A few days ago AVG antivirus removed a Trojan type virus, after which at startup I get the message "Windows cannot find Services.exe ......". I've looked through the start up log and done a search in the Registry. win.ini and system.ini but can find no reference to Services.exe. How can I get rid of the startup message?

[Reply or follow-up to this message]

It means you have some of the Virus still on the Computer. I would suggest you register at one of the Malware Removal Forums for some help cleaning the computer.

[Reply or follow-up to this message]

Hi Brian.

The web is a wonderful search tool.

services.exe 
- services - Process Information

Win98 
but the same applies

[Reply or follow-up to this message]

Tried that one but get the error message "cannot install on a server". My lap top is not a server to my knowledge, has it anything to do with the virus. AVG, Spybot, a-squared, Regseeker and various other programs give a clean bill of health but I still get the "Windows cannot find Server.exe...." on startup. After clicking OK all is fine and Zone Alarm shows no unusual traffic. Thanks for the help.


On Wednesday, October 31, 2007 at 4:39 am, Keith Stanier wrote:
>Hi Brian.
>
>The web is a wonderful search tool.
>
>services.exe
>- services - Process Information
>
>Win98
>but the same applies

[Reply or follow-up to this message]

A few programs giving you a clean bill of health, is no indication you don't have 
an infection and that your system is actually clean. You need to get expert help 
on a malware support forum as Steve suggested.

Either go through these preliminary cleaning steps, or register on one of the other 
forums listed below. They specialize in malware removal. 

GeekstoGo - Malware Cleaning 

MalWare Removal Forums

Post Only on one forum. Good luck. 
Tech Support Guy-Malware Removal forum

Tip: To help prevent future malware infections, Stop using IE as your main 
browser. Switch to a more secure, less malware prone browser as your main browser. 
IE is extremely vulnerable to malware infections. 

Firefox and Opera are recommended alternatives by security experts. Additionally, 
use a HOSTS file. See the link below for more info. 
 

Blocking Unwanted Parasites with a Hosts File

Search results can be misleading, if you don't have an understanding of something. Obviously you don't, when it comes to malwares. You're in the habit of oversimplifying malware removal processes. FYI, liutilities sucks.

Have you tried using the System Configuration Utility, to identify which programs are run automatically on startup?

Click on START then on RUN, and in the "Open" box that pops up type MSCONFIG then click "OK", to open the System Configuration Utility.

Click its STARTUP tab. On that tab, look for an entry for the program SERVICES.EXE and, if found, untick it, then click "OK". Restart your computer. The program will no longer load automatically on startup.

Ed




On Tuesday, October 30, 2007 at 1:55 pm, Brian Partington wrote:
>A few days ago AVG antivirus removed a Trojan type virus, after which at startup
>I get the message "Windows cannot find Services.exe ......". I've looked through
>the start up log and done a search in the Registry. win.ini and system.ini but can
>find no reference to Services.exe.
>How can I get rid of the startup message?

[Reply or follow-up to this message]

Thanks to all. I will persue this matter in a malware forum and if there is a solution post here. There is absolutely no visible reference to Services.exe in the file system or startup and all registry, program and file searches are negative.


On Thursday, November 1, 2007 at 10:25 am, Ed wrote:
>Have you tried using the System Configuration Utility, to identify which programs
>are run automatically on startup?
>
>Click on START then on RUN, and in the "Open" box that pops up type MSCONFIG then
>click "OK", to open the System Configuration Utility.
>
>Click its STARTUP tab. On that tab, look for an entry for the program SERVICES.EXE
>and, if found, untick it, then click "OK". Restart your computer. The program will
>no longer load automatically on startup.
>
>Ed
>
>
>
>

[Reply or follow-up to this message]

Of course they're negative.

Your anti-virus program has found and *deleted* the file SERVICES.EXE - the symptom which you're experiencing is your system attempting to run a file that doesn't exist!

The message "Windows cannot find Services.exe ..." means there is no such file.

All you should be trying to do is identify where the instruction to run the program is coming from, so that you can turn that instruction off.

You've been left with merely an annoyance, literally, not an infection.

Ed




On Sunday, November 4, 2007 at 10:54 am, Brian Partington wrote:
>Thanks to all.
>I will persue this matter in a malware forum and if there is a solution post here.
>There is absolutely no visible reference to Services.exe in the file system or startup
>and all registry, program and file searches are negative.
>
>
>

[Reply or follow-up to this message]

Ed wrote: All you should be trying to do is identify where the instruction to 
run the program is coming from...

If you'd read his responses, he has checked startup locations and searched the registry 
for reference to it. You call it merely an annoyance, but that's not necessarily 
the case. It's best that he pursue this on a malware support forum. Why would you 
have a problem with that? 
 


Blocking Unwanted Parasites with a Hosts File

I never said any such thing.

It may be helpful for his peace of mind to know that he is not dealing with an actual infection, only a fairly trivial annoyance.

It is clear that, although he cannot as yet identify how to stop the system from trying to run the program in question, the program itself has already been deleted.

He may not need a malware forum. He does, however, need to know that he is searching in his computer for the WRONG thing. It may in fact assist him to be made aware of this!

He should not bother searching for the file SYSTEM.EXE as it no longer exists, so obviously he won't find it.

If he searched the registry for instances of "SYSTEM" instead, he might find the run command he is looking for. Searching for "SYSTEM.EXE" has failed since that file has already been deleted.

Ed




On Monday, November 5, 2007 at 7:46 pm, Ms. Eagle wrote:
>
>Ed wrote: All you should be trying to do is identify where the instruction to
>run the program is coming from...
>
>If you'd read his responses, he has checked startup locations and searched the registry
>for reference to it. You call it merely an annoyance, but that's not necessarily
>the case. It's best that he pursue this on a malware support forum. Why would you
>have a problem with that?
>
>
>

Sorry Brian, I meant to say SERVICES.EXE (not SYSTEM.EXE) in the previous posting - sudden brainstorm!

Ed




On Friday, November 9, 2007 at 6:06 am, Ed wrote:
>I never said any such thing.
>
>It may be helpful for his peace of mind to know that he is not dealing with an actual
>infection, only a fairly trivial annoyance.
>
>It is clear that, although he cannot as yet identify how to stop the system
>from trying to run the program in question, the program itself has already been deleted.
>
>He may not need a malware forum. He does, however, need to know that he is searching
>in his computer for the WRONG thing. It may in fact assist him to be made aware of
>this!
>
>He should not bother searching for the file SYSTEM.EXE as it no longer exists, so
>obviously he won't find it.
>
>If he searched the registry for instances of "SYSTEM" instead, he might find the
>run command he is looking for. Searching for "SYSTEM.EXE" has failed since that file
>has already been deleted.
>
>Ed
>
>
>
>

[Reply or follow-up to this message]

Ed, firstly there is no such application as Services.exe on a 9x system! That indicates 
it's malware. If the infection had been cleaned up, it (non-existent or not) would 
not be trying to load. 

I suggested the same in this thread on XP, to search for the DLL and delete all refs. 
to it. After further research, I discovered it's a malware infection so that suggestion 
is out. 

Now, I invite you to have a good look at the thread on CastleCop's forum I linked 
to here... Scroll through it, so you get a good look! Then tell us again how you 
"think" it can be resolved, OK??
http://www.annoyances.org/exec/forum/winxp/1194585915
 

Blocking Unwanted Parasites with a Hosts File

Brian, I should note that there may be a wait before they can get to you on one of 
those malware forums. They get swamped with problems. Hang in there. 

Tip: don't bump your post, because that will make your wait even longer. It's first 
come... first serve basis, which goes without saying. If you bump your thread, the 
latest date will be what they go by. 
 


Blocking Unwanted Parasites with a Hosts File

I would have thought it was blindingly obvious that there is no such file in Windows ME as SERVICES.EXE - which is why it is obvious that the o/p has a virus infection. That and the fact that he told us this in his original posting.

Since the o/p is clear on one important point - that there is no SERVICES.EXE file in his computer - he clearly has no infection as such. There is no executable file that can run.

The file might be a Windows XP file being accessed by the Trojan, or it might be a file that is actually installed by the Trojan. What difference does that make? The infection has failed on his computer.

I see no value in directing a WinME user to a forum that offers anti virus utilities that only run on WinXP or Vista.

Brian, look in the Registry at the following keys, which are some obvious places the run instruction might be located. If you find a reference to SERVICES that would be the reference to delete. Be sure to back-up your Registry before making any changes to it!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

Ed

[Reply or follow-up to this message]

I've been away for a few days, so no time to go to a malware forum. On the advice 
of a friend found this in C:\Windows\system.ini, one place I did'nt look in.

[boot]
oemfonts.fon=vgaoem.fon
shell=Explorer.exe SERVICES.EXE
system.drv=system.drv
drivers=mmsystem.dll power.drv
user.exe=user.exe
gdi.exe=gdi.exe
sound.drv=mmsound.drv
dibeng.drv=dibeng.dll
comm.drv=comm.drv
mouse.drv=mouse.drv
keyboard.drv=keyboard.drv
*DisplayFallback=0
fonts.fon=vgasys.fon
fixedfon.fon=vgafix.fon
386Grabber=vgafull.3gr
display.drv=pnpdrvr.drv

Is it safe to delete SERVICES.EXE from this file?

Thanks to all.







On Sunday, November 4, 2007 at 10:54 am, Brian Partington wrote:

>Thanks to all.

>I will persue this matter in a malware forum and if there is a solution post here. 

>There is absolutely no visible reference to Services.exe in the file system or startup 

>and all registry, program and file searches are negative. 

>

>

> 

[Reply or follow-up to this message]

Yes, you can Brian. Delete that line, so it only lists Explorer.exe, and looks like 
this: shell=Explorer.exe. Be sure to save the changes. 

However, it's likely there's still an infection present. Some has been cleaned up, 
obviously. Since you haven't registered on a forum yet, I found out Spybot's forums 
aren't nearly as busy as most of them, and you'll get help much quicker. 

Don't put it off just because the error message is gone, after deleting that. That 
is just a false sense of security. When you have time to deal with it, here's the 
place to start. My apologies to Keith Steiner, as he did refer you to an example 
of the infection. However, each case is different. 

If you notice here, this poster same issue with Services.exe. Have a look at post 
#6. Just for your info.

http://forums.techguy.org/windows-95-98-me/445355-services-exe-win-ini.html

"BEFORE you POST" (READ this Procedure BEFORE Requesting Assistance)
Spybot.info forums - preliminary cleaning steps

All those forums have preliminary cleaning steps they want you to go through first. 
Just update Spybot and run another scan, even though you have recently and follow 
the rest of the instr. Please let me know how you make out.
 

Blocking Unwanted Parasites with a Hosts File

On Saturday, November 10, 2007 at 5:29 pm, Ms. Eagle wrote:

|My apologies to Keith Stainer, as he did refer you to an example of the infection.
|However, each case is different. 

Apology accepted Carol. 

[Reply or follow-up to this message]

I also apologize for misspelling your name!
 



Blocking Unwanted Parasites with a Hosts File

On Tuesday, November 13, 2007 at 6:38 pm, Ms. Eagle wrote:
|I also apologize for misspelling your name!

Thats ok, I corrected the a but I forgot to move the i so I'm no better 
Carol..  

[Reply or follow-up to this message]

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum