services.exe terminating w/status code 203, 204 or -1073741819

[BuddyCole]

Hello,

Obviously i'm new here, but unfortunately not new to this problem. Awhile (a few months?) ago, my computer started giving me a popup that would shutdown my computer within a minute, saying services.exe had crashed with one of three status codes (see topic title), which were random. No rhyme or reason when this happened, although it didn't occur when my internet was unplugged.

I had my brother fix this problem after he did rigorous work on my computer. Well, he's gone for the holidays and it this problem has shown it's ugly head once again. I've searched far and wide on the net and couldn't find a suitable solution for myself, so I figured I would try my luck here. Thank you in advance, and to kick things off, here is my HJT log:



Logfile of HijackThis v1.99.1
Scan saved at 2:44:20 PM, on 12/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\winnt\System32\smss.exe
C:\winnt\system32\winlogon.exe
C:\winnt\system32\lsass.exe
C:\winnt\system32\svchost.exe
C:\winnt\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\system32\drivers\CDAC11BA.EXE
C:\WINNT\system32\dllhost.exe
C:\winnt\system32\drivers\KodakCCS.exe
C:\WINNT\runservice.exe
C:\winnt\system32\nvsvc32.exe
C:\winnt\Explorer.EXE
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\winnt\system32\wscntfy.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINNT\system32\LXSUPMON.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\winnt\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [LXSUPMON] "C:\WINNT\system32\LXSUPMON.EXE" RUN
O4 - HKLM\..\Run: [UVS10 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe"
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\winnt\system32\NvMcTray.dll,NvTaskbarInit
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by22fd.bay22.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols3/fscax.cab
O20 - Winlogon Notify: WRNotifier - C:\winnt\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\winnt\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINNT\runservice.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\winnt\system32\nvsvc32.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: Super Ad Blocker Service (SABSVC) - Unknown owner - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - C:\Program Files\Spyware Doctor\sdhelp.exe (file missing)
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

 

[Ididmyc600]

Hi
Sounds like the blaster virus, from a while back...your post is in the wrong thread, a MOD will shift it shortly to the right place, if you read this before it gets moved, then go to the security and the web forum and follow the instuctions for posting a HJT log.

Regards

 

[BuddyCole]

Whoops, I found a topic about the same thing and I thought they had posted it here, my mistake. Regardless, i'll wait until somebody moves it rather than starting a new topic.

 

[N3051M]

have a run through these in the meanwhile

preliminary removal instructions and don't forget to rename the HJT app to a different filename before scanning.

Just post your HJT log as an attachment next time, makes it easier on my scroll wheel

 

[spirtire]

I got the exact problem a few days ago. I scanned my PC with EZ Internet Security Suite and found nothing. I then use 'Prevx1' and 'Norton Anti-Virus' to full scan my PC 2-3 times and found nothing also. Problem remains.

I continue to use my PC by putting that disgusting pop-up on one side and the comp is operating as usual. Only when I do 'shut down' I had to go thru the countdown. I searched thru the net to find a solution but nothing works for me.

Go to
http://www.file.net/process/services.exe.html

to find out which type of 'services.exe' is in your harddisk. Luckily, mine is only '4% dangerous'.

Check the registry to see if 'services.exe' is safe or infected.

If you find the follwing values

".Prog" = "%Windir%\system\services.exe"
"BuildLab" = "%Windir%\system\services.exe"
"ccApps" = "%Windir%\system\services.exe"
"FriendlyTypeName" = "%Windir%\system\services.exe"
"Microsoft Visual SourceSafe" = "%Windir%\system\services.exe"
"RegDone" = "%Windir%\system\services.exe"
"TEXTCONV" = "%Windir%\system\services.exe"
"WMAudio" = "%Windir%\system\services.exe"

in this registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

then it's infected. If it's infected, we can still use 'anit-virus' or etc tools to remove it. But I told that I scanned and scanned and found nothing.

One night, I didn't click 'shut down' in Windows but simply press and hold the switch button for a few seconds to switch off my PC (while my Windows is running). When I turn on my PC next time, that disgusting pop-up was gone. I then full scan again it shows nothing. I think my problem is solved.

This problem is tough becasue the virus/malware have a lot of variants to cause the 'services.exe failure error'.

Good Luck.

 

[spirtire]

If you are still finding the solution to this error message and went thru all the above processes but couldn't find your PC is infected, then you might have RAM problem.

(1) Your PC is using 2 RAM chips. Say 512 + 512 or 1G + 1G or whatever.

(2) You sometimes get READ/WRITE error in Windows XP regarding RAM problem, but doesn't affect your work.

(3) Your 2 RAM chips aren't working well together, though they are of the same brand, speed, model...etc.

(4) Try some RAM diagnostic programs to check. Check both first, then remove 1 of them and check again; replace the other 1 and check again.

(5) If you find problem(s) during RAM check, then it is the cause of this error. It's not strange that the check result for each RAM is OK, but not OK when using both.

(6) You can remove 1 RAM and use only 1 in your PC to avoid the error. Of course, you can buy new RAM for replacement. You can also use a rubber to clean the RAM contact, exchange the slot and try the RAM diagnostic again.

(7) If you hear a BEEP sound when you switch on your PC, then you will have that 'services.exe' error in XP because RAM check during start-up is failed. You can swithch off and then on again to see if you can pass the RAM test.

Good Luck.