G
Guest
Running XP, SP2 build 2600. Cleaning up college "community" PC (SpyBot S&D /
Ad-Aware / XoftSpy / Norton all participated). All cleaned-up EXCEPT, every
reboot Ad-Aware finds W32.Spybot running (Process file = smncs.exe) -- true
enough it is in the process list. Spybot tell me it is launched from
C:\Windows. Exployer File Search finds no instances of the file anywhere on
C:\. I can terminate the process and Ad-Aware reports removing the worm.
But, there it is again on re-start.
Registry search finds HK_Local Machine/Service/Service Filter/ImagePath
(with quotes as shown) = "C:\Windows\smncs.exe"
Help Please:
(1) Education on what a Service Filter is / is doing; what ImagePath is /
is doing
(2) How to rid the problem (is it safe to delete this entry or blank the
ImagePath? AND will that work?)
Ad-Aware / XoftSpy / Norton all participated). All cleaned-up EXCEPT, every
reboot Ad-Aware finds W32.Spybot running (Process file = smncs.exe) -- true
enough it is in the process list. Spybot tell me it is launched from
C:\Windows. Exployer File Search finds no instances of the file anywhere on
C:\. I can terminate the process and Ad-Aware reports removing the worm.
But, there it is again on re-start.
Registry search finds HK_Local Machine/Service/Service Filter/ImagePath
(with quotes as shown) = "C:\Windows\smncs.exe"
Help Please:
(1) Education on what a Service Filter is / is doing; what ImagePath is /
is doing
(2) How to rid the problem (is it safe to delete this entry or blank the
ImagePath? AND will that work?)