Spybot cannot delete command service

Pozzydrive · Dec 15, 2005

Hi all

Have noticed that Spybot search and destroy keeps displaying 3 x Command Service, it tries to delete it but says it can only delete one of them, having trawled through the internet I found some informtion on the Spybot site saying they thought it was a false positive? can anyone explain what a command service and a false positive is, is there anyway of removing it either remotely or manualy, I did find a site about manual removal and having to go into regedit, saving a copy as a backup etc but some of the information given could not be found in regedit, so did'nt get very far.

chaslang · Dec 15, 2005

Are you referring to a malware system service like the one in message # 2 of the below post:

http://forums.majorgeeks.com/showthread.php?t=77682

If so, Spybot cannot fix it becuase it is an NT service. You have to use steps like those shown.

Pozzydrive · Dec 16, 2005

Hi Chaslang

Sorry did not get back earlier been having problems getting back onto the net, anyway thanks for that, I tried your advice and went to the link and there was no sign of Command service in services.msc, nor cmdservice or anything like it, but Spybot keeps on showing it, anywhere else I can look or any other way I can find it.

chaslang · Dec 17, 2005

Post a log from Spybot that shows exactly what it is finding.

Pozzydrive · Dec 17, 2005

Chaslang

As requested please find below Spybot log:

Command Service: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdService

Command Service: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cmdService

Command Service: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\cmdService

--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2005-12-13 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2005-05-31 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2005-05-31 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2005-12-09 Includes\Cookies.sbi (*)
2005-12-09 Includes\Dialer.sbi (*)
2005-12-09 Includes\Hijackers.sbi (*)
2005-12-09 Includes\Keyloggers.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2005-12-09 Includes\Malware.sbi (*)
2005-12-09 Includes\PUPS.sbi (*)
2005-12-09 Includes\Revision.sbi (*)
2005-12-09 Includes\Security.sbi (*)
2005-12-09 Includes\Spybots.sbi (*)
2005-02-17 Includes\Tracks.uti
2005-12-09 Includes\Trojans.sbi (*)

chaslang · Dec 17, 2005

That is the same as the one I was referring to in the link I posted. You should follow the steps below.

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

.

Pozzydrive · Dec 21, 2005

Chaslang

I have to apologise, I will not be able to complete this before I leave for work, I work overseas and will be away for 29 days, on my return I will follow your instructions, thankyou.

chaslang · Dec 21, 2005

No problem! Search for your thread when you return and gives us the results.

Log in or Sign up

Spybot cannot delete command service

Pozzydrive Corporal

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Pozzydrive Corporal

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Pozzydrive Corporal

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Pozzydrive Corporal

chaslang MajorGeeks Admin - Master Malware Expert Staff Member