[jemfree]

I have a Dell Latitude C840 running SP2
I recently flashed my bios
Since then, an obsolete service tries to startup at logon
brsvc01a.exe is a Brother printer service
I no longer have the Brother printer installed and the .exe does not exist, but the service is still listed when I run msconfig
I tried to uncheck it in msconfig but then every time I start up the computer bugs me about it anyway which is more annoying than the original bug
Is there a way to remove all references to the program so it does not try to start up?
I tried CrapCleaner registry issue fixer but it didn't detect it

[Advertisements]

Hi jemfree,
Is the printer listed in printers and Faxes??
If so remove it by right clicking on it and selecting Delete

Is it listed in Add/Remove programs??
If so uninstall the Brother entry there

If you remove it from Add/Remove or Printers, find the Brother folder and delete it as well.

Also go to Start, ControlPanel, Admin Tools
Click on Services
See if any entry for the Brother is there (probably not)
If so Right click on it and select properties
Set it to Disable, apply, then ok

[Linkmaster]

Hi jemfree,
Is the printer listed in printers and Faxes??
If so remove it by right clicking on it and selecting Delete

Is it listed in Add/Remove programs??
If so uninstall the Brother entry there

If you remove it from Add/Remove or Printers, find the Brother folder and delete it as well.

Also go to Start, ControlPanel, Admin Tools
Click on Services
See if any entry for the Brother is there (probably not)
If so Right click on it and select properties
Set it to Disable, apply, then ok

[jemfree]

Thanks, I had already removed the printer and the drivers and the brother folder and it was not in add/remove programs.
I also ran the Brother uninstall tool which also has a spl service remover, but this did not work either.
I took your advice and disabled the service and now it doesn't bug me at startup, BUT...
It still bothers me that it is there on my system.
What do you think about using sc delete from the cmd prompt and deleting the service altogether?

[Fenor]

Hey jemfree!

What is the exact name of the service that you have disabled?

Fenor

Edited by Fenor, 06 October 2005 - 06:55 AM.

[jemfree]

Displayname = BrSplService

[Fenor]

Have you ever used HiJackThis before?

Fenor

[dsenette]

as a last ditch effort you may be able to go into the registry and delete all brother references

[Fenor]

jemfree,

Please go HERE and download HiJackThis. After you have downloaded it, run a system scan and post the log in here.

Fenor

[jemfree]

I'm glad this is generating a bit of interest.

After setting a restore point, I did try to delete the service from the cmd prompt by entering: sc delete Brother XP spl Service
I got an error message: The specified service does not exist as an installed service
Same result using the displayname "BrSplService" instead of the keyname
However, the service still appears under the control panel service tool

I have found numerous dead-end google refs to this issue and no solutions, so it may well be in the too hard basket, but it annoys me that Brother doesn't even acknowledge the problem

I am pretty sure I am clean as excal can attest after a nasty problem a while back I have installed every malware prevention known to man and mouse.

Logfile of HijackThis v1.99.1
Scan saved at 11:29:35 PM, on 6/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Dell\AccessDirect\dadapp.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\PROGRA~1\Security\BILLPS~1\WINPAT~1\winpatrol.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Security\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Security\SpywareGuard\sgmain.exe
C:\Program Files\Security\SpywareGuard\sgbhp.exe
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\dmi\win32\bin\Win32sl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Security\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\Security\SpywareGuard\dlprotect.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\Security\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Security\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\Security\SpywareGuard\sgmain.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Copy Location - C:\WINDOWS\WEB\graburl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {B06300D0-CCDE-11d2-92D3-0000F87A4A55} - C:\WINDOWS\system32\webzone.dll
O9 - Extra 'Tools' menuitem: Add to R&estricted Zone - {B06300D0-CCDE-11d2-92D3-0000F87A4A55} - C:\WINDOWS\system32\webzone.dll
O9 - Extra button: (no name) - {BF80219A-CCDD-11d2-92D3-0000F87A4A55} - C:\WINDOWS\system32\webzone.dll
O9 - Extra 'Tools' menuitem: Add to Tr&usted Zone - {BF80219A-CCDD-11d2-92D3-0000F87A4A55} - C:\WINDOWS\system32\webzone.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Offline - {FC09D8A3-C85A-11d2-92D0-0000F87A4A55} - C:\WINDOWS\system32\oline.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell....iler/SysPro.CAB
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://vpn.children...ca32/wficat.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe
O23 - Service: WinPPPoverEthernet - Unknown owner - C:\Program Files\Verizon Voyager\High Speed Internet Service\WinPoET\WrOS.EXE (file missing)

[Fenor]

I am pretty sure I am clean as excal can attest after a nasty problem a while back I have installed every malware prevention known to man and mouse.

I didn't have you run the HJT scan to look for Malware, rather I wanted to see what was listed to see if anything corresponded to the "BrSplService" Service you say is still listed in the SERVICES windows.

From your log though it appears that it isn't actually there. I suggest you do what dsenette suggested and that is goin into your registry (START-->RUN and type in: regedit) and delete all references to Brother that you find. Just do a FIND for Brother and delete the folders/entries that correspond to it. Also do a search for BrSplService and brsvc01a.exe. OF COURSE BACKUP YOR REGISTRY FIRST BEFORE DOING THIS!

If you have any questions/concerns please post them here.

Fenor

[jemfree]

I took a bit of your combined advice and simply deleted the following entry and subentries;
My Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Brother
After a restart the service no longer appears in the control panel service tool.
I will ignore the other registry entries
Thanks for your help