Bad Windows 7 service???
While doing a virus cleanup on a clients win 7 x32 laptop (domain environment), I noticed a service that I cannot set to manual (or disabled for that matter) It bugs me because the service looks like a typical malware keyboard mash.... Display name = "ghykva" and Service name = "nrdgzkwb" If I try to set to manual or disabled I get "Access Denied" in normal or safe mode.
This user did get the conficker worm, (I think from charging her IPhone) - which had some shared music on it and I think was uploading the virus when it synced....I uninstalled ITunes and stopped that issue and I was able to remove conficker and some other adware/tracking cookies...and all AV scans show clean now but I still cant seem to change the startup on this service and I am worried it may be malware....
Google research on both the display and service name either shows no results or just some Romanian Prince , or other foreign authors, artists etc....nothing windows or PC releated...
Has anyone seen this service before? know if it is safe ? or not and how to remove/set to manual or disable?