TechSpot

services.exe terminating w/status code 203, 204 or -1073741819

By BuddyCole
Dec 16, 2006
  1. Hello,

    Obviously i'm new here, but unfortunately not new to this problem. Awhile (a few months?) ago, my computer started giving me a popup that would shutdown my computer within a minute, saying services.exe had crashed with one of three status codes (see topic title), which were random. No rhyme or reason when this happened, although it didn't occur when my internet was unplugged.

    I had my brother fix this problem after he did rigorous work on my computer. Well, he's gone for the holidays and it this problem has shown it's ugly head once again. I've searched far and wide on the net and couldn't find a suitable solution for myself, so I figured I would try my luck here. Thank you in advance, and to kick things off, here is my HJT log:



    Logfile of HijackThis v1.99.1
    Scan saved at 2:44:20 PM, on 12/16/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\winnt\System32\smss.exe
    C:\winnt\system32\winlogon.exe
    C:\winnt\system32\lsass.exe
    C:\winnt\system32\svchost.exe
    C:\winnt\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINNT\system32\LEXBCES.EXE
    C:\WINNT\system32\LEXPPS.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINNT\system32\drivers\CDAC11BA.EXE
    C:\WINNT\system32\dllhost.exe
    C:\winnt\system32\drivers\KodakCCS.exe
    C:\WINNT\runservice.exe
    C:\winnt\system32\nvsvc32.exe
    C:\winnt\Explorer.EXE
    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    C:\winnt\system32\wscntfy.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\WINNT\system32\LXSUPMON.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HijackThis\HijackThis.exe

    O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\winnt\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [LXSUPMON] "C:\WINNT\system32\LXSUPMON.EXE" RUN
    O4 - HKLM\..\Run: [UVS10 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\winnt\system32\NvMcTray.dll,NvTaskbarInit
    O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
    O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by22fd.bay22.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols3/fscax.cab
    O20 - Winlogon Notify: WRNotifier - C:\winnt\SYSTEM32\WRLogonNTF.dll
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINNT\system32\drivers\CDAC11BA.EXE
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\winnt\system32\drivers\KodakCCS.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
    O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINNT\runservice.exe
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\winnt\system32\nvsvc32.exe
    O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
    O23 - Service: Super Ad Blocker Service (SABSVC) - Unknown owner - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE (file missing)
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - C:\Program Files\Spyware Doctor\sdhelp.exe (file missing)
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
     
  2. Ididmyc600

    Ididmyc600 TechSpot Chancellor Posts: 1,415

    Hi
    Sounds like the blaster virus, from a while back...your post is in the wrong thread, a MOD will shift it shortly to the right place, if you read this before it gets moved, then go to the security and the web forum and follow the instuctions for posting a HJT log.

    Regards
     
  3. BuddyCole

    BuddyCole TS Rookie Topic Starter

    Whoops, I found a topic about the same thing and I thought they had posted it here, my mistake. Regardless, i'll wait until somebody moves it rather than starting a new topic.
     
  4. N3051M

    N3051M TS Evangelist Posts: 2,115

    have a run through these in the meanwhile

    preliminary removal instructions and don't forget to rename the HJT app to a different filename before scanning.

    Just post your HJT log as an attachment next time, makes it easier on my scroll wheel :D
     
  5. spirtire

    spirtire TS Rookie

    I got the exact problem a few days ago. I scanned my PC with EZ Internet Security Suite and found nothing. I then use 'Prevx1' and 'Norton Anti-Virus' to full scan my PC 2-3 times and found nothing also. Problem remains.

    I continue to use my PC by putting that disgusting pop-up on one side and the comp is operating as usual. Only when I do 'shut down' I had to go thru the countdown. I searched thru the net to find a solution but nothing works for me.

    Go to
    http://www.file.net/process/services.exe.html

    to find out which type of 'services.exe' is in your harddisk. Luckily, mine is only '4% dangerous'.

    Check the registry to see if 'services.exe' is safe or infected.

    If you find the follwing values

    ".Prog" = "%Windir%\system\services.exe"
    "BuildLab" = "%Windir%\system\services.exe"
    "ccApps" = "%Windir%\system\services.exe"
    "FriendlyTypeName" = "%Windir%\system\services.exe"
    "Microsoft Visual SourceSafe" = "%Windir%\system\services.exe"
    "RegDone" = "%Windir%\system\services.exe"
    "TEXTCONV" = "%Windir%\system\services.exe"
    "WMAudio" = "%Windir%\system\services.exe"

    in this registry key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

    then it's infected. If it's infected, we can still use 'anit-virus' or etc tools to remove it. But I told that I scanned and scanned and found nothing.

    One night, I didn't click 'shut down' in Windows but simply press and hold the switch button for a few seconds to switch off my PC (while my Windows is running). When I turn on my PC next time, that disgusting pop-up was gone. I then full scan again it shows nothing. I think my problem is solved.

    This problem is tough becasue the virus/malware have a lot of variants to cause the 'services.exe failure error'.

    Good Luck.
     
  6. spirtire

    spirtire TS Rookie

    If you are still finding the solution to this error message and went thru all the above processes but couldn't find your PC is infected, then you might have RAM problem.

    (1) Your PC is using 2 RAM chips. Say 512 + 512 or 1G + 1G or whatever.

    (2) You sometimes get READ/WRITE error in Windows XP regarding RAM problem, but doesn't affect your work.

    (3) Your 2 RAM chips aren't working well together, though they are of the same brand, speed, model...etc.

    (4) Try some RAM diagnostic programs to check. Check both first, then remove 1 of them and check again; replace the other 1 and check again.

    (5) If you find problem(s) during RAM check, then it is the cause of this error. It's not strange that the check result for each RAM is OK, but not OK when using both.

    (6) You can remove 1 RAM and use only 1 in your PC to avoid the error. Of course, you can buy new RAM for replacement. You can also use a rubber to clean the RAM contact, exchange the slot and try the RAM diagnostic again.

    (7) If you hear a BEEP sound when you switch on your PC, then you will have that 'services.exe' error in XP because RAM check during start-up is failed. You can swithch off and then on again to see if you can pass the RAM test.

    Good Luck.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...