W32.XTC.Worm - Removal

The Services.exe worm program runs as a service. Therefore, you must remove the program from memory before you can delete it.

To remove Services.exe from memory

1. In the registry, search for and delete all references to XTCUpdate.
2. Restart the computer.
3. In the \Windows (Windows 9x) or \WINNT (Windows NT\2000) directory, delete Services.exe.

Note: Be careful not to remove the file c:\winnt\system32\services.exe (a Windows NT system file.)

Technical Details