Multiple Programs – SERVICES.EXE

Services.exe is the Windows Service Controller. This Microsoft application is found in Windows NT, Windows 2000, and Windows XP. It is used to start, stop or modify any system services that may be running. Services.exe generally works closely with sc.exe, the service controller, and svchost.exe. More information can be found at http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sc.mspx?mfr=true. All of these files should be left in place. Stopping them could make Windows unstable as any running processes that depend upon them would crash.

You'll find a listing of services.exe registry settings at http://msdn2.microsoft.com/en-us/library/aa926416.aspx. You'll find a rundown of Services functions at http://msdn2.microsoft.com/en-us/library/aa450232.aspx.

If you find that services.exe is crashing frequently or that it is using up all of your system resources, we'd recommend going to Microsoft's Knowledgebase at http://support.microsoft.com/ then searching on "services.exe". Then simply open the article that applies to your operating system and the problem you're experiencing. If you find that CPU Utilization in Services.exe Increases to 100%, you'll find a fix at http://support.microsoft.com/kb/328885.

Unfortunately, there are also some viruses that copy themselves to your system using the name "services.exe", overwriting the Windows file.

Services.exe also installs with many variants of the W32/Sober worm. This worm spreads via zip files attached to email. If you have a file called services.exe in a folder called Windows\WinSecurity, you have the Sober.z variant. More information can be found at http://www.sophos.com/virusinfo/analyses/w32soberz.html. This worm installs itself in the registry, lowers system security, and uses its own mail engine to send itself to everyone in your address book. That mail will appear to have come from you. We'd recommend removing this file using WinPatrol. First kill it in your Active Tasks then remove it from your Startup Programs.

Services.exe installs with Troj/Krepper-G. This instance of the file will appear in c:\windows\inetdata. This trojan can change browser settings including your home and search pages. It can also download and run other program. Finally, it modifies your windows hosts file so that you can't get to most antivius program's websites. We'd recommend removing this file using WinPatrol. First kill it in your Active Tasks then remove it from your Startup Programs. Additional information can be found at http://www.sophos.com/virusinfo/analyses/trojkrepperg.html.

A file called services.exe installs with Adware.Replace. More info can be found at http://securityresponse.symantec.com/avcenter/venc/data/adware.replace.html.

Services.exe also installs with the W32.HLLW.Kazping virus. More info and cleanup instructions can be found at http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.kazping.html.

Services installs with W32.Servese, cleanup info is found at http://securityresponse.symantec.com/avcenter/venc/data/w32.servese.html.

Safe if not Virus

Microsoft