Explorer Service Failed to Start

I just finished removing the final bit of a virus on one of our servers and I'm now getting a error on reboot that at least one service failed to start. I checked the event viewer and I found the message attached to this question. Looks like it's related to the Explorer service (which I was unaware ran as a service). The solve to my last question involved removing a fake copy of explorer from C:\WINNT\System32. I'm wondering if this service was also part of the virus as well, since the service installed on the system points to that exact file. Does this sound correct? If so, how do I go about removing this service?
Who is Participating?
QlemoConnect With a Mentor Batchelor and DeveloperCommented:
There is NO Explorer service. This entry has to be part of the virus.
You can use sc.exe, if you've got Resource Kit or Supplement Tools, to remove the service, or do it manually (but have to reboot then):
In Registry, go to HKLM\System\CurrentControlSet\Services, and delete the key pointing to the malicious explorer.exe. Do the same in the other ControlSetXXX paths. After reboot, the service has gone.
gsszuberAuthor Commented:
Thanks, everything started up fine after I deleted that registry entry.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.