Prev: Windows cannot load profile when logging on.
Next: Can't see Networked drive
From: AsK on 18 Jun 2010 04:32
I have found reference to "PereSvc" in the registry after running a
"cleaner" in "safe" mode. When I attempt to delete any part of this
entry it point blank refuses to go.
HKEY_Local_Machine>system>Controlset001(+002+Currentcontrolset)>Enum>Root
to find Legal_Peresvc. I used FixVirut & SUPERAntiSpyware. Any & all
help welcome.
TIA
From: John John - MVP on 18 Jun 2010 07:28
What makes you think that there is a "Bug" in the registry? This is
simply a permissions issue, by default only the System account has full
permission on any of the Enum keys in any of the control sets, other
users only have "Read" permission.

John

AsK wrote:
> I have found reference to "PereSvc" in the registry after running a
> "cleaner" in "safe" mode. When I attempt to delete any part of this
> entry it point blank refuses to go.
> HKEY_Local_Machine>system>Controlset001(+002+Currentcontrolset)>Enum>Root
> to find Legal_Peresvc. I used FixVirut & SUPERAntiSpyware. Any & all
> help welcome.
> TIA
From: AsK on 18 Jun 2010 14:32
On Jun 18, 12:28 pm, John John - MVP <audetw...(a)nbnot.nb.ca> wrote:
> What makes you think that there is a "Bug" in the registry?  This is
> simply a permissions issue, by default only the System account has full
> permission on any of the Enum keys in any of the control sets, other
> users only have "Read" permission.
>
> John
>
> AsK wrote:
> > I have found reference to "PereSvc" in the registry after running a
> > "cleaner" in "safe" mode. When I attempt to delete any part of this
> > entry it point blank refuses to go.
> > HKEY_Local_Machine>system>Controlset001(+002+Currentcontrolset)>Enum>Root
> > to find Legal_Peresvc. I used FixVirut & SUPERAntiSpyware. Any & all
> > help welcome.
> > TIA

PereSvc.exe has been appearing frequently & shows up as a trojan etc.
When I thought I had gotten rid of it, by various methods it
reappears. On looking through the registry I found this line. Nothing
else claims this so I want rid of it. It won't go. Perhaps you could
tell me if "Legal_Peresvc" is a genuine Windows object with
PereSvc.exe masquerading as the genuine article? Thanks for your
reply.
From: Twayne on 19 Jun 2010 10:56
In news:8f0f492c-5973-463f-aa0b-84b30f88204a(a)c10g2000yqi.googlegroups.com,
AsK <aleckie68(a)googlemail.com> typed:
> I have found reference to "PereSvc" in the registry after
> running a "cleaner" in "safe" mode. When I attempt to
> delete any part of this entry it point blank refuses to go.
> HKEY_Local_Machine>system>Controlset001(+002+Currentcontrolset)>Enum>Root
> to find Legal_Peresvc. I used FixVirut & SUPERAntiSpyware.
> Any & all help welcome.
> TIA

If you had looked it up on Google, you would have found these hits and many
more to boot:

http://www.prevx.com/filenames/X66113364402232565-X1/PERESVC.EXE.html

http://www.greatis.com/appdata/d/p/peresvc.exe.htm

Typical excerpt:
peresvc.exe - Dangerous
--------------------------------------------------------------------------------

peresvc.exe
We suggest you to remove PERESVC.EXE from your computer as soon as possible.
PERESVC.EXE is Trojan/Backdoor.
Kill the process PERESVC.EXE and remove PERESVC.EXE from Windows startup.
Removal: peresvc.exe is removed by RegRun.


Read more... Removal instructions...


Comments:
Bob
The UnHackMe is a real program, no spyware or phish and works great and is
easy to use. Enjoy!

Sonya

UnHackMe has demonstrated its protective power and gives me great peace of
mind. Thank you for this excellent program and keep up the superb work!

Chris

I would like to say that RegRun has helped me on more than 1 occasion when
it comes to spyware/adware by letting me know automatically that a piece of
it got added to Windows startup. There is so much spyware/addware out there
today it's hard to imagine being without RegRun. I like many other features
too including the daily registry backups and file protection.




--------------------------------------------------------------------------------
Constantly updated. Last update: June 12 2010
--------------

I do NOT know or recommend these siites; they're just two of the man
possibilities in the search. Personally I'd look for removal for it on
Symantec.com and follow ther instructions.

HTH,

Twayne`


From: Daave on 19 Jun 2010 11:34
AsK wrote:
> I have found reference to "PereSvc" in the registry after running a
> "cleaner" in "safe" mode. When I attempt to delete any part of this
> entry it point blank refuses to go.
> HKEY_Local_Machine>system>Controlset001(+002+Currentcontrolset)>Enum>Root
> to find Legal_Peresvc. I used FixVirut & SUPERAntiSpyware. Any & all
> help welcome.
> TIA

(In the future, do not use registry cleaners!)

You have malware, and it needs to be properly removed.

From David H. Lipman:

Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe

Then post the contents of the HJT log in your post with a full
explanation of your problem
and what you have done to date in one of the below expert forums...

{ Please - Do NOT post the HJT Log here ! }

Forums where you can get expert advice for HiJack This! (HJT) Logs.

NOTE: Registration is REQUIRED in any of the below before posting a log

Suggested primary:
http://www.thespykiller.co.uk/index.php?board=3.0

Suggested secondary:
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/index.php?showforum=7

Suggested tertiary:
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://aumha.net/viewforum.php?f=30
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13


 |  Next  |  Last
Pages: 1 2
Prev: Windows cannot load profile when logging on.
Next: Can't see Networked drive