servicemgr.exe at 100% and CMS

[RS]

Hi

I have cms 2002 installed on a Win 2K advanced server machine. There
is a process called servicemgr.exe (which also appears in the
Applications tab and which started appearing only after I installed
CMS ) which runs in the background and which is taking up 100% of the
CPU most of the time. As soon as I kill this process nothing happens.
How is this process linked to CMS ?

Regards
RS

[Stefan [MSFT]]

Hi RS,

this is not a process coming with CMS.
Can you find this exe on your filesystem?
Maybe it is a 3rd party tool or - in worst case - a virus or something like
that.

Cheers,
Stefan.

"RS" <fd9...@yahoo.com> wrote in message
news:53046c48.03081...@posting.google.com...

[RS]

Hi Stefan,

The path in "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
points to "C:\WINNT\system32\servicemgr.exe" for that particular
process.

TIA
RS

"Stefan [MSFT]" <ste...@online.microsoft.com> wrote in message news:<ORGwmO#XDHA...@tk2msftngp13.phx.gbl>...

[Stefan [MSFT]]

Hi RS,

I have double checked this module is on no of my boxes.
Maybe a virus???

Anyone else who has seen this before?

Cheers,
Stefan.

"RS" <fd9...@yahoo.com> wrote in message

news:53046c48.0308...@posting.google.com...

[Mark Harrison [ms]]

Find the servicemgr.exe executable and right click - select properties then
the version tab,
Hopefully this tell you the vendor of servicemgr.exe

Mark

This posting is provided "AS IS" with no warranties, and confers no rights.
---------------------------------------------------------------------------

"Stefan [MSFT]" <ste...@online.microsoft.com> wrote in message

news:Oa7Zq0AY...@TK2MSFTNGP09.phx.gbl...

[RS]

Well, that's the funny part. According to those details
its from microsoft.

Even strange is its behaviour. If I delete the file,
remove the entires
from "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current
Version\Run" log off/shut down and log in again, both the
entires and the file come back.
The following are the details of the file.

Company Name: Microsoft
Internal Name: SERVICEMGR
Original FileName: servicemgr.exe
Product Name: Service Manager
Product Version: 4.90.3000

RS

>.
>

[Stefan [MSFT]]

Hi RS,

it is very simple for a virus writer to write that it is from Microsoft.
I have checked the knowledgebase: there seems not to be a file named
servicemgr.exe in any product from Microsoft.
And as it is a virus it seems to create himself after deletion - or is it
registered in the dllcache directory?

Cheers,
Stefan

"RS" <fd9...@yahoo.com> wrote in message

news:0e7d01c360dc$a9260a60$a501...@phx.gbl...

[RS]

Hi

It looks like a virus alright. All files with timestamp
modifications since I started the install of CMS have the
same properties for the files as below. And you were
right, the virus recreates itself after its deleted (both
the registry entries and the exes).

But where do I find the dllcache directory ?

Almost the whole bloody machine is infected, especially
windows system files.

Thank god for tools like regmon.exe. Otherwise there was
no way i'd have found this out.

Have to start a fresh install now.

Thanks a lot for the help. Will come back if there are
further problems :)).

RS

>.
>

[Stefan [MSFT]]

Hi RS,

if the Virus is already on your machine the only way to surely remove it and
all backdoors it might have installed is to boot from CD, format the disk
and reinstall the box. You can backup the data files (by being sure that no
macro virus is in your word documents) but you should not keep exe files.

Regards,
Stefan.

"RS" <fd9...@yahoo.com> wrote in message

news:101d01c360ef$48a6d850$a601...@phx.gbl...

[RS]

Did exactly what you said. Its working fine now.

thanks a ton
RS

>.
>