I have found reference to "PereSvc" in the registry after running a
"cleaner" in "safe" mode. When I attempt to delete any part of this
entry it point blank refuses to go.
HKEY_Local_Machine>system>Controlset001(+002+Currentcontrolset)>Enum>Root
to find Legal_Peresvc. I used FixVirut & SUPERAntiSpyware. Any & all
help welcome.
TIA

What makes you think that there is a "Bug" in the registry?  This is 
simply a permissions issue, by default only the System account has full 
permission on any of the Enum keys in any of the control sets, other 
users only have "Read" permission.

John

AsK wrote:
> I have found reference to "PereSvc" in the registry after running a
> "cleaner" in "safe" mode. When I attempt to delete any part of this
> entry it point blank refuses to go.
> HKEY_Local_Machine>system>Controlset001(+002+Currentcontrolset)>Enum>Root
> to find Legal_Peresvc. I used FixVirut & SUPERAntiSpyware. Any & all
> help welcome.
> TIA

On Jun 18, 12:28=A0pm, John John - MVP <audetw...@nbnot.nb.ca> wrote:
> What makes you think that there is a "Bug" in the registry? =A0This is
> simply a permissions issue, by default only the System account has full
> permission on any of the Enum keys in any of the control sets, other
> users only have "Read" permission.
>
> John
>
> AsK wrote:
> > I have found reference to "PereSvc" in the registry after running a
> > "cleaner" in "safe" mode. When I attempt to delete any part of this
> > entry it point blank refuses to go.
> > HKEY_Local_Machine>system>Controlset001(+002+Currentcontrolset)>Enum>Ro=
ot
> > to find Legal_Peresvc. I used FixVirut & SUPERAntiSpyware. Any & all
> > help welcome.
> > TIA

PereSvc.exe has been appearing frequently & shows up as a trojan etc.
When I thought I had gotten rid of it, by various methods it
reappears. On looking through the registry I found this line. Nothing
else claims this so I want rid of it. It won't go. Perhaps you could
tell me if "Legal_Peresvc" is a genuine Windows object with
PereSvc.exe masquerading as the genuine article? Thanks for your
reply.

In news:8f0f492c-5973-463f-aa0b-84b30f88204a@c10g2000yqi.googlegroups.com,
AsK <aleckie68@googlemail.com> typed:
> I have found reference to "PereSvc" in the registry after
> running a "cleaner" in "safe" mode. When I attempt to
> delete any part of this entry it point blank refuses to go.
> HKEY_Local_Machine>system>Controlset001(+002+Currentcontrolset)>Enum>Root
> to find Legal_Peresvc. I used FixVirut & SUPERAntiSpyware.
> Any & all help welcome.
> TIA

If you had looked it up on Google, you would have found these hits and many 
more to boot:

http://www.prevx.com/filenames/X66113364402232565-X1/PERESVC.EXE.html

http://www.greatis.com/appdata/d/p/peresvc.exe.htm

Typical excerpt:
 peresvc.exe - Dangerous
--------------------------------------------------------------------------------

peresvc.exe
We suggest you to remove PERESVC.EXE from your computer as soon as possible.
PERESVC.EXE is Trojan/Backdoor.
Kill the process PERESVC.EXE and remove PERESVC.EXE from Windows startup.
Removal: peresvc.exe is removed by RegRun.


Read more... Removal instructions...


Comments:
Bob
The UnHackMe is a real program, no spyware or phish and works great and is 
easy to use. Enjoy!

Sonya

UnHackMe has demonstrated its protective power and gives me great peace of 
mind. Thank you for this excellent program and keep up the superb work!

Chris

I would like to say that RegRun has helped me on more than 1 occasion when 
it comes to spyware/adware by letting me know automatically that a piece of 
it got added to Windows startup. There is so much spyware/addware out there 
today it's hard to imagine being without RegRun. I like many other features 
too including the daily registry backups and file protection.




--------------------------------------------------------------------------------
Constantly updated. Last update: June 12 2010
--------------

I do NOT know or recommend these siites; they're just two of the man 
possibilities in the search. Personally I'd look for removal for it on 
Symantec.com and follow ther instructions.

HTH,

Twayne`

AsK wrote:
> I have found reference to "PereSvc" in the registry after running a
> "cleaner" in "safe" mode. When I attempt to delete any part of this
> entry it point blank refuses to go.
> HKEY_Local_Machine>system>Controlset001(+002+Currentcontrolset)>Enum>Root
> to find Legal_Peresvc. I used FixVirut & SUPERAntiSpyware. Any & all
> help welcome.
> TIA

(In the future, do not use registry cleaners!)

You have malware, and it needs to be properly removed.

From David H. Lipman:

Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe

Then post the contents of the HJT log in your post with a full 
explanation of your problem
and what you have done to date in one of the below expert forums...

{ Please - Do NOT post the HJT Log here ! }

Forums where you can get expert advice for HiJack This! (HJT) Logs.

NOTE: Registration is REQUIRED in any of the below before posting a log

Suggested primary:
http://www.thespykiller.co.uk/index.php?board=3.0

Suggested secondary:
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/index.php?showforum=7

Suggested tertiary:
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://aumha.net/viewforum.php?f=30
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13 

On Jun 19, 4:34=A0pm, "Daave" <da...@example.com> wrote:
> AsK wrote:
> > I have found reference to "PereSvc" in the registry after running a
> > "cleaner" in "safe" mode. When I attempt to delete any part of this
> > entry it point blank refuses to go.
> > HKEY_Local_Machine>system>Controlset001(+002+Currentcontrolset)>Enum>Ro=
ot
> > to find Legal_Peresvc. I used FixVirut & SUPERAntiSpyware. Any & all
> > help welcome.
> > TIA
>
> (In the future, do not use registry cleaners!)
>
> You have malware, and it needs to be properly removed.
>
> From David H. Lipman:
>
> Download and execute HiJack This! (HJT)http://www.trendsecure.com/portal/=
en-US/_download/HJTInstall.exe
>
> Then post the contents of the HJT log in your post with a full
> explanation of your problem
> and what you have done to date in one of the below expert forums...
>
> { Please - Do NOT post the HJT Log here ! }
>
> Forums where you can get expert advice for HiJack This! (HJT) Logs.
>
> NOTE: Registration is REQUIRED in any of the below before posting a log
>
> Suggested primary:http://www.thespykiller.co.uk/index.php?board=3D3.0
>
> Suggested secondary:http://www.bleepingcomputer.com/forums/forum22.htmlht=
tp://www.malwarebytes.org/forums/index.php?showforum=3D7
>
> Suggested tertiary:http://www.dslreports.com/forum/cleanuphttp://www.cybe=
rtechhelp.com/forums/forumdisplay.php?f=3D25http://www.atribune.org/forums/=
index.php?showforum=3D9http://www.geekstogo.com/forum/Malware_Removal_HiJac=
kThis_Logs_Go_Her...http://gladiator-antivirus.com/forum/index.php?showforu=
m=3D170http://forum.networktechs.com/forumdisplay.php?f=3D130http://forums.=
maddoktor2.com/index.php?showforum=3D17http://www.spywarewarrior.com/viewfo=
rum.php?f=3D5http://forums.spywareinfo.com/index.php?showforum=3D18http://f=
orums.techguy.org/f54-s.htmlhttp://forums.tomcoyote.org/index.php?showforum=
=3D27http://forums.subratam.org/index.php?showforum=3D7http://www.5starsupp=
ort.com/ipboard/index.php?showforum=3D18http://aumha.net/viewforum.php?f=3D=
30http://makephpbb.com/phpbb/viewforum.php?f=3D2http://forums.techguy.org/5=
4-security/http://forums.security-central.us/forumdisplay.php?f=3D13

Thanks for the help, all. Much appreciated.
Daave, I have saved the links and will go through them at leisure.
Obliged.

AsK wrote:
> On Jun 19, 4:34 pm, "Daave" <da...@example.com> wrote:
>> AsK wrote:
>>> I have found reference to "PereSvc" in the registry after running a
>>> "cleaner" in "safe" mode. When I attempt to delete any part of this
>>> entry it point blank refuses to go.
>>> HKEY_Local_Machine>system>Controlset001(+002+Currentcontrolset)>Enum>Root
>>> to find Legal_Peresvc. I used FixVirut & SUPERAntiSpyware. Any & all
>>> help welcome.
>>> TIA
>>
>> (In the future, do not use registry cleaners!)
>>
>> You have malware, and it needs to be properly removed.
>>
>> From David H. Lipman:
>>
>> Download and execute HiJack This!
>> (HJT)http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
>>
>> Then post the contents of the HJT log in your post with a full
>> explanation of your problem
>> and what you have done to date in one of the below expert forums...
>>
>> { Please - Do NOT post the HJT Log here ! }
>>
>> Forums where you can get expert advice for HiJack This! (HJT) Logs.
>>
>> NOTE: Registration is REQUIRED in any of the below before posting a
>> log
>>
>> Suggested primary:http://www.thespykiller.co.uk/index.php?board=3.0
>>
>> Suggested
>> secondary:http://www.bleepingcomputer.com/forums/forum22.htmlhttp://www.malwarebytes.org/forums/index.php?showforum=7
>>
>> Suggested
>> tertiary:http://www.dslreports.com/forum/cleanuphttp://www.cybertechhelp.com/forums/forumdisplay.php?f=25http://www.atribune.org/forums/index.php?showforum=9http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Her...http://gladiator-antivirus.com/forum/index.php?showforum=170http://forum.networktechs.com/forumdisplay.php?f=130http://forums.maddoktor2.com/index.php?showforum=17http://www.spywarewarrior.com/viewforum.php?f=5http://forums.spywareinfo.com/index.php?showforum=18http://forums.techguy.org/f54-s.htmlhttp://forums.tomcoyote.org/index.php?showforum=27http://forums.subratam.org/index.php?showforum=7http://www.5starsupport.com/ipboard/index.php?showforum=18http://aumha.net/viewforum.php?f=30http://makephpbb.com/phpbb/viewforum.php?f=2http://forums.techguy.org/54-security/http://forums.security-central.us/forumdisplay.php?f=13
>
> Thanks for the help, all. Much appreciated.
> Daave, I have saved the links and will go through them at leisure.
> Obliged.

YW. Good luck.