How to delete a service?

My friend thought he'd be smart and put this trojan on my computer called "institution". The nice thing is, it uses service hiding to do its dirty work. So now I need to remove this service from my computer, but I can't see it in the service browser. I know it's running because I can connect to myself.

http://www.iamaphex.net/modules.php?...q=getit&lid=54
(couldn't find it on megasecurity or anything, and in the readme it says run with the '/u' parameter to remove. Problem is, for some reason I can't get the command prompt to 'cd' to my d:\ root, where my friend ran the virus.)

Does anyone know how I can go about deleting services by not using the service browser?

Considering that your friends suck...

If I were you I would run a complete scan on your box. Here is a document that can help:
http://www.antionline.com/attachment...achmentid=4913

To summarize the article, download the tools listed and their updates, boot into safe mode, and scan. Then scan with an online scanner, like one listed.

Safe mode will prevent the service from starting, giving you better success of ending what is starting it.

Yeah...he's a moron thinking he'd be cool and "hack" me...

Thanks for that guide, I'm gonna go try it now

i trust you know that the 'CD' command is not used to change drives, instead just enter the drive letter and a colen (d:) at the prompt.

i think you might be talking about this:

http://securityresponse.symantec.com...aphex.kit.html

removal instructions are on this page but im sure soda's meathod will work just fine

Quote:

---

Originally posted here by Tedob1
i trust you know that the 'CD' command is not used to change drives, instead just enter the drive letter and a colen (d:) at the prompt.

---

Heh...yeah I did, i'm just being stupid today...

Normally you'd go about removing a service by stopping the service (in your case booting to safe mode would d the trick) then onpen regedit mosey on down to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
browse trough the keys you find there and delete the ones you want to delete and reboot
that's about it

you can also use in windows xp

sc delete [service name]

sc = NT Service Controller

you can also use this same process to add a service (sc create)

Well I got it off by simply executing with "/u" as a cmdline argument.
Ty for the help though, now I know where to go next time.