After i made a lot of Microsoft update and also installed the program called Advanced SystemCare and fixed some problems, i reboot the server but nothing came back on behalf of desktop and taskbar and it says "at least one of service or driver have failed". The 2 of my servers have same problem.I first checked hidden and superhidden registry keys and made sure that they are ok. Explorer.exe is not working, after i renamed itin windows folder a new one appeared again.
I alreadty have Mcafee8.5 installed and up-to-date but anyway i suspected for maliciousware
so i first made sfc.exe /scannow but no use then i used a lot of spyware and antirootkit.
Spyware Doctor,Super antispyware,Iobit Security 360,Uniblue Registery Kit 2010, now i ll try Adaware and Spybot. They found a lot of things but still the problem is there.
I already checked winlogon-> userinit loguin registry keys and also checked Image File options-> explorer.exe and iexplore.exe keys but they are ok either.
I can execute taskmanager so i could install all these but i cant access mmc console it say class is not registered or smth. I also cannot edit txt files it says its not associated and it shows up with "Openwith" console under a registry name like{21434......-31231....
I will be grateful for any of ideas that can work.
P.S. Now my client pc also demands the same 44 microsoft updates that i did apply in server before the incident.
I cannot reach to event manager remotely
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Business Accounts
Answer for Membership
by: trislassisPosted on 2009-11-06 at 10:58:14ID: 25761953
Here is one of hijack help site report (part of it) but i am not sure if its valid.
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services alg.exe Added by W32/Tilebot-EU WORM!, Note: not to be confused with see_Here located in C:\Windows\System32\ this infection is locate in C:\Windows\
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services aspnet_state.exe Related to Microsoft Windows Operating System and is the ASP State Service.
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services cisvc.exe Microsoft Content Index service
Services clipsrv.exe No Record
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services Dfssvc.exe No Record
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services tcpsvcs.exe No Record
Services dmadmin.exe Related to Veritas logical disk manager
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services dns.exe Troj/Wollf-M
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services DNTUS26.EXE Related to Dameware_NT_Utilities program that allows remote access and control of a computer. This is a common program for hackers to install on a computer, so if it is installed, and you did not install it, it should be removed. Note: Located in C:\%WINDIR%\System32 (XP/WinNT/2K)
Services DWRCS.EXE Related to DameWare Development
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services services.exe Spanish Windows 2000 applications managing
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services IS360srv.exe No Record
Services ismserv.exe No Record
Services lsass.exe Part of Windows Vista Note:Located in C:\%WINDIR%\System32
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services llssrv.exe No Record
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services FrameworkService.exe McAfee/CA related
Services Mcshield.exe Related to McAfee_Virus_Shield Note: Located in \%Program Files%\McAfee\VirusScan Enterprise\
Services VsTskMgr.exe Related to Network Associates Virus protection software. Previously known as McAfee.
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services inetinfo.exe Added by the Troj/Sdbot-AMX TROJAN! Read the link, rootkit type stealth involved.
Services netdde.exe Spanish Windows 2000 network DDE
Services netdde.exe Spanish Windows 2000 network DDE
Services lsass.exe Part of Windows Vista Note:Located in C:\%WINDIR%\System32
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services NeTmSvNT.exe No Record
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services ntfrs.exe No Record
Services lsass.exe Part of Windows Vista Note:Located in C:\%WINDIR%\System32
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services services.exe Spanish Windows 2000 applications managing
Services lsass.exe Part of Windows Vista Note:Located in C:\%WINDIR%\System32
Services lsass.exe Part of Windows Vista Note:Located in C:\%WINDIR%\System32
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services locator.exe No Record
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services RSoPProv.exe No Record
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services lsass.exe Part of Windows Vista Note:Located in C:\%WINDIR%\System32
Services SCardSvr.exe The application belonging to the Microsoft Windows Operating System, which provides the authentication facilities for smart security cards on your local system.
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services pctsAuxs.exe No Record
Services pctsSvc.exe No Record
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services spoolsv.exe Added by the Troj/IRCBot-VA TROJAN! Note: This worm\trojan is located in C:\%WINDIR%\
Services srmhost.exe No Record
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services smlogsvc.exe Spanish Windows 2000 performance logs and alerts
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services lserver.exe No Record
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services tssdis.exe No Record
Services ups.exe power management application from APC PowerChute.
Services vds.exe Microsoft Windows Server 2003 R2 Virtual Disk Service
Services vssvc.exe Related to ShadowCopy service implemented into Windows XP and onwards. This service allows files which are modified to be backed up automatically by the operating system.
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services WinVNC.exe Related to RealVNC remote control software. Note: Located in \%WINDIR%\System32\rc\
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus
Services svchost.exe Trojan-PSW.Win32.Sagic.15 Virus