Is SMC service Sygate ?

[eyespy]

Just did an uninstall of Sygate PFW. I usually comb through the registry and delete the leftovers. I came across a couple of entries under the heading :
LEGACY_SMCSERVICE

Isn't this part of Sygate ?
It is a protected reg entry and cannot be deleted !

Anybody else have this issue ?

ty,
bill ???

[FanJ]

Hi,

Have you tried it here:
Sygate forum:
http://forums.sygatetech.com/

[TonyKlein]

Sounds like Sygate:

SmcService = Smc.exe = Sygate

[TonyKlein]

Yup.

I did some further research, and I found that these reg keys do apparently belong to Sygate:

HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SMCSERVICE\0000
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_WG3N\0000

HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SMCSERVICE\0000
HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_WG3N\0000

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SMCSERVICE\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WG3N\0000

[root]

To the best of my knowledge, all those legacy keys are undeletable. I tried deleting some before, but could not.

[eyespy]

-{ Quote: " quoting: root link=board=23;threadid=3793;start=0#25363 date=1032730065]
To the best of my knowledge, all those legacy keys are undeletable. I tried deleting some before, but could not.
" }-

I thought they might be leftovers from Sygate. Why would a person not be able to delete them? And we complain about ZA !! ;D
Their has to be a way to delete them !!
I'll check into the Sygate forums as well !

thanks,
bill :)

[eyespy]

I've just posted this same question over at the Sygate forums. I'll will keep you updated on any fixes !!

bill :)

[FanJ]

A year ago someone else posted the same kind of question at comp.security.firewalls; but he got no reply:

http://groups.google.com/groups?hl=nl&lr=&ie=UTF-8&threadm=3B1F90D0.F813B827%40ntr.net&rnum=1&prev=/groups%3Fq%3D%2522LEGACY_SMCSERVICE%2522%26hl%3Dnl%26lr%3D%26ie%3DUTF-8%26selm%3D3B1F90D0.F813B827%2540ntr.net%26rnum%3D1

Indeed:
-{ Quote: "
I have run the uninstall.
I have run a registry cleaning utility.
I have attempted to manually edit the registry.

But I still have Sygate in my registry - located at the following :

HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SMCSERVICE\0000
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_WG3N\0000

HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SMCSERVICE\0000
HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_WG3N\0000

HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SMCSERVICE\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WG3N\0000


How can I get rid of this?" }-


This site gives:

http://www.igknighttec.com/Windows/WindowsXP/svchost_exe.php

-{ Quote: "What is SVCHOST.EXE?

...snip...

Image name: Smc.exe
PID: 1816
Service: SmcService " }-


This site, while giving info about a Trojan, confirms that smc.exe belongs to Sygate Personal Firewall.

http://www.pspl.com/virus_info/trojans/autoupder.htm

-{ Quote: "Backdoor/Autoupder is a backdoor. This backdoor disguises itself as Coolstuff.cab. This CAB file contains Coolstuff.OCX and Coolstuff.inf files. When the Coolstuff.OCX file is installed on the computer, it checks for existence of some well known firewall softwares.

...snip...

Smc.exe (Sygate Personal Firewall)" }-

[root]

Very interesting. So it seems that Smc.exe is both a windows service file and an executable for Sygate?
I have known instances in the past where Sygate was not doing a complete uninstall on some systems and causing problems such as an incomplete uninstall of ZA does.
I wonder if this has something to do with it.
I noticed, FanJ, that at the very end of that google post, the guy came back and said, "Nevermind.......got rid of 'em".
I'd like to know how he did that. I have never been able to delete anything that said legacy.
I'm guessing that legacy files are holdovers from previous OS versions, but its hard to find much information on them, at least where I looked.
Good information, my friend. ;)

[eyespy]

OK guys and gals,
after a couple of hours searching Google,
I found the solution and it works. Here ya' go, but it's slow loading

http://www.experts-exchange.com/Operating_Systems/Win2000/Q_11198919.html

Also, I got a few answers at the Sygate forums as well.....


http://forums.sygatetech.com/showthread.php?s=9d2fb85738238257d2af412f6e7f0e4f&postid=11102#post11102


And while I was using REGEDT32.EXE, I had to search manually. I couldn't search for keys automatically !!
regards,
bill ;)