Unknown Services on my PC?

Ferrari458 · Oct 13, 2011

Hello all my name is Isaac and I'm new to VistaForums.

As the title describes there are unknown services on my computer but they aren't running I wondered if they were virus related but so far that doesn't seem to be the issue because i spent most of the day yesterday scanning my pc with Kaspersky Rescue Disk 10, Mcafee Total Protection, Malwarebytes, and MRT and nothing comes up just a few tracking cookies. What has me concerned is that these services don't have any description and the registry entries that are associated with the services can't be deleted. The Services are EGNRB, LNOFTN, MYWWAZPF, OKHHUSQMKP, RUKCOCJIWMD, and XMXWPXY they all seem to live in C:\Users\Isaac\AppData\Local\Temp\ but when i go to the directory they aren't there, in CMD i navigate to it also do an "attrib" and there aren't any hidden files. Im so stumped because i don't know what is going on and to me this seems very suspicious. Thanks in advance and sorry if i posted in the wrong section.

Yard Dog · Oct 13, 2011

Welcome to this forum Ferrari458,
Try this program , called process explorer and it will give you info about any process that is listed for your microsoft processes . Here: Process Explorer
I use this myself for service host files , just so i know where they came from, you may find this helpful, Post back if you need more assistance.

richc46 · Oct 13, 2011

Most likely hidden services, which may be hidden. They may be hidden from process explorer, too, but its worth a try.
If you cannot find the services

1) Open the “Start” menu and choose “Run…”
2) Type in “cmd” (without the quotes) and click “ok”.
3) At the cmd prompt, type in “set devmgr_show_nonpresent_devices=1″ (without the quotes) and press enter. (Note that nothing seems to happen–this is ok. We are actually setting an environment variable which is going to help us to see hidden devices)
4) On the next cmd prompt line, type in “devmgmt.msc” (without the quotes) and press enter. This will launch the Windows Device Manager Console.
5) In the Device Manager Console, from the “View” menu, select “Show Hidden Devices”.

Ferrari458 · Oct 13, 2011

richc46 said:
Most likely hidden services, which may be hidden. They may be hidden from process explorer, too, but its worth a try.
If you cannot find the services

1) Open the “Start” menu and choose “Run…”
2) Type in “cmd” (without the quotes) and click “ok”.
3) At the cmd prompt, type in “set devmgr_show_nonpresent_devices=1″ (without the quotes) and press enter. (Note that nothing seems to happen–this is ok. We are actually setting an environment variable which is going to help us to see hidden devices)
4) On the next cmd prompt line, type in “devmgmt.msc” (without the quotes) and press enter. This will launch the Windows Device Manager Console.
5) In the Device Manager Console, from the “View” menu, select “Show Hidden Devices”.

I tried what you suggested and this is what i got for hidden devices.

Ferrari458 · Oct 13, 2011

Yard Dog said:
Welcome to this forum Ferrari458,
Try this program , called process explorer and it will give you info about any process that is listed for your microsoft processes . Here: Process Explorer
I use this myself for service host files , just so i know where they came from, you may find this helpful, Post back if you need more assistance.

Thank you for welcoming me to the forum and the for the help

When I run the program under Services.exe there is a little "+" sign and when i click it doesn't show the unknown services. Its a good program though

Might it be under some different tab or something?

richc46 · Oct 13, 2011

I selected 2 at random and did a Google; nothing comes up. This usually means a name changing virus. To protect you I will summon our security expert. If she give you the all clear, I would just forget about them as they are not causing any harm.

Ferrari458 · Oct 13, 2011

richc46 said:
I selected 2 at random and did a Google; nothing comes up. This usually means a name changing virus. To protect you I will summon our security expert. If she give you the all clear, I would just forget about them as they are not causing any harm.

I did the same thing also i spent hours researching this on google but nothing comes up. How could i have gotten a virus though? I don't go on any bad sites I always check siteadvisor b4 i go to any site or link but i know that it isn't fool proof. And if it is a virus how come none of the scanners pick them up, Kaspersky Rescue Disk is a bootable on demand scanner so the viruses couldn't haven't loaded because Windows never loaded. Thank you for your help btw.

richc46 · Oct 13, 2011

You cannot be more careful than me. I made my once a week scan with Security Essentials and it found two Severe problems. Those B------s that write those virus should be hung by their b---- and made to rot in the sun.
Those names could be anything, but lets check for the dangerous possiblilities first.

