest]

Thanks for the reply. A virus is one of the things that went through my mind.
I've looked fairly closely, but didn't see any virus 'fingerprints', other
than this error message (which, yes, does seem like scman.exe is trying to
run at login but the OS is preventing). I'd prefer knowing the files that
hold the worm, and the registry entries, and I'll get rid of it that way --
for now, whatever it's trying to do, it isn't. I did previously google
scman.exe and saw the Trendmicro alert, but I would think if it were a more
prevalent worm I'd see more bulletin board activity.