Author Topic: Help needed with about:blank/ home search - trojan (Read 1959 times)

Gaute · « **on:** October 15, 2004, 09:28:36 AM »

Hello!

Something has happened to my beloved pc. Whenever I go on the
internet I am transferred to a page about:blank - Home search.
I've read something about it - and I thinks it's a trojan. Not quite sure though.

I was wondering if anyone could be so kind and help me get rid of this virus?
I'm not a tech, so I'm kinda lost.

This is my hijack log:

Logfile of HijackThis v1.97.7
Scan saved at 16:31:10, on 15.10.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\NOVELL\ZENRC\wuser32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svohost.exe
C:\WINDOWS\System32\pctspk.exe
C:\Programfiler\D-Tools\daemon.exe
C:\WINDOWS\System32\dpmw32.exe
C:\WINDOWS\System32\NWTRAY.EXE
C:\MOONS\MPROTECT\PMMODE.EXE
C:\Programfiler\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\WINDOWS\system32\ieve32.exe
C:\Programfiler\Messenger\msmsgs.exe
C:\WINDOWS\System32\windll32.exe
C:\Documents and Settings\BRUKER\Programdata\adeu.exe
C:\WINDOWS\msdfmap.ini:yvzld
C:\Programfiler\Internet Explorer\IEXPLORE.EXE
C:\Programfiler\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
F0 - system.ini: Shell=explorer.exe C:\WINDOWS\System32\svohost.exe
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\System32\svohost.exe
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {21EE8B1E-4826-CBD8-177D-882322CDB315} - C:\WINDOWS\appme.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programfiler\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\System32\dpmw32.exe
O4 - HKLM\..\Run: [ZENRC Tray Icon] zentray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [ZPMMode] C:\MOONS\MPROTECT\PMMODE.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [load32] C:\WINDOWS\System32\swchost.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\PROGRA~1\NORTON~1\Cfgwiz.exe /R
O4 - HKLM\..\Run: [ieve32.exe] C:\WINDOWS\system32\ieve32.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [windll32.exe] C:\WINDOWS\System32\windll32.exe
O4 - HKCU\..\Run: [Soae] C:\Documents and Settings\BRUKER\Programdata\adeu.exe
O4 - HKLM\..\RunOnce: [yvzld] C:\WINDOWS\msdfmap.ini:yvzld
O4 - Startup: svchost.exe
O9 - Extra button: MOONS (HKLM)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6...922/wmv9VCM.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{27FF44F9-988C-475B-B1FD-23287C17E7C0}: NameServer = 130.67.15.198
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5CFF8CA-A6B0-425C-B019-871DEA59B464}: NameServer = 130.67.15.198
O17 - HKLM\System\CS1\Services\Tcpip\..\{27FF44F9-988C-475B-B1FD-23287C17E7C0}: NameServer = 130.67.15.198
O17 - HKLM\System\CS2\Services\Tcpip\..\{27FF44F9-988C-475B-B1FD-23287C17E7C0}: NameServer = 130.67.15.198

Any help would be much appreciated!

Best regards from the cold north,

Gaute

guestolo · « **Reply #1 on:** October 15, 2004, 07:45:30 PM »

From the Cold North, I'm assuming from your 017 entries in your log you mean Norway
Actually, could you let me know that info.... I have to make sure that entry is legit

Your hijackthis log is out of date
Could you download the newest version of hijackthis
Open Hijackthis>>>Config>>>Misc Tools>>>Check for updates online
or download from this link
Hijackthis.exe

You look like your infected with WORM_TURTA.A
among other things
This worm may also alter your hosts files
Can you do me a favor
Your hosts file should look like this unless you've added a custom host file

Quote

# Copyright © 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a "#" symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
#
127.0.0.1 localhost

Anything below "127.0.0.1 localhost" may be added by the worm
and/or altered by the hijacker you have

Can you try this---Open Hijackthis>>>Config>>>>Misc Tools>>>Open Hosts File Manager>>>Click on the "Open in Notepad"

Remove any lines below 127.0.0.1 localhost <--don't remove this line

but remove anything you didn't add as a custom host entry
be sure to remove anything that looks similiar to this
127.0.0.1 mast.mcafee.com
These will disable you from accessing any Anti-Virus sites

The next thing you should do
Download the Trial Version of Trojan Hunter
The scanner is good for 30 days
AFTER installation go to This Link
You will have to manually update the latest ruleset for TrojanHunter
Simply save the Latest Ruleset to your desktop and UNZIP it to your Trojan Hunter folder

