When Trojan Remover encounters a Windows Service that is hidden using Rootkit technology it will display an alert screen. If Trojan Remover can access the file it will scan it to see if it is malicious. However such files are usually not accessible whilst the Rootkit service is running.

 

Not all Windows Services hidden using Rootkit technology are necessarily malicious. However the fact that such a Service is hidden from normal access makes it suspicious.

 

When the Alert screen is displayed you have the following options:

 

Allow this Windows Service to load as normal

No action will be taken on the file and the scan will continue.

 

Disable this Windows Service

Trojan Remover will change this Windows Service's registry Start setting to "Disabled" so that it will no longer run. This change will not take effect until the PC is restarted.

 

Disable this Windows Service and remove the reference

The Windows Service's registry Start setting will be altered to "Disabled", then the registry key loading this Service will be removed. These changes will not take effect until the PC is restarted.

 

Disable this Windows Service, remove the reference, and rename the Service file

This is the recommended option if you are certain that the file is malicious. The Windows Service's registry Start setting will be altered to "Disabled", then the registry key loading this Service will be removed. These changes will not take effect until the PC is restarted. After this Trojan Remover will attempt to rename the file. If the file cannot be immediately renamed Trojan Remover will arrange for the file to be renamed when the PC is restarted.

 

Exclude this Windows Service from future scans

Choose this option if you no longer wish Trojan Remover to show an alert screen when this file is scanned. No action will be taken on the file. You should note that if you select this option, the file will continue to be excluded from future scans, even if, when such a scan is carried out, the file is no longer hidden using Rootkit technology. If you select this option to exclude the file from future scans, you can arrange for the file to be re-included in future scans by selecting File > Manage Exclusions from the main menu. This is the recommended option if you know that the Windows Service being alerted on is not malicious.

 

Select the required option and click on the OK button.

 

Clicking on the Stop Scan button will stop the remainder of the scan. No action will be taken on the file currently being alerted on.

 

Note: hidden Rootkit Windows Services are usually used to hide other files, often along with associated registry keys, from normal access. If you disable this Rootkit Service we highly recommend that a new scan is run with Trojan Remover once the PC has been restarted, so that it can properly scan any files that are no longer hidden.