Services.exe

Discussion in 'ProcessGuard' started by Feivel, Jun 29, 2004.

Thread Status:
Not open for further replies.
  1. Feivel

    Feivel Registered Member

    Joined:
    Nov 7, 2002
    Posts:
    100
    Location:
    Baytown, TX
    Looking over my PG log I found an entry I don't fully understand.

    29 Jun 11:08:03 - [DRIVER/SERVICE] c:\windows\system32\services.exe [688] Tried to install a driver/service named CLPCIID

    To make a long story short, this was prevented and nothing unexpected happened. I understand this is a file from PowerDVD but what I want to know is short of contacting Cyberlink, is this an unecessary service?
     
  2. UNICRON

    UNICRON Technical Expert

    Joined:
    Feb 14, 2002
    Posts:
    1,935
    Location:
    Nanaimo BC Canada
    services.exe. is a NT4/W2K/XP system file that is used for starting, stopping, and interacting with system services. This file is not used by Win9x/Me afaik.

    Services.exe is not a name of any file associated with poweredvd. I too have powerdvd and that file is not on the cd nor is there any file in my poweredvd install directory with that name.

    Because of its sometimes obscure behavior, it has been targeted by trojans like Troj/Legmir-E.

    TDS-3 also has a file named services, but it lives in the TDS-3 directory and has a "wrench" icon.

    HTH
     
  3. Feivel

    Feivel Registered Member

    Joined:
    Nov 7, 2002
    Posts:
    100
    Location:
    Baytown, TX
    Unicron,

    CLPCIID is from PowerDVD not services.exe
     
  4. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Hi Feivel, If this is an isolated log entry and PowerDVD still works as expected then ignore it.
    Services.exe is in the default protection list with the first four Block flags and all Allow flags.

    If needs be you can also give it the Allow driver / service install, this should be quite safe as services.exe will be on your checksum list and you would know if a Trojan had tried to change it.

    Cheers Pilli
     
  5. Feivel

    Feivel Registered Member

    Joined:
    Nov 7, 2002
    Posts:
    100
    Location:
    Baytown, TX
    Everything seems fine with PowerDVD. I guess I will contact Cyberlink and ask them what function does CLPCIID.sys serve. I am glad that PG made me aware of this because after all this is my computer NOT Cyberlinks.
     
  6. Pilli

    Pilli Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    6,217
    Location:
    Hampshire UK
    Yep, It is amazing what you see when Process Guard is running, quite a few surprises. Jason said it was quite often due to sloppy programming when an app will sometimes try to gain access etc. to something which it has no intention what-so-ever to do anything to. :D
     
  7. Feivel

    Feivel Registered Member

    Joined:
    Nov 7, 2002
    Posts:
    100
    Location:
    Baytown, TX
    PG is an awesome program. Then again, all DiamondCS programs are :)

    I fired off an email to Cyberlink. They want me to become a member for technical support. Not gonna happen. I finally found an email address but it was to their PR department. I explained the problem and asked my question. It is now wait and see what they say.If I don't get an answer, PowerDVD is gone and WinDVD is gonna get a test.
     
  8. UNICRON

    UNICRON Technical Expert

    Joined:
    Feb 14, 2002
    Posts:
    1,935
    Location:
    Nanaimo BC Canada
    Ooops I thought you were talking about services.exe. Indeed CLPCIID is from powerDVD.
     
Thread Status:
Not open for further replies.