had some serious spyware removed along with a couple of virus files. all seems to be well now except for one entry that shows when i run hijackthis. this entry is: F1 - win.ini: run=C:\WINDOWS\SYSTEM32\services\services.exe i thought services.exe should be located in the system32 folder not in a services folder. does this look like remnents left from my previous problems and if so how should i correct it. let hijackthis try to or if manually how to do it. would appreciate any suggestions.

http://homepage.ntlworld.com/dvk01uk/tutorial.htm F0, F1, F2, F3 - Autoloading programs from INI files What it looks like: F0 - system.ini: Shell=Explorer.exe Openme.exe F1 - win.ini: run=hpfsched What to do: The F0 items are always bad, so fix them. The F1 items are usually very old programs that are safe, so you should find some more info on the filename to see if it's good or bad. Pacman's Startup List can help with identifying an item. http://www.sysinfo.org/startuplist.php ========================================== More help sites . http://www.spywareinfo.com/~merijn/htlogtutorial.html http://www.help2go.com/article153.html http://hjt.wizardsofwebsites.com/ http://www.spywareinfo.com/bhos/ http://www.spychecker.com/program/bholist.html http://www.spywareinfo.com/~merijn/htlogtutorial.html#r http://www.computercops.biz/postt6393.html http://www.google.com/search?q=spyware+lis

Johnw, Thanks for the info and site links. I had already been to the tutorial site and Pac-Portal start list database was down. I know the services.exe is a legit file if it is located in the system32 folder. I think this one is not legit because of it's location and I think it is gone now. I am not at that computer at the moment to search for it. If the file is gone, I wanted to know how to safely remove it from the win.ini file so the computer won't look for it on bootup as it is now.

Lot of ways L.B. Here are a few to try . http://support.microsoft.com/default.aspx?scid=KB;EN-US;q310560&ID=KB;EN-US;q310560 StartupList : http://www.lurkhere.com/~nicefiles/ The newest version of the efficient and effective program by Merijn that lists all and every autostarting app on your system. Checks Autostart folders, the Registry Run keys, Autoexec.bat, Stub Paths, ICQ Agent, Program extensions, Win.ini, System.ini, Wininit.ini, Wininit.bak, Winstart.bat, Dosstart.bat, as well as checking for duplicate instances of Explorer.exe and checking for superhidden extensions. Recommended for Windows 95/98/98SE/ME/NT4/2000/XP. Listing & description of Startup Entries . http://www.sysinfo.org/startuplist.php?filter=v&count=&type= Startup Control Panel http://www.mlin.net/StartupCPL.shtml Startup Control Panel is compatible with all modern versions of Windows . Win95/98/ME/NT/2K/XP By Mike Lin which does a much better job of managing startup programs than MSCONFIG . Download the standalone version .

Edit win.ini with Notepad. You'll find a run= line in it for the interloper. Remove the line & save on exit.

Thanks Johnw and thanks Rambler. That's the info I was looking for. I think the win.ini edit is what I need.