Ferrari458 · Oct 13, 2011

richc46 said:
You cannot be more careful than me. I made my once a week scan with Security Essentials and it found two Severe problems. Those B------s that write those virus should be hung by their b---- and made to rot in the sun.
Those names could be anything, but lets check for the dangerous possiblilities first.

I couldn't agree more with you these Virus Compilers get more craftier by the day with writing their malicious code

Yard Dog · Oct 13, 2011

Hello again, Sorry, i am a little lost on how you are seeing these services to begin with, you indicate they are in the C:\Users\Isaac\AppData\Local\Temp\, but , i missed the part/failed to ask , how did you find these services in that location ? I can tell you right now, that if you ran an updated version of malwarebytes with latest definitions and if there were virus/malware in the temp folders/files that mbam would have detected the threat . You indicate that " just a few tracking cookies " showed up in the scans.
Can you please indicate how you came across these services please ?

Yard Dog · Oct 13, 2011

Me again, are you seeing these in task manager as services ?

Ferrari458 · Oct 13, 2011

Yard Dog said:
Hello again, Sorry, i am a little lost on how you are seeing these services to begin with, you indicate they are in the C:\Users\Isaac\AppData\Local\Temp\, but , i missed the part/failed to ask , how did you find these services in that location ? I can tell you right now, that if you ran an updated version of malwarebytes with latest definitions and if there were virus/malware in the temp folders/files that mbam would have detected the threat . You indicate that " just a few tracking cookies " showed up in the scans.
Can you please indicate how you came across these services please ?

I found the location when i checked Computer Management and then Services. All of the unknown services were set to manual so when i click "Properties" it showed me where the services were. The funny thing is that if i tried starting any of the unknown services it would cause an error saying that the file wasn't found. MBAM was fully updated as well as all of the other scanners. I just went ahead right now and deleted all of the associated registry entries that were associated with the services and they(the services) no longer show in Services under Computer Management. I deleted the Registry entries by taking ownership of them and their sub-entries, does that mean I am safe from any threat if there ever was a threat?

richc46 · Oct 13, 2011

They are probably needed for one of your programs. Lets be 100% sure not malware, our experts will tell us. Then we will try a few things to try to find the true source.

Ferrari458 · Oct 13, 2011

richc46 said:
They are probably needed for one of your programs. Lets be 100% sure not malware, our experts will tell us. Then we will try a few things to try to find the true source.

Idk the only program i installed lately is Oracle Virtualbox and also on my laptop and the services didn't show up on it. I make a habit of checking the services once in a while and i know for sure those weren't there a week ago. But still im open to trying anything you guys suggest. Thank you guys for your help I really do appreciate it. Almost forgot I backed up the Registry b4 i deleted anything in case they are needed.

Yard Dog · Oct 13, 2011

I was going to suggest using the free latest version of ccleaner to check that you had no trash " laying around " , but, you have went the extra mile already IMO ( in my opinion ) .

Here is another neat program , works like regedit, i peek at it once in a while, you can have it search for entries in the register with the F3 function to find entries. As always, have a back up of your registry before you mess around in there. Here is this program : Everything Search Engine

As you have already cleaned up those entries, as Rich has mentioned, we have a Security person who will look at this thread and see if you did the right thing by removing those already. You of course have a restore pt/backup to go to if it is required .?

Ferrari458 · Oct 13, 2011

Yard Dog said:
I was going to suggest using the free latest version of ccleaner to check that you had no trash " laying around " , but, you have went the extra mile already IMO ( in my opinion ) .

Here is another neat program , works like regedit, i peek at it once in a while, you can have it search for entries in the register with the F3 function to find entries. As always, have a back up of your registry before you mess around in there. Here is this program : Everything Search Engine

As you have already cleaned up those entries, as Rich has mentioned, we have a Security person who will look at this thread and see if you did the right thing by removing those already. You of course have a restore pt/backup to go to if it is required .?

yes i made a backup

richc46 · Oct 13, 2011

We have many members in different time zones etc, but I will keep a eye on this thread to make sure you are helped.

Ferrari458 · Oct 13, 2011

ok thank you rich you guys have such a nice group of helpful people on this forum Im so glad i joined.

richc46 · Oct 13, 2011

After we solve this problem, and we will, you will always be welcome to learn or just have fun.

Yard Dog · Oct 13, 2011

* shuffles feet * kicks sand, and looks embarrassed !! Thanks Ferrari458, I joined in Oct of this year, and i am quite happy here. I am still learning way more than i help tho..
You will like coming here. I just * feel * it..

Unknown Services on my PC?

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer