Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Windows Defender Offline detected services.exe as being infected by Trojan:Win64/Sirefef.Y. The recommended action was to remove it, which is what i chose to do. But it failed, returning the error code 0x800704ec (blocked by a group policy).

Is there a way for me to manually overwrite the services.exe file with a healthy copy using my Windows disk?

share|improve this question

I am not sure if you can do this just with the windows disc, but you can boot something else than just the infected windows install or the windows DVD and overwrite the file.

E.g. a liveCD with Linux, Hiren's bootCD, sysinternals ERD commander, ....
Or even an other computer (just make sure that that one is up to date so it does not get infected).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.