After this is done
RESTART your Computer in SAFE MODE

Do a Full Scan with Trojan Hunter and let it Fix whatever it finds

RESTART back up into Normal mode

Post back with a Fresh hijackthis log from Hijackthis 1.98.2
in one of your replies
In another reply can you
Download GetServices.zip
UNZIP it to a folder
Double click on the Getservice.bat file to run it. This will create and open a text file named getservice.txt in the same folder.
getservice.txt will list all active Services
Can you post the GetServices.txt in a seperate reply, thanks

These fixes may take a few steps, but you have a few infections

guestolo · « **Reply #2 on:** October 15, 2004, 08:31:34 PM »

I should of said this,
Can you try this---Open Hijackthis>>>Config>>>>Misc Tools>>>Open Hosts File Manager
You can use the delete line(s) button to remove entries in your hosts file, if your unsure

Do this
Open Hijackthis>>>Config>>>>Misc Tools>>>Open Hosts File Manager>>>Click on the "Open in Notepad"
Copy and paste the Whole contents of notepad back here for assistance

Gaute · « **Reply #3 on:** October 16, 2004, 09:42:34 AM »

Hello Guestolo!
Thank you so much for your help and kindness, I'm very grateful for the assistance.

And yes, the cold north is Norway. But I didn't understand what you meant with
the entry not being legit. Is there a problem with my connection? Tell me
if I could do anything to help you.

I ran the Trojan Virus 4.0 and it found 20 entries of infections. It managed to
clean them all. So far - so good. I haven't had any pop-ups or being redirected
to about:blank (home search) yet...

This is my new Hijackthis log:

Logfile of HijackThis v1.98.2
Scan saved at 16:34:13, on 16.10.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\NOVELL\ZENRC\wuser32.exe
C:\WINDOWS\System32\pctspk.exe
C:\Programfiler\D-Tools\daemon.exe
C:\WINDOWS\System32\dpmw32.exe
C:\WINDOWS\System32\NWTRAY.EXE
C:\MOONS\MPROTECT\PMMODE.EXE
C:\WINDOWS\System32\svohost.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Programfiler\Messenger\msmsgs.exe
C:\WINDOWS\System32\windll32.exe
C:\Documents and Settings\BRUKER\Programdata\adeu.exe
C:\Programfiler\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\System32\svohost.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {21EE8B1E-4826-CBD8-177D-882322CDB315} - C:\WINDOWS\appme.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programfiler\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\System32\dpmw32.exe
O4 - HKLM\..\Run: [ZENRC Tray Icon] zentray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [ZPMMode] C:\MOONS\MPROTECT\PMMODE.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\PROGRA~1\NORTON~1\Cfgwiz.exe /R
O4 - HKLM\..\Run: [ieve32.exe] C:\WINDOWS\system32\ieve32.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [THGuard] C:\Programfiler\TrojanHunter 4.0\THGuard.exe
O4 - HKLM\..\Run: [load32] C:\WINDOWS\System32\swchost.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [windll32.exe] C:\WINDOWS\System32\windll32.exe
O4 - HKCU\..\Run: [Soae] C:\Documents and Settings\BRUKER\Programdata\adeu.exe
O4 - Startup: svchost.exe
O9 - Extra button: MOONS - {7CC7BC40-F3C1-11d5-92DC-0050BADF3970} - www.moonscape.com (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{27FF44F9-988C-475B-B1FD-23287C17E7C0}: NameServer = 130.67.15.198
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5CFF8CA-A6B0-425C-B019-871DEA59B464}: NameServer = 130.67.15.198
O17 - HKLM\System\CS1\Services\Tcpip\..\{27FF44F9-988C-475B-B1FD-23287C17E7C0}: NameServer = 130.67.15.198
O17 - HKLM\System\CS2\Services\Tcpip\..\{27FF44F9-988C-475B-B1FD-23287C17E7C0}: NameServer = 130.67.15.198

Hope this looks better

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/unsure.gif\' class=\'bbc_emoticon\' alt=\':unsure:\' />

I'll post both the host file and getservice in another reply as you asked for.

Thank You!

Best regards,
Gaute

Guest · « **Reply #4 on:** October 16, 2004, 09:45:39 AM »

HOST FILE

Here's the host file from Hijackthis.
I didn't see any suspicious files, it was just the same as the example you sent.
So therefore I didn't delete anything.

# Copyright © 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

Best regards,

Gaute

Guest · « **Reply #5 on:** October 16, 2004, 09:49:00 AM »

GETSERVICE FILE

Here is the getservice file from the .bat.
Unfortunately it is in norwegian, I don't know why. Tell me if there is
anything you need to get translated, or a way to get a english version
of the the list.

PsService v1.1 - local and remote services viewer/controller
Copyright © 2001-2003 Mark Russinovich
Sysinternals - www.sysinternals.com

SERVICE_NAME: Alerter
Varsler utvalgte brukere og datamaskiner om administrative varsler. Hvis tjenesten stoppes, får ikke programmer som bruker administrative varsler, disse. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Alerter
   DEPENDENCIES    : LanmanWorkstation
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: ALG
Støtter tredjepartsprotokoll-plugin-moduler for Deling av Internett-tilkobling og Brannmur for Internett-tilkobling
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\alg.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Application Layer Gateway Service
   DEPENDENCIES    :
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: AppMgmt
Tilbyr installasjonstjenester for programvare, som f.eks. Tilordne, Publiser og Fjern.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Application Management
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Ati HotKey Poller
(null)
   TYPE       : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\Ati2evxx.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Ati HotKey Poller
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: AudioSrv
Administrerer lydenheter ofr Windows-baserte programmer. Hvis denne tjenesten stoppes, vil ikke lydenheter og effekter fungere som de skal. Hvis denne tjenesten deaktiveres, vil andre tjenester som er avhengig av den, ikke kunne starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : AudioGroup
   TAG       : 0
   DISPLAY_NAME    : Windows Audio
   DEPENDENCIES    : PlugPlay
          : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: BITS
Bruker inaktiv nettverksbåndbredde til å overføre data.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Background Intelligent Transfer Service
   DEPENDENCIES    : LanmanWorkstation
          : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Browser
Vedlikeholder en oppdatert liste over datamaskiner på nettverket og leverer listen til datamaskiner som er oppnevnt som lesere. Hvis tjenesten stoppes, oppdateres eller vedlikeholdes ikke listen. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Computer Browser
   DEPENDENCIES    : LanmanWorkstation
          : LanmanServer
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: CiSvc
Indekserer innhold og egenskaper til filer på lokale og eksterne datamaskiner, og sørger for rask tilgang til filer med et fleksibelt spørringsspråk.
   TYPE       : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\cisvc.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Indexing Service
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ClipSrv
Utklippsbok kan lagre informasjon og dele den med eksterne datamaskiner. Hvis tjenesten stoppes, kan ikke Utklippsbok dele informasjon med eksterne datamaskiner. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\clipsrv.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : ClipBook
   DEPENDENCIES    : NetDDE
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: COMSysApp
Behandler konfigurasjon og sporing av COM+-baserte komponenter (COM = Component Object Model). Hvis tjenesten stoppes, vil de fleste COM+-komponenter ikke fungere på riktig måte. Hvis tjenesten deaktiveres, vil ingen tjenester som eksplisitt er avhengige av den, starte.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : COM+-systemapplikasjon
   DEPENDENCIES    : rpcss
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 30 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 1000 seconds
          : Restart   DELAY: 5000 seconds
          : None   DELAY: 1000 seconds

SERVICE_NAME: CryptSvc
Inneholder tre administrasjonstjenester: Katalogdatabasetjeneste, som bekrefter signatur av Windows-filer, beskyttet rottjeneste, som legger til og fjerner sertifikater fra godkjente rotsertifiseringsinstanser fra datamaskinen og nøkkeltjeneste, som hjelper deg med å registrere datamaskinen for sertifikater. Hvis tjenesten stoppes, fungerer ikke disse administrasjonstjenestene som de skal. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Cryptographic Services
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Dhcp
Behandler nettverkskonfigurasjon ved registrering og oppdatering av IP-adresser og DNS-navn.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : TDI
   TAG       : 0
   DISPLAY_NAME    : DHCP Client
   DEPENDENCIES    : Tcpip
          : Afd
          : NetBT
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: dmadmin
Konfigurerer harddiskstasjoner og volumer. Tjenesten kjører bare for konfigurasjonsprosesser. Deretter stopper den.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\dmadmin.exe /com
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Logical Disk Manager Administrative Service
   DEPENDENCIES    : RpcSs
          : PlugPlay
          : DmServer
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: dmserver
Oppdager og overvåker nye harddiskstasjoner og sender diskvoluminformasjon til Logical Disk Manager Administrative Service for konfigurasjon. Hvis tjenesten stoppes, kan dynamisk diskstatus og konfigurasjonsinformasjon utdateres. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Logical Disk Manager
   DEPENDENCIES    : RpcSs
          : PlugPlay
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Dnscache
Løser og hurtigbufrer DNS-navn for denne datamaskinen. Hvis tjenesten er stoppet, kan ikke datamaskinen løse DNS-navn og finne Active Directory-domenekontrollere. Hvis tjenesten er deaktivert, kan ikke tjenester som er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k NetworkService
   LOAD_ORDER_GROUP : TDI
   TAG       : 0
   DISPLAY_NAME    : DNS Client
   DEPENDENCIES    : Tcpip
   SERVICE_START_NAME: NT AUTHORITY\NetworkService

SERVICE_NAME: ERSvc
Tillater feilrapportering for tjenester og programmer som kjøres i ikke-standard miljøer.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Error Reporting Service
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Eventlog
Hendelsesloggmeldinger utstedt av Windows-baserte programmer og komponenter kan vises i Hendelsesvisning. Denne tjenesten kan ikke stoppes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\services.exe
   LOAD_ORDER_GROUP : Event log
   TAG       : 0
   DISPLAY_NAME    : Event Log
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: EventSystem
Støtter System Event Notification Service (SENS), som gir automatisk distribusjon av hendelser til COM-komponenter (Component Object Model) som abonnerer. Hvis tjenesten stoppes, vil SENS lukkes og ikke lenger være i stand til å tilby påloggings- og avloggingsvarslinger. Hvis tjenesten deaktiveres, vil ingen tjenester som eksplisitt er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : Network
   TAG       : 0
   DISPLAY_NAME    : COM+-hendelsessystem
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: FastUserSwitchingCompatibility
Tilbyr behandling av programmer som krever hjelp i et flerbrukermiljø.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Fast User Switching Compatibility
   DEPENDENCIES    : TermService
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: helpsvc
Aktiverer Hjelp og støtte på datamaskinen. Hvis denne tjenesten stoppes, er ikke Hjelp og støtte tilgjengelig lenger. Hvis tjenesten deaktiveres, kan ikke noen tjenester som er avhengig av den, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Help and Support
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 100 seconds
          : Restart   DELAY: 100 seconds
          : None   DELAY: 100 seconds

SERVICE_NAME: HidServ
Aktiverer generisk inndatatilgang for HID (Human Interface Devices), som aktiverer og vedlikeholder bruken av forhåndsdefinerte hurtigknapper på tastaturer, eksterne kontroller og andre multimedieenheter. Hvis denne tjenesten stoppes, fungerer ikke hurtigknapper kontrollert av tjenesten, lenger. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 4 DISABLED
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Human Interface Device Access
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ImapiService
Administrerer CD-ROM-brenning gjennom IMAPI-grensesnittet (Image Mastering Applications Programming Interface) Hvis tjenesten stoppes, kan datamaskinen bli ute av stand til å brenne CD-ROMer. Hvis tjenesten deaktiveres, vil tjenester som uttrykkelig avhenger av denne, ikke kunne starte.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\imapi.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : IMAPI CD-Burning COM Service
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: lanmanserver
Støtter deling av filer, utskrift og navngitte datakanaler over nettverket for denne datamaskinen. Hvis tjenesten stoppes, blir disse funksjonene utilgjengelige. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Server
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: lanmanworkstation
Oppretter og vedlikeholder klientens nettverkstilkoblinger til eksterne servere. Hvis tjenesten stoppes, blir tilkoblingene utilgjengelige. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : NetworkProvider
   TAG       : 0
   DISPLAY_NAME    : Workstation
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: LmHosts
Aktiverer støtte for NetBIOS over tjenesten TCP/IP (NetBT) og NetBIOS-navneløsing.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP : TDI
   TAG       : 0
   DISPLAY_NAME    : TCP/IP NetBIOS Helper
   DEPENDENCIES    : NetBT
          : Afd
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: Messenger
Overfører meldinger fra tjenestene Net Send og Alerter mellom klienter og servere. Denne tjenesten er ikke relatert til Windows Messenger. Hvis tjenesten stoppes, overføres ikke meldinger fra Alerter. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Messenger
   DEPENDENCIES    : LanmanWorkstation
          : NetBIOS
          : PlugPlay
          : RpcSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: mnmsrvc
Lar godkjente brukere få ekstern tilgang til Windows-skrivebordet med NetMeeting.
   TYPE       : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\mnmsrvc.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : NetMeeting Remote Desktop Sharing
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: MSDTC
Koordinerer transaksjoner som inkluderer flere ressursbehandlere, for eksempel meldingskøer og filsystemer. Hvis tjenesten stoppes, vil disse transaksjonene ikke finne sted. Hvis tjenesten deaktiveres, vil ingen tjenester som eksplisitt er avhengige av den, starte.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\msdtc.exe
   LOAD_ORDER_GROUP : MS Transactions
   TAG       : 0
   DISPLAY_NAME    : Distributed Transaction Coordinator
   DEPENDENCIES    : RPCSS
          : SamSS
   SERVICE_START_NAME: NT AUTHORITY\NetworkService

SERVICE_NAME: MSIServer
Installerer, reparerer og fjerner programvare i henhold til instruksjoner i MSI-filer.
   TYPE       : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\msiexec.exe /V
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Windows Installer
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: navapsvc
Handles Norton AntiVirus Auto-Protect events.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\Programfiler\Norton AntiVirus\navapsvc.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Norton AntiVirus Auto Protect Service
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NetDDE
Inneholder nettverkstransport og sikkerhet for DDE (Dynamic Data Exchange) for programmer som kjører på samme datamaskin eller andre datamaskiner. Hvis tjenesten stoppes, er ikke DDE-transport og -sikkerhet tilgjengelig. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\netdde.exe
   LOAD_ORDER_GROUP : NetDDEGroup
   TAG       : 0
   DISPLAY_NAME    : Network DDE
   DEPENDENCIES    : NetDDEDSDM
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NetDDEdsdm
Administrerer delte DDE-nettverksressurser (Dynamic Data Exchange). Hvis tjenesten stoppes, er ikke delte DDE-nettverksressurser tilgjengelige. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, starter.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\netdde.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Network DDE DSDM
   DEPENDENCIES    :
          : EGrLocalSystem
          : Network DDE DSDM
          : etwork DDE
          : ntiVirus Auto Protect Service
          : ction Coordinator
          : on
          : ler\FelleZ
          :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Netlogon
Støtter godkjenning av kontopåloggingshendelser for datamaskiner i et domene.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe
   LOAD_ORDER_GROUP : RemoteValidation
   TAG       : 0
   DISPLAY_NAME    : Net Logon
   DEPENDENCIES    : LanmanWorkstation
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Netman
Behandler objekter i nettverket og i mappen Nettverk og eksterne tilkoblinger, hvor du kan vise både lokalnettilkoblinger og eksterne tilkoblinger.
   TYPE       : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Network Connections
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Nla
Samler og lagrer nettverkskonfigurasjon og plasseringsinformasjon, og gir beskjed til programmer når denne informasjonen endres.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Network Location Awareness (NLA)
   DEPENDENCIES    : Tcpip
          : Afd
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Novell WUser Agent
(null)
   TYPE       : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\NOVELL\ZENRC\wuser32.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Remote management
   DEPENDENCIES    :
          : k nLocalSystem
          : Remote management
          : ystem
          : Network Location Awareness (NLA)
          : vice
          : ction Coordinator
          : on
          : ler\FelleZ
          :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NtLmSsp
Tilbyr sikkerhet til eksterne prosedyrekall (RPC)-programmer som bruker andre transporter enn navngitte datakanaler.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : NT LM Security Support Provider
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NtmsSvc
(null)
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Removable Storage
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: O?’ŽrtñåÈ²$Ó
(null)
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\system32\mfcik.exe /s
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Workstation NetLogon Service
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: PlugPlay
En datamaskin kan godkjenne og tilpasse seg maskinvareendringer med liten eller ingen brukerdeltakelse. Hvis tjenesten stoppes eller deaktiveres, blir systemet ustabilt.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\services.exe
   LOAD_ORDER_GROUP : PlugPlay
   TAG       : 0
   DISPLAY_NAME    : Plug and Play
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: PolicyAgent
Behandler IP-sikkerhetspolicy og starter ISAKMP/Oakley (IKE) og IP-sikkerhetsdriveren.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : IPSEC Services
   DEPENDENCIES    : RPCSS
          : Tcpip
          : IPSec
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ProtectedStorage
Tilbyr beskyttet lagring for sensitive data som f.eks. privatnøkler, for å hindre tilgang fra uautoriserte tjenester, prosesser eller brukere.
   TYPE       : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\lsass.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Protected Storage
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RasAuto
Oppretter en tilkobling til et eksternt nettverk når et program refererer et eksternt DNS- eller NetBIOS-navn eller -adresse.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Remote Access Auto Connection Manager
   DEPENDENCIES    : RasMan
          : Tapisrv
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RasMan
Oppretter en nettverkstilkobling.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Remote Access Connection Manager
   DEPENDENCIES    : Tapisrv
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RDSessMgr
Styrer og kontrollerer fjernhjelp. Hvis tjenesten er stoppet, er fjernhjelpen utilgjengelig. Før du stopper tjenesten, bør du se kategorien Avhengigheter i dialogboksen Egenskaper.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\sessmgr.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Remote Desktop Help Session Manager
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RemoteAccess
Tilbyr rutingstjenester til firmaer i lokale nettverksmiljøer og regionnettmiljøer.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 4 DISABLED
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Routing and Remote Access
   DEPENDENCIES    : RpcSS
          : +NetBIOSGroup
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RemoteRegistry
Eksterne brukere kan redigere registerinnstillinger på datamaskinen. Hvis tjenesten stoppes, kan registret bare redigeres av brukere på denne datamaskinen. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Remote Registry
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: NT AUTHORITY\LocalService
   FAIL_RESET_PERIOD : 0 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 1000 seconds

SERVICE_NAME: RpcLocator
Administrerer RCP-navnetjenestedatabasen.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\locator.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Remote Procedure Call (RPC) Locator
   DEPENDENCIES    : LanmanWorkstation
   SERVICE_START_NAME: NT AUTHORITY\NetworkService

SERVICE_NAME: RpcSs
Tilbyr endepunktstilordneren og diverse andre RPC-tjenester.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost -k rpcss
   LOAD_ORDER_GROUP : COM Infrastructure
   TAG       : 0
   DISPLAY_NAME    : Remote Procedure Call (RPC)
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 0 seconds
   FAILURE_ACTIONS    : Reboot   DELAY: 60000 seconds

SERVICE_NAME: RSVP
Tilbyr nettverkssignalisering og lokal trafikkontroll for programmer og kontrollappleter som støtter QoS.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\rsvp.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : QoS RSVP
   DEPENDENCIES    : TcpIp
          : Afd
          : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SamSs
Lagrer sikkerhetsinformasjon for lokale brukerkontoer.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\lsass.exe
   LOAD_ORDER_GROUP : LocalValidation
   TAG       : 0
   DISPLAY_NAME    : Security Accounts Manager
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SCardDrv
Aktiverer støtte for eldre ikke plug-and-play smartkort-lesere som er brukt av denne datamaskinen. Hvis denne tjenesten stoppes, kan ikke denne maskinen støtte den eldre leseren og tjenester som er avhengig av den, vil ikke kunne starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\System32\SCardSvr.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Smart Card Helper
   DEPENDENCIES    : +Smart Card Reader
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: SCardSvr
Administrerer tilgang til smartkortleser ved denne datamaskinen. Hvis tjenesten stoppes, kan ikke denne maskinen lese smartkort. Hvis denne tjenesten er deaktivert, vil ikke tjenester som er avhengig av den kunne starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\System32\SCardSvr.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Smart Card
   DEPENDENCIES    : PlugPlay
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: Schedule
En bruker kan konfigurere og planlegge automatiske oppgaver på datamaskinen. Hvis tjenesten stoppes, kjøres ikke disse oppgavene på faste tidspunkter. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : SchedulerGroup
   TAG       : 0
   DISPLAY_NAME    : Task Scheduler
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: seclogon
Aktiverer startprosesser under alternative legitimasjonsbeskrivelser. Hvis denne tjenesten er stoppet, vil ikke denne typen påloggingstilgang være tilgjengelig. Hvis tjenesten er deaktivert, vil tjenester som er avhengig av den, ikke kunne starte.
   TYPE       : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Secondary Logon
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SENS
Sporer systemhendelser som f.eks. Windows-pålogging, nettverk og strømhendelser. Varsler abonnenter av COM+ Event System om disse hendelsene.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : Network
   TAG       : 0
   DISPLAY_NAME    : System Event Notification
   DEPENDENCIES    : EventSystem
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SharedAccess
Tilbyr nettverksadresseløsing (NAT), adressering, navneløsingstjenester og/eller tjenester til forhindring av inntrenging for hjemmenettverk eller små kontornettverk.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
   DