RE: Anyone know what "piiserviceO" is?

From: Amer Karim (amerk@telus.net)
Date: 09/03/02


From: "Amer Karim" <amerk@telus.net>
To: "H C" <keydet89@yahoo.com>, "Focus on Microsoft Mailing List" <FOCUS-MS@SECURITYFOCUS.COM>
Date: Tue, 3 Sep 2002 11:26:55 -0700

I went through all those steps, and posted only when I could find no info at
all. There was no entry, other than the key name, in the registry key. I
ran fport to see if there were any open ports associated with it, or any
'strange' ports open, and found nothing that wasn't supposed to be there.
The other tools also returned no info on it, which is why I decided to
delete the reg entry associated with to see if it would have an effect on
the system. It didn't, so I was left with what appeared to be an entry in
the 'Run' branch of the registry that apparently didn't do anything. Hence
the post here to see if anyone else had heard of this thing. I've come to
believe it may have something to do with the Palm Software (refer to
previous message) but haven't been able to verify this. Sorry, I should
have given more detail as to what I did before I deleted the reg keys. The
thing that has me flummoxed is that there seems to be no info on this thing,
other than
http://support.earthlink.net/mu/1/psc/img/walkthroughs/other/3Com_palmpilot_
win95/5527.piiservice.gif, and I'm not sure how relevant that would be to a
W2K system.

Thanks for the suggestions, though. If I find anything new, I'll let you
know.

Regards,
Amer Karim
Nautilis Information Systems
e-mail: amerk@telus.net, mamerk@hotmail.com

-----Original Message-----
From: H C [mailto:keydet89@yahoo.com]
Sent: September 3, 2002 10:57
To: Amer Karim; Focus on Microsoft Mailing List
Subject: Re: Anyone know what "piiserviceO" is?

Amer,

> I was just doing some cleaning up on my home system
> (W2K Pro SP3) and I
> noticed this ?piiserviceO? in the processes list. I
> found it in the
> registry under
>
?HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run?,
> but I
> can?t find any info on it either at MSKB or via
> google searches. I?ve
> deleted the key and haven?t noticed any change in
> the systems behaviour, but
> I?d like to know what it is (or was)?

As with other cases like this..."I got rid of it but
now I want to know what it was"...there are a lot more
questions than answers:

1. What was the full entry to the Registry key? Was
there a path to the process image (ie, executable
file)?

2. Did you happen to run pslist.exe, handle.exe,
listdlls.exe (from SysInternals), and fport.exe (from
FoundStone) to gather any information about the
process? Handle.exe and listdlls.exe provide such
information as the process owner, full image path,
command line, and which modules (DLLs) are in use.

3. You mentioned that you searched for a file by that
name, but didn't find anything...how did you conduct
your search? By hand, or by using the Find
capability? Or did you search by the path that you
found in the Registry?

I've recommended the steps in #2 above to the list
before, in order for folks to gather more information
regarding the incident.

If you do end up finding a copy of the file on your
system, I'd greatly appreciate a zipped up copy of it
for review.

HTH,

Carv

__________________________________________________
Do You Yahoo!?
Yahoo! Finance - Get real-time stock quotes
http://finance.yahoo.com



Relevant Pages

  • Re: Registry question
    ... RegMaid.exe Helps Clean Up the Registry ... Microsoft Visual C++, 32-bit Learning Edition, version 6.0 ... RegMaid provides information about entries that are believed to be ... server file entry cannot be found by the system. ...
    (microsoft.public.windowsxp.general)
  • Re: MS Backup
    ... Okay, I had to go to bed too:) Now, no cd is nothing to worry about. ... reason you don't have that entry in your registry is because you don't have ... >> msnewsgroups..on the right, then go to the toolbar, click on view>current ...
    (microsoft.public.windowsxp.basics)
  • Re: Word opens slowly
    ... See http://support.microsoft.com/?kbid=329820 "How to use Office programs with the Norton AntiVirus Office plug-in" for more information. ... I have done three fresh install, scanning first, then defragging, then cleaning the registry before reinstalling Office. ... HKEY_CLASSES_ROOT\word\10.0 Delete the entire 10.0 entry. ...
    (microsoft.public.word.application.errors)
  • Re: C:WINDOWSafitelaguzeyaweb.dll
    ... entry the "right" way:. ... an associated orphaned startup parameter or registry entry ... tool called Autoruns. ...
    (microsoft.public.windowsxp.basics)
  • Re: HP Scanjet 5400cse
    ... Do you have any help on the registry update. ... that I must uninstall again; clean up residual folders, ... Create a new folder on your desktop and name it registry backups, ... select export now navigate to the folder you created and save this entry ...
    (microsoft.public.windowsxp.general)