Unknown Service in XP.

[dairyman]

I was just looking at the Services list in XP Home, and found an interesting entry named GDWBAMDZVX.

I have attached a HijackThis log, just in case somebody wants to see what is running.

Note: Sidebar.exe is Windows Sidebar. I scanned this with AVG, and it was clean. And even though I am running XP, I managed to install it, so don't worry about this process.

[Broni]

Your log is clean...
From cosmetic point of view, you can fix:
- O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
= O2 - BHO: Popup Manager - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - (no file)

 

[Broni]

As for GDWBAMDZVX
You can see this name under "Name" column?
If so, what does it say under "Description", "Status", and "Startup Type"?

[dairyman]

As for GDWBAMDZVX
You can see this name under "Name" column?
If so, what does it say under "Description", "Status", and "Startup Type"?

That is under the name column.
Startup type is Manual.

There is no description.
It is not running.

[Broni]

Get ServiWin (free) from here: http://www.nirsoft.net/utils/serviwin.html
When you open it, hit F8 in order to view Services (also View>Services).
Go View>Choose Columns, and enable as many columns, as possible.
Post back what additional info about GDWBAMDZVX you'll get.

[dairyman]

File Description: RootKit Detection Utility
Company: SysInternals - www.sysinternals.com
Filename: C:\DOCUME~1\_____~1\LOCALS~1\Temp\GDWBAMDZVX.exe
Product Name: Sysinternals Rootkitrevealer.

[Broni]

Do you run "Autoruns" as a startup?

[dairyman]

I've never heard of Autoruns...

[Broni]

File Description: RootKit Detection Utility
Company: SysInternals - www.sysinternals.com

Must be RootkitRevealer from Sysinternals:
http://www.microsoft.com/technet/sysinternals/utilities/RootkitRevealer.mspx

The Sysinternals web site was created in 1996 by Mark Russinovich and Bryce Cogswell to host their advanced system utilities and technical information. Microsoft acquired Sysinternals in July, 2006. Whether you’re an IT Pro or a developer, you’ll find Sysinternals utilities to help you manage, troubleshoot and diagnose your Windows systems and applications.

http://www.microsoft.com/technet/sysinternals/default.mspx

[dairyman]

I remember I installed that program. It crashed the first time I used it.

[Broni]

Since you don't use it, you may set it to "Disabled".

[dairyman]

Done. Thank you.

[Broni]

Cool