Should I block it?

No, this file is 100% safe to run.

Additional versions

6.2.9200.16384 (win8_rtm.120725-1247)	1.02%
6.2.8102.0 (winmain_win8m3.110823-1455)	0.12%
6.1.7600.16385 (win7_rtm.090713-1255)	30.46%
6.1.7600.16385 (win7_rtm.090713-1255)	54.86%
6.0.6000.16386 (vista_rtm.061101-2205)	8.27%
6.0.6000.16386 (vista_rtm.061101-2205)	0.06%
6.0.6000.16386 (vista_rtm.061101-2205)	0.54%
6.0.6000.16386 (vista_rtm.061101-2205)	1.86%
6.0.6000.16386 (vista_rtm.061101-2205)	0.06%
5.2.3790.4455 (srv03_sp2_gdr.090203-1205)	0.06%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	0.06%
5.1.2600.5755 (xpsp_sp3_qfe.090206-1316)	2.40%
5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)	0.06%
5.1.2600.3311 (xpsp.080212-0005)	0.06%
5.1.2600.3300 (xpsp.080125-2028)	0.06%
5.1.2600.3244 (xpsp.071030-1537)	0.06%

Relationships

Parent process

wininit.exe (Windows Start-Up Application by Microsoft)

Child processes

PE file structure

Show functions

Import table

advapi32.dll

TraceMessage, GetTokenInformation, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, ConvertSidToStringSidW, RevertToSelf, CreateProcessAsUserW, ImpersonateLoggedOnUser, InitiateSystemShutdownExW, OpenThreadToken, LsaClose, LsaFreeMemory, LsaLookupSids, LsaOpenPolicy, OpenProcessToken, EqualSid, AdjustTokenPrivileges, SetSecurityDescriptorDacl, AddAce, InitializeAcl, CopySid, GetLengthSid, GetSecurityDescriptorDacl, RegGetKeySecurity, RegSetKeySecurity, SetSecurityDescriptorOwner, InitializeSecurityDescriptor, RegLoadMUIStringW, LsaManageSidNameMapping, LookupPrivilegeValueW, RegNotifyChangeKeyValue, LsaQueryInformationPolicy, SetTokenInformation, AddAccessAllowedAce, LsaEnumeratePrivileges, LsaLookupNames, FreeSid, AllocateAndInitializeSid, AllocateLocallyUniqueId, SetKernelObjectSecurity, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSecurityDescriptorToStringSecurityDescriptorW, GetKernelObjectSecurity, LsaStorePrivateData, EventWrite, EventRegister, RegOpenKeyW, SystemFunction005, SystemFunction029, StartServiceCtrlDispatcherW, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, ControlTraceW, EnableTrace, StartTraceW, CheckTokenMembership, LogonUserExExW

api-ms-win-core-crt-l1-1-0.dll

memcpy, wcschr, _wcslwr_s, wcsrchr, wcscat_s, memset, memcmp, _vsnwprintf_s, _wcsnicmp, wcstoul, _ltow_s, wcscspn, wcsstr, _wcsicmp, _wtol, wcsncmp, _ultow_s, _except_handler4_common

api-ms-win-core-crt-l2-1-0.dll

exit, _initterm, _initterm_e

api-ms-win-core-errorhandling-l1-1-0.dll

SetLastError, GetLastError, SetErrorMode, SetUnhandledExceptionFilter, UnhandledExceptionFilter

api-ms-win-core-errorhandling-l1-1-1.dll

SetLastError, GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetErrorMode

api-ms-win-core-file-l1-1-0.dll

CreateFileW, SetFileInformationByHandle, FindNextFileW, FindClose, CreateDirectoryW, FindFirstFileW

api-ms-win-core-file-l1-2-0.dll

CreateDirectoryW, FindFirstFileW, SetFileInformationByHandle, FindClose, FindNextFileW, CreateFileW

