Strange services.exe running at Windows startup?

Question

I am running Windows XP Pro, and for the past few days, I have had a strange version of services.exe running at startup. It looks to me like some sort of threat, and I cannot disable it. Here is what I've found so far:

1. The file is located in the C:\Windows folder, not the C:\Windows\System32 folder where the legitimate Microsoft version of services.exe is located.

2. It is marked as a system file.

3. Norton A/V full system scan run twice and no viruses were discovered. Virus definitions are current.

4. Full system scan ran with both Spybot and Ad-Aware , no adware/spyware/malware found. Definitions up to date.

5. Security Task Manager (by Neuber Software) finds this file to be a threat. It appears to be trying to reach a website on the net: http//badmental3.netfirms.com/bad.gif, and then Microsoft.com. This first site does not exist.

6. I searched the registry for services.exe, and no references to this file were found except for the legitimate Microsoft file

Answer 1

The legitimate Services runs in the system32 folder and does not load from the run key. Anti-virus software usually removes the viral file, but leave the Windows startup registry keys. This can cause the processor to run at 100%
and slow your system. Run some of the registry mechanic programs (with caution)

Answer 2

Hi

Ok , sometimes if you install a software that either has to be related with networking or it needs to have internet connection then yes , it will create a secondary service.exe on windows. Now the ones ive come accross had been spyware , but since you run your spyware then try this , do a system restore and verify if the file goes away if not then , use a software call unlocker http://ccollomb.free.fr/unlocker/

give me a shout for more info ok

Answer 3

Why don't you delete the file. If it is not a windows file then windows will not prevent you from deleting it. Alternatively rename the file , and see if everything works normally and you do not get any error messages. After that delete the file. You can boot the computer in safe mode to do the above task.

Answer 4

Boot into Windows Safe mode, and then go where the copy of the wrong version of services is placed, and then move it to a temp directory outside of the system area. Once out reboot, and see how things work.
Isolate the services file, until you are sure it is incorrect, and then delete it.
If a Safe mode boot fails to help you remove the file , boot into the command line prompt version, and then go to the correct directory, and del the file you want to remove

Answer 5

just set your firewall to block the application when it tries to connect to the internet. this should prevent it from harming your system.
also, related to an advice above ... try to remove it by using the safe mode or even booting in ms-dos mode and then run a repair from your windows xp setup cd. this should restore the original file.

Answer 6

Comes down to this. You can ask people here, who probably have no idea what they are talking about. Or you can get professional help for free by posting on this forum.

http://www.geekstogo.com/forum/index.php

I used to work there as a helper and there are some of the smartest guys on that site. Should take less than a day to get a response. Post in the windows xp section.

Answer 7

i imagine you're searching on the methods tab on your job manager. those are quite often issues operating in the historic past you would possibly want to opt for to have. I presently have 38 operating on mine. it truly is frequent. once you've homestead windows XP or 2000, you could ideal click on My pc and decide take care of ... in there you'll come across a section referred to as Sevices and applications that provides you a extra useful clarification of what methods are operating on your pc and why. you could provide up them from there also.

Answer 8

here's simple but effective services.exe removal:
http://www.2-spyware.com/file-services-exe.html