A common mistake arises when working on removing malware from a computer, the only place to begin the infection is in one of the entries enumerated by HijackThis. Most of the part these entries are the most common, but it is not always the case. Lastly there are more infections installing a part of them known as a service like Ssearch.biz and Home Search Assistant. While cleaning a computer the standard method is to clean up the Run entries first and then the other more common startup entries. For the most part, that will be sufficient to remove the infection. The issue arises when the log looks clean in system, but there are still problems occurring. If you are looking for the infection in the operating system's services, to see if there is a service present there and does not belong to be there and may be loading the infection.
A service can be defined as a program that is automatically started by Windows NT/XP/2000/2003 on startup or through some other means and is generally used for programs which run in the background.
In Service Configuration, a service is loaded on startup of computer by either using svchost.exe or by windows directly launching the program. If a service is loaded directly by windows, you can see the associated file name that launches the service. It can be found in the ImagePath value under the following registry entry.
Malware hides and is installed as a Service, to get a report of configured services which are installed on the computer. Just put a simple batch file that uses Bobbi Flekman's swsc program to get a list of the services and open a notepad. It saves time when diagnosing. Well it is not an easy task to remove a service manually, because it requires removing entries from the registry. It can be a dangerous and harmful for the health of your computer. If you do not have any idea regarding this, then please take help from the experts to help with this step of the cleanup registry files procedure as making a mistake can harm your system very badly.
SOURCE: http://www.removepcthreats.com/