api-ms-win-core-handle-l1-1-0.dll

DuplicateHandle, CloseHandle

api-ms-win-core-heap-l1-1-0.dll

HeapFree, HeapCreate, HeapAlloc, HeapSetInformation

api-ms-win-core-heap-l1-2-0.dll

HeapAlloc, HeapSetInformation, HeapFree

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalAlloc, LocalFree

api-ms-win-core-interlocked-l1-1-0.dll

InterlockedCompareExchange, InterlockedExchange, InterlockedCompareExchange64

api-ms-win-core-interlocked-l1-2-0.dll

InterlockedCompareExchange64, InterlockedIncrement, InterlockedCompareExchange, InterlockedExchange

api-ms-win-core-io-l1-1-0.dll

DeviceIoControl

api-ms-win-core-io-l1-1-1.dll

DeviceIoControl

api-ms-win-core-libraryloader-l1-1-0.dll

GetModuleHandleW, GetProcAddress, FreeLibrary, LoadLibraryExW, GetModuleHandleA, LoadStringW

api-ms-win-core-libraryloader-l1-1-1.dll

LoadStringW, GetModuleHandleW, GetProcAddress, LoadLibraryExW, FreeLibrary

api-ms-win-core-localregistry-l1-1-0.dll

RegCloseKey, RegQueryValueExW, RegOpenKeyExW, RegGetKeySecurity, RegSetKeySecurity, RegNotifyChangeKeyValue, RegLoadMUIStringW, RegSetValueExW, RegCreateKeyExW

api-ms-win-core-misc-l1-1-0.dll

LocalFree, Sleep, lstrlenW, LocalAlloc

api-ms-win-core-processenvironment-l1-1-0.dll

GetEnvironmentVariableW, ExpandEnvironmentStringsW

api-ms-win-core-processenvironment-l1-2-0.dll

GetEnvironmentVariableW, ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-0.dll

CreateProcessW, CreateThread, TerminateProcess, GetCurrentThreadId, OpenThreadToken, GetCurrentThread, GetProcessId, GetCurrentProcess, CreateProcessAsUserW, DeleteProcThreadAttributeList, UpdateProcThreadAttribute, InitializeProcThreadAttributeList, OpenProcessToken, ResumeThread, SetThreadPriority, ExitThread, SetProcessShutdownParameters, GetCurrentProcessId, GetProcessTimes

api-ms-win-core-processthreads-l1-1-1.dll

CreateThread, CreateProcessW, SetThreadPriority, GetCurrentThread, GetCurrentThreadId, TerminateProcess, GetProcessId, OpenThreadToken, GetCurrentProcess, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, DeleteProcThreadAttributeList, CreateProcessAsUserW, ResumeThread, OpenProcessToken, OpenProcess, GetProcessTimes, ExitThread, SetProcessShutdownParameters, GetCurrentProcessId

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0.dll

RegOpenKeyExW, RegQueryValueExW, RegCloseKey, RegDeleteTreeW, RegNotifyChangeKeyValue, RegSetKeySecurity, RegGetKeySecurity, RegLoadMUIStringW, RegCreateKeyExW, RegSetValueExW, RegQueryInfoKeyW, RegEnumValueW

api-ms-win-core-string-l1-1-0.dll

CompareStringW

api-ms-win-core-synch-l1-1-0.dll

LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, WaitForSingleObject, SetEvent, CreateEventW, ResetEvent, WaitForMultipleObjectsEx, OpenEventW, OpenProcess

api-ms-win-core-synch-l1-2-0.dll

AcquireSRWLockExclusive, OpenEventW, ResetEvent, WaitForMultipleObjectsEx, CreateEventW, SetEvent, WaitForSingleObject, Sleep, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, ReleaseSRWLockExclusive

api-ms-win-core-sysinfo-l1-1-0.dll

GetTickCount, GetSystemTimeAsFileTime, GetComputerNameExW, GetSystemTime, GetVersionExW

api-ms-win-core-sysinfo-l1-2-0.dll

GetTickCount64, GetSystemTimeAsFileTime, GetComputerNameExW, GetVersionExW, GetSystemTime, GetTickCount

api-ms-win-core-threadpool-l1-2-0.dll

CreateThreadpoolCleanupGroup, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolCleanupGroupMembers, CloseThreadpoolCleanupGroup, CallbackMayRunLong, CloseThreadpoolWork

api-ms-win-security-base-l1-1-0.dll

SetSecurityDescriptorDacl, AdjustTokenPrivileges, EqualSid, ImpersonateLoggedOnUser, RevertToSelf, GetLengthSid, CopySid, CheckTokenMembership, GetTokenInformation, AddAce, InitializeAcl, GetSecurityDescriptorDacl, SetSecurityDescriptorOwner, InitializeSecurityDescriptor, SetTokenInformation, AddAccessAllowedAce, AllocateAndInitializeSid, AllocateLocallyUniqueId, FreeSid, SetKernelObjectSecurity, GetKernelObjectSecurity

api-ms-win-security-base-l1-2-0.dll

AddAccessAllowedAce, SetKernelObjectSecurity, GetKernelObjectSecurity, FreeSid, AllocateAndInitializeSid, AllocateLocallyUniqueId, SetSecurityDescriptorDacl, AddAce, InitializeAcl, GetSecurityDescriptorDacl, SetSecurityDescriptorOwner, InitializeSecurityDescriptor, EqualSid, AdjustTokenPrivileges, RevertToSelf, ImpersonateLoggedOnUser, CopySid, GetLengthSid, CheckTokenMembership, GetTokenInformation, SetTokenInformation

api-ms-win-security-lsalookup-l1-1-0.dll

LsaLookupFreeMemory, LsaLookupTranslateSids, LsaLookupOpenLocalPolicy, LsaLookupManageSidNameMapping, LsaLookupGetDomainInfo, LsaLookupTranslateNames, LsaLookupClose

api-ms-win-security-lsalookup-l1-1-1.dll

LsaLookupOpenLocalPolicy, LsaLookupFreeMemory, LsaLookupClose, LsaLookupManageSidNameMapping, LsaLookupGetDomainInfo, LsaLookupTranslateNames, LsaLookupTranslateSids

api-ms-win-security-sddl-l1-1-0.dll

ConvertSecurityDescriptorToStringSecurityDescriptorW, ConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW

cryptbase.dll

SystemFunction005, SystemFunction029

kernel32.dll

InterlockedCompareExchange64, CreateNamedPipeW, ReadFile, CancelIo, GetOverlappedResult, WaitForMultipleObjects, HeapAlloc, FreeLibrary, GetProcAddress, LoadLibraryW, GetModuleHandleW, TransactNamedPipe, WriteFile, GetTickCount, DuplicateHandle, GetCurrentProcess, GetSystemTimeAsFileTime, CreateEventW, SetEvent, GetCurrentThread, ResetEvent, DeviceIoControl, CreateFileW, GetProcessId, ResumeThread, GetCurrentProcessId, GetDriveTypeW, OpenEventW, GetComputerNameW, CompareStringW, SetThreadPriority, ExitThread, SetProcessShutdownParameters, SetConsoleCtrlHandler, HeapSetInformation, SetErrorMode, SetUnhandledExceptionFilter, GetProcessTimes, OpenProcess, InterlockedCompareExchange, LoadLibraryA, HeapCreate, WaitForSingleObject, TerminateProcess, HeapFree, InitializeCriticalSection, CreateThread, ExpandEnvironmentStringsW, CreateProcessW, GetLastError, CloseHandle, SetLastError, EnterCriticalSection, LeaveCriticalSection, Sleep, LocalFree, LocalAlloc, GetEnvironmentVariableW, CreateDirectoryW, FindFirstFileW, FindClose, lstrlenW, FindNextFileW, MoveFileExW, GetVersionExW, GetSystemTime, GetExitCodeThread, UnhandledExceptionFilter, GetCurrentThreadId, QueryPerformanceCounter, GetModuleHandleA, InterlockedExchange, DelayLoadFailureHook, ConnectNamedPipe

msvcrt.dll

DllMain

ncobjapi.dll

WmiCreateObjectWithFormat, WmiEventSourceConnect, WmiSetAndCommitObject

ntdll.dll

DllMain, EtwRegisterTraceGuidsW, RtlUnicodeStringToInteger, RtlSetLastWin32Error, NtTraceControl, RtlInitializeCriticalSection, NtQueueApcThread, NtOpenThread, EvtIntReportEventAndSourceAsync, RtlSetProcessIsCritical, NtOpenProcessToken, NtSetInformationProcess, NtSetEvent, EtwEventRegister, EtwEventWrite, RtlFreeHeap, NtDeleteFile, NtQueryDirectoryFile, NtWaitForSingleObject, RtlAppendUnicodeToString, RtlAppendUnicodeStringToString, NtQueryInformationFile, NtSetInformationFile, NtFilterToken, RtlCopyUnicodeString, RtlMapGenericMask, RtlValidRelativeSecurityDescriptor, RtlSetSecurityObject, RtlQuerySecurityObject, NtQueryInformationToken, NtDuplicateToken, NtAdjustPrivilegesToken, NtSetInformationThread, NtAccessCheckAndAuditAlarm, NtAccessCheck, NtOpenThreadToken, NtPrivilegeCheck, NtPrivilegeObjectAuditAlarm, WinSqmAddToStream, RtlSetEnvironmentVariable, RtlLengthSecurityDescriptor, RtlValidSecurityDescriptor, RtlSetControlSecurityDescriptor, NtDeleteKey, RtlSubAuthoritySid, NtOpenKey, NtEnumerateKey, NtDeleteValueKey, NtSetValueKey, NtQueryValueKey, NtCreateKey, RtlConvertSharedToExclusive, RtlConvertExclusiveToShared, RtlRegisterWait, RtlCreateServiceSid, RtlGetNtProductType, RtlEqualUnicodeString, RtlLengthSid, RtlCopySid, NtLoadDriver, NtOpenDirectoryObject, NtQueryDirectoryObject, RtlCompareUnicodeString, NtUnloadDriver, DbgPrintEx, RtlAdjustPrivilege, RtlExpandEnvironmentStrings_U, RtlInitializeSRWLock, NtFlushKey, NtOpenFile, RtlDosPathNameToNtPathName_U, NtOpenSymbolicLinkObject, NtQuerySymbolicLinkObject, RtlFreeUnicodeString, RtlAcquireSRWLockShared, NtDeleteObjectAuditAlarm, RtlReleaseSRWLockShared, RtlAreAllAccessesGranted, NtCloseObjectAuditAlarm, RtlDeregisterWait, RtlQueueWorkItem, RtlCopyLuid, RtlDeleteSecurityObject, RtlAcquireSRWLockExclusive, RtlReleaseSRWLockExclusive, RtlReleaseResource, RtlAcquireResourceExclusive, RtlAcquireResourceShared, RtlInitializeResource, NtInitializeRegistry, NtQueryKey, NtClose, RtlInitUnicodeString, NtSetSystemEnvironmentValue, RtlNtStatusToDosError, NtShutdownSystem, EtwTraceMessage, RtlUnhandledExceptionFilter, NtQuerySystemInformation, RtlNtStatusToDosErrorNoTeb, RtlInitializeSid, RtlAllocateHeap, RtlLengthRequiredSid, RtlSubAuthorityCountSid, RtlSetSaclSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlSetGroupSecurityDescriptor, RtlSetOwnerSecurityDescriptor, RtlCreateSecurityDescriptor, RtlAddAce, RtlCreateAcl, RtlNewSecurityObject, RtlAnsiStringToUnicodeString, RtlInitAnsiString, RtlUnicodeStringToAnsiString, EtwGetTraceEnableFlags, EtwGetTraceEnableLevel, EtwGetTraceLoggerHandle, RtlAddAccessAllowedAce, RtlEqualSid, RtlGetOwnerSecurityDescriptor, NtDisplayString, TpReleaseWait, RtlInitUnicodeStringEx, TpAllocWait, NtDeleteWnfStateName, RtlPublishWnfStateData, NtCreateWnfStateName, TpSetWait, RtlAbsoluteToSelfRelativeSD, RtlAddAccessDeniedAce, RtlGetAce, RtlGetDaclSecurityDescriptor, RtlGetGroupSecurityDescriptor, NtDelayExecution, NtRaiseHardError, RtlConnectToSm, RtlSendMsgToSm

rpcrt4.dll

UuidCreate, RpcAsyncAbortCall, RpcServerUnsubscribeForNotification, UuidEqual, RpcServerUseProtseqEpW, RpcServerRegisterIfEx, RpcServerUseProtseqW, RpcServerInqBindings, RpcBindingToStringBindingW, RpcStringBindingParseW, RpcStringFreeW, RpcEpRegisterW, RpcServerInqDefaultPrincNameW, RpcServerRegisterAuthInfoW, UuidCreateNil, I_RpcMapWin32Status, RpcServerInqCallAttributesW, RpcAsyncCompleteCall, RpcServerInqBindingHandle, RpcImpersonateClient, RpcRevertToSelf, I_RpcBindingInqLocalClientPID, I_RpcBindingIsClientLocal, I_RpcSessionStrictContextHandle, NdrServerCall2, NdrAsyncServerCall, RpcSsGetContextBinding, RpcServerInqCallAttributesA, RpcBindingServerFromClient, RpcBindingFree, RpcBindingVectorFree, RpcServerSubscribeForNotification, UuidFromStringW, RpcServerUnregisterIf, RpcMgmtWaitServerListen, RpcMgmtStopServerListening, RpcServerUnregisterIfEx, RpcServerRegisterIf, RpcServerListen, I_RpcExceptionFilter, NdrAsyncClientCall, RpcAsyncInitializeHandle, NdrClientCall2, RpcStringBindingComposeW, RpcBindingFromStringBindingW, RpcEpResolveBinding, RpcServerRegisterIf3, RpcEpUnregister

scesrv.dll

ScesrvTerminateServer, ScesrvInitializeServer

sspicli.dll

LogonUserExExW

user32.dll

BroadcastSystemMessageW, LoadStringW, RegisterServicesProcess

userenv.dll

UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW, DestroyEnvironmentBlock

services.exe

Services and Controller app by Microsoft

Remove services.exe

Version:	6.0.6000.16386 (vista_rtm.061101-2205)
MD5:	8737764f4fd36d6808ee80578409c843
SHA1:	653e37bb2ae7df6bbe5f62aa0bd2566c684cc259
SHA256:	d370021aecf0826cf3935467c09fbca0960ee0cd7f99fbf83d50fe204537e133

This is a Windows system installed file with Windows File Protection (WFP) enabled.

Warning 35 antivirus scanners has detected malware.

What is services.exe?

Service Control Manager (SCM) is a special system process which starts, stops and interacts with Windows service processes. The SCM executable, Services.exe, runs as a Windows console program, and is launched by the Wininit process early during the system startup.

Overview

services.exe is malware that executes as a process under the SYSTEM account with extensive privileges (the system and the administrator accounts have the same file privileges) typically within the context of its parent wininit.exe (Windows Start-Up Application by Microsoft). This is the Service Service Control Manager for Windows wich is responsible for controlling most Windows services. This version is designed to run on Windows Vista and is compiled as a 32 bit program.

Details

File name:	services.exe
Publisher:	Microsoft Corporation
Product name:	Services and Controller app
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\services.exe
Original name:	services.exe.mui
File version:	6.0.6000.16386 (vista_rtm.061101-2205)
Product version:	6.0.6000.16386
Size:	273 KB (279,552 bytes)
Digital DNA
Entropy:	6.449338
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Network connections

[UDP] listens on port 49451

Malware detections

Based on 40+ industry antivirus scanners, 35 of them detected the following malware.

Antivirus engine	Engine version	Detection
Avira AntiVir	7.11.87.208	W32/Patched.UB
Antiy Labs AVL	2.0.3.7	Virus/Win32.ZAccess.gen
avast!	8.0.1489.320	Win32:Sirefef-AII [Rtk]
AVG	2014.0.3629	Patched_c.LYT
BitDefender	7.2	Trojan.Patched.Sirefef.C
Clam AntiVirus	0.97.3.0	Trojan.Zeroaccess-496
Commtouch	5.4.1.7	W32/Backdoor.NKMQ-3542
Comodo Internet Security	16515	UnclassifiedMalware
Dr.Web	8.13.6.16	BackDoor.Maxplus.5220
Emsisoft Anti-Malware	3.0.0.583	Trojan.Patched.Sirefef.C (B)
eSafe	7.0.17.0	Win32.Trojan
ESET NOD32	7.8505	Win32/Sirefef.FB.Gen
Fortinet	5.1.146.0	W32/ZAccInf.B!tr
F-Secure	11.0.19100.45	Virus:W32/ZeroAccess.B
G Data	13.6.22	Trojan.Patched.Sirefef.C
Ikarus	T3.1.4.3.0	Trojan.Patched_c
K7 AntiVirus	9.170.8927	Trojan
K7GW	12.7.0.12	Trojan
Kaspersky	9.0.0.837	Virus.Win32.ZAccess.m
Malwarebytes	1.75.0.1	Rootkit.0Access
McAfee	5.400.1158	ZeroAccess.ds.gen.c
McAfee Gateway Anti-Malware	v2013-dat	ZeroAccess.ds.gen.c
Microsoft Security Essentials	1.9607.0	Virus:Win32/Sirefef.R
eScan by MicroWorld	12.0.250.0	Trojan.Patched.Sirefef.C
Norman	7.01.04	ZAccInf.A
Panda Antivirus	10.0.3.5	W32/SirefefP
PC Tools	9.0.0.2	Trojan.Zeroaccess
Sophos	4.90.0	Troj/ZAccInf-B
Symantec	20131.1.0.101	Trojan.Zeroaccess!inf
The Hacker	None	Trojan/Sirefef.FB.gen
Total Defense	37.0.10487	Win32/Sirefef!patched
Trend Micro	9.740.0.1012	Mal_Siref32
Trend Micro HouseCall	9.700.0.1001	Mal_Siref32
VIPRE Antivirus	19140	Virus.Win32.Sirefef.r (v)
ViRobot	2011.4.7.4223	Win32.ZeroAccess.A

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00090225%	0.028634%
Kernel CPU:	0.00034958%	0.013761%
User CPU:	0.00055267%	0.014873%
Kernel CPU time:	13,619 ms/min	100,923,805ms/min
Memory
Private memory:	3.02 MB	21.59 MB
Private (maximum):	6.46 MB
Private (minimum):	6.42 MB
Non-paged memory:	3.02 MB	21.59 MB
Virtual memory:	39.27 MB	140.96 MB
Virtual memory (peak):	49.41 MB	169.69 MB
Working set:	6.46 MB	18.61 MB
Working set (peak):	7.35 MB	37.95 MB
Resource allocations
Threads:	11	12
Handles:	279	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	C:\Windows\System32\services.exe
Owner:	SYSTEM
Parent process:	wininit.exe (Windows Start-Up Application by Microsoft)

Threads