so i woke up earlier to do some research on the net. i turned on my pc and suddenly my microsoft antispyware (thank goodness!) keeps popping up a message that says "microsoft antispyware has blocked a possible windows trojan d:\windows\services.exe from being running". i've searched it on the internet and most of the sites that i saw said that it was a virus, since the true services.exe is located inside the windows\system32\folder not the windows\ folder.

so i've run updates on avg, ad-aware, spybot and microsoft antispyware and ran scans simultaneously. it fixed some "possible hijack" attempt on my pc (some errors, i guess), but it didn't fix this problem. in fact, the first three applications doesn't even detect this virus. microsoft antispyware detects it at startup but never detects it while scanning.

the only hope i have right now is the fact that microsoft antispyware blocks it everytime it tries to run, but i'm worried that sooner or later it might affect my pc. i really need help right now because the entire time i'm supposed to be researching was consumed by the scans that i've done. it's already morning and i haven't done a single thing in my work.

i've seen a similar instance that it occured to someone over the internet, but the details on how to fix it was not shown because i have to be a member (and pay them) in order for me to see the solution. and please, please, please don't tell me to reformat my pc and reinstall windows, because it's not really the best option that i can think of right now, and besides, as i've said, i've wasted too much time just on scans alone. this is driving me nuts and i'm already having a headache...

please help me!

 

 

 

Reply

here's a page from symantec on the services.exe issue:
http://www.symantec.com/avcenter/venc/data...re.replace.html

it requires editing of the windows registry, so heed warnings on the page about editing your registry. Incorrect changes to the registry can result in permanent data loss or corrupted files.

Reply

but it says that the services.exe is located under the %system%/services folder. the services.exe that i was talking about a while back is located under the d:\windows\ folder. the website you gave said that the %system% in xp prof is the \windows\system32, as i've mentioned in my post.

would that link refer to the same services.exe? because i don't want to risk doing anything, especially if it requires editing the registry, until i've seen a closer solution.

Reply

i've disabled system restore and ran the scans again, but the scanners didn't detect the services.exe virus. @_@ this is insane! i don't know what to do anymore!!!

.... oh and one more thing, the link you gave... they're requiring me to get their product...

Reply

It could be the Trojan/Legmir-E. Information on removal can be found at the link below:

http://www.sophos.com/virusinfo/analyses/trojlegmire.html

Reply

i've found a software that was able to detect the virus. it's called xoftspy. the only problem was, it was able to detect the virus via free scan, but that's just about it. i have to pay like 40 dollars or something for me to be able to remove the threat on my pc, which translates to me buying the application in the first place...

what a bummer....

Reply

So I guess you have to ask yourself a question. Is the information I have on my hard drive worth $40? If it is, then buy the program. If it's not, then do nothing. Pretty simple really.

Reply

honestly, what i did was i had to find a crack for the app to work, so yeah, the virus is now gone. i've ran out of options, and obviously reformatting and reinstalling windows on my pc was not an option for me, so there.

Reply

This in itself might install another virus. Be careful.

Reply

While your idea could work, I highly suggest running Hijackthis, a great hijack prevention tool.

http://www.merijn.org/downloads.html

If you run it, you will get a log. Show this log to anyone who can analyze HijackThis logs.

If that doesn't work, try running these three antivirus/spyware/adware programs.



Of course, you will want to update your definitions first.

Reply