clevere1
Premium
join:2002-01-06
Vancouver, WA
 ·Qwest.net
| Houston, I have a problem! Unknown Service?
I was looking through my services today, and saw this thing listed:
Aflsbposa
It's not running, and is set to manual...
I've googled the name, and nothing has come up..
Any ideas? Hijack this doesn't show anything odd ...
--
I picked up a Magic 8-Ball the other day and it said 'Outlook not so good'. I said 'Sure, but Microsoft still ships it.' |
|
JamPony9
Premium
join:2004-12-08
Austin, TX
| In the Sercives applet, click for "Porperties" of the service. It normally will show the actual path to the executable file for the service. Tell us what that whole path is.
And go find that file and right-click on it and see if there's a "Version" tab with info on who made it.
Also check dates. When was the last time you checked, when it wasn't yet there, and what have you installed or changed since then?
Do you use Internet Explorer? Anti-virus, anti-spyware? |
|
clevere1
Premium
join:2002-01-06
Vancouver, WA
·Qwest.net
1 edit | Yup, I Use Trend Micro Pc-Cillian, Spybot, and Ad-ware.
This is a pretty clean install, it's maybe a month old.
Nothing in the properties of the executable, and nothing when the hard drive is searched. I have no idea where this oddity came from, but, I'm not taking a chance, I'll format the hard drive.
--
I picked up a Magic 8-Ball the other day and it said 'Outlook not so
good'. I said 'Sure, but Microsoft still ships it.' |
|
JamPony9
Premium
join:2004-12-08
Austin, TX
| reply to clevere1
Posters with possible malware problems here are usually referred to ...
»Security »I think my computer is infected or hijacked. What should I do?
There's no harm in a format and clean install, if you have backups of everything you want to keep. Still, it might be worthwhile to look thru that disinfection list and consider anything you haven't tried - it could get you to the same place with less work. |
|
clevere1
Premium
join:2002-01-06
Vancouver, WA
·Qwest.net
| said by JamPony9  :Posters with possible malware problems here are usually referred to ... » Security » I think my computer is infected or hijacked. What should I do?There's no harm in a format and clean install, if you have backups of everything you want to keep. Still, it might be worthwhile to look thru that disinfection list and consider anything you haven't tried - it could get you to the same place with less work. It's a pretty clean system so a format and reinstall isn't to much work. I've never had a mysterious service before, so I'm taking no chances. The thing that gets me, is that a google search, Yahoo!, MSN, and a altavista search don't show ANYTHING for the mysterious service.
--
I picked up a Magic 8-Ball the other day and it said 'Outlook not so good'. I said 'Sure, but Microsoft still ships it.' |
|
Anonymous
Premium
join:2004-06-01
IA
 ·Mediacom
| reply to clevere1
Have you tried searching Google for "random name" "unknown service" ?
--
Get Firefox! |
|
BlitzenZeus
Burnt Out Cynic
Premium,MVM
join:2000-01-13
Beaverton, OR
 ·Verizon FIOS
·Verizon Online DSL
| reply to clevere1
I would look at the properties to see what program it would run, and I personally would remove the entire entry manually through the registry if it was my machine, however manually editing the registry is not for everyone. Along with removing the information in the registry I would look for any more files associated with the program it would launch if deemed malicious, but with that name....
--
My hourly rates:
$25 per hour.
$35 per hour if you want to watch.
$45 per hour if you want to help.
$75 per hour if you tried to fix it, and failed.
The biggest error is sitting in front of your keyboard. |
|
clevere1
Premium
join:2002-01-06
Vancouver, WA
·Qwest.net
| reply to Anonymous
Hmm .. nope, I just went for a specific name..
Aflsbposa
--
I picked up a Magic 8-Ball the other day and it said 'Outlook not so good'. I said 'Sure, but Microsoft still ships it.' |
|
clevere1
Premium
join:2002-01-06
Vancouver, WA
·Qwest.net
| reply to BlitzenZeus
said by BlitzenZeus :I would look at the properties to see what program it would run, and I personally would remove the entire entry manually through the registry if it was my machine, however manually editing the registry is not for everyone. Along with removing the information in the registry I would look for any more files associated with the program it would launch if deemed malicious, but with that name.... I tried, there is no entry in services for the program it would launch... I tried to set the service to disabled and windows complained that it couldn't find the program...
--
I picked up a Magic 8-Ball the other day and it said 'Outlook not so good'. I said 'Sure, but Microsoft still ships it.' |
|
BlitzenZeus
Burnt Out Cynic
Premium,MVM
join:2000-01-13
Beaverton, OR | Either a bad uninstall/install, or you had malware which was removed is my guess.
If your brave, backup your system or registry first, and search your registry for the service name, then remove the key for that service. |
|
clevere1
Premium
join:2002-01-06
Vancouver, WA
·Qwest.net
| said by BlitzenZeus :Either a bad uninstall/install, or you had malware which was removed is my guess. If your brave, backup your system or registry first, and search your registry for the service name, then remove the key for that service. Something funky that is for sure. I can't be the first person to get it...
I've backed up the important stuff, and I am right now in the middle of installing SP2 on a clean install. This is my other machine, one that doesn't have the offending service.
--
I picked up a Magic 8-Ball the other day and it said 'Outlook not so good'. I said 'Sure, but Microsoft still ships it.' |
|
Anonymous
Premium
join:2004-06-01
IA | reply to clevere1
It seems random to me. |
|
Tuulilapsi
Kenosis
join:2002-07-29
Finland
| reply to clevere1
You wouldn't have, by any chance, used RootkitRevealer from Sysinternals? Older versions had a bug that left randomly named services on the system.
--
And lead me not into temptation - for I can find my way there myself easily enough. |
|
Cudni
La Merma - Vigilado
Premium,MVM
join:2003-12-20
Someshire
| reply to clevere1
If you don't want to tinker with registry use
»p-nand-q.com/download/pserv_cpl.html
and/or
»Windows Services Finder/Deleter
Cudni |
|
norwegian
Premium
join:2005-02-15
Outback | reply to clevere1
what about something like filealyser from the makers of spybot S&D, it might in the text in the hex dump, mention a .DLL or 2 its linked to, anyway just a thought |
|
clevere1
Premium
join:2002-01-06
Vancouver, WA
·Qwest.net
| reply to clevere1
Thanks guys. I've done a complete reinstall, with just about all the programs I had on the machine before I formatted installed.
So far, so odd service, I'm going to keep my eye on it. If it comes back, I'll post some logs, and screen shots.
Thanks for your moral support.
--
I picked up a Magic 8-Ball the other day and it said 'Outlook not so good'. I said 'Sure, but Microsoft still ships it.' |
|
duh
@verizon.net
| reply to clevere1
I found a thread regarding a random "new hardware device" driver name, it installs a non-PnP driver, I don't know if this is in any way related to the OP's problem - »www.devhardware.com/forums/t40197/s.html |
|
hexaguano
join:2003-06-09 | reply to clevere1
Any chance you have Photoshop CS installed ? It will install "random" services. |
|
clevere1
Premium
join:2002-01-06
Vancouver, WA
·Qwest.net
| said by hexaguano :Any chance you have Photoshop CS installed ? It will install "random" services. Photoshop CS yes, never had a random service, can you elaborate?
--
I picked up a Magic 8-Ball the other day and it said 'Outlook not so good'. I said 'Sure, but Microsoft still ships it.' |
|
clevere1
Premium
join:2002-01-06
Vancouver, WA | reply to duh
Nope, no non-plug and play drivers that shouldn't have been there, I looked prior to reinstalling. |
|
