Results 1 to 8 of 8

Thread: How to delete a service?

  1. #1
    Senior Member
    Join Date
    Jul 2003
    Posts
    113

    How to delete a service?

    My friend thought he'd be smart and put this trojan on my computer called "institution". The nice thing is, it uses service hiding to do its dirty work. So now I need to remove this service from my computer, but I can't see it in the service browser. I know it's running because I can connect to myself.

    http://www.iamaphex.net/modules.php?...q=getit&lid=54
    (couldn't find it on megasecurity or anything, and in the readme it says run with the '/u' parameter to remove. Problem is, for some reason I can't get the command prompt to 'cd' to my d:\ root, where my friend ran the virus.)

    Does anyone know how I can go about deleting services by not using the service browser?

  2. #2
    Considering that your friends suck...

    If I were you I would run a complete scan on your box. Here is a document that can help:
    http://www.antionline.com/attachment...achmentid=4913

    To summarize the article, download the tools listed and their updates, boot into safe mode, and scan. Then scan with an online scanner, like one listed.

    Safe mode will prevent the service from starting, giving you better success of ending what is starting it.

  3. #3
    Senior Member
    Join Date
    Jul 2003
    Posts
    113
    Yeah...he's a moron thinking he'd be cool and "hack" me...

    Thanks for that guide, I'm gonna go try it now

  4. #4
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,785
    i trust you know that the 'CD' command is not used to change drives, instead just enter the drive letter and a colen (d at the prompt.

    i think you might be talking about this:

    http://securityresponse.symantec.com...aphex.kit.html

    removal instructions are on this page but im sure soda's meathod will work just fine
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  5. #5
    Senior Member
    Join Date
    Jul 2003
    Posts
    113
    Originally posted here by Tedob1
    i trust you know that the 'CD' command is not used to change drives, instead just enter the drive letter and a colen (d at the prompt.
    Heh...yeah I did, i'm just being stupid today...

  6. #6
    Junior Member
    Join Date
    Nov 2001
    Posts
    20
    Normally you'd go about removing a service by stopping the service (in your case booting to safe mode would d the trick) then onpen regedit mosey on down to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    browse trough the keys you find there and delete the ones you want to delete and reboot
    that's about it
    \" I love fools and mistakes i\'m alway\'s making them \" (Charles Darwin)

  7. #7
    Senior Member
    Join Date
    Jun 2004
    Posts
    460
    you can also use in windows xp

    sc delete [service name]

    sc = NT Service Controller

    you can also use this same process to add a service (sc create)
    [gloworange]find / -name \"*your_base*\" -exec chown us:us {} \\;[/gloworange] [glowpurple]Trust No One[/glowpurple][shadow] Use Hardened Gentoo [/shadow]
    CATAPULTAM HABEO. NISI PECUNIAM OMNEM MIHI DABIS, AD CAPUT TUUM SAXUM IMMANE MITTAM

  8. #8
    Senior Member
    Join Date
    Jul 2003
    Posts
    113
    Well I got it off by simply executing with "/u" as a cmdline argument.
    Ty for the help though, now I know where to go next time.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •