Broadband Tech > Security > Security > Spybot detects "Command Service" as malware

Spybot detects "Command Service" as malware

What are the reg entries?
--
Best RegardsVampirefo

reply to BigPoppa44
Could refer to the resource kit tools "Rcmdsvc.exe" (server end, service) and "rcmd.exe" (client end, command line app?

It's a server for remotely running command line programs. Obviously, that can create some issues. But it's not "malware", just something that can be abused to run malware, given the right set of circumstances...
--
Semper Eadem

Come all without, come all within,
You'll not see nothing like the mighty Quinn.

reply to BigPoppa44
I got the same thing today and well I deleted the registry entries. Is this a false positive?:(

reply to BigPoppa44
same here

reply to BigPoppa44
Well, I thought I was alone on this issue.:(

reply to BigPoppa44
Here is my Spybot log of the fixed registry:

--- Report generated: 2005-12-02 16:45 ---

Command Service: Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mchInjDrv

Command Service: Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mchInjDrv

Command Service: Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\mchInjDrv

TrojanHunter, spysweeper, a2 all add this registry entry, probably more security apps also.
mchInjDrv (Mad code hook injection driver)
malware can use it, but if you use any of the above security apps, then it's a false positive.
--
Best RegardsVampirefo

Yep Vampirefo is right on the money.. One piece of malware that does use it though is this one information on command.exe aka the Buddy trojan..
--
Lost in Texas

reply to Vampirefo
So it's a false positive right?

Absolutely.

reply to Vampirefo
Vampirefo, Thanks for the info. I run Spysweeper V4.5 and A squared V1.6. I'm glad to know that it's a false positive for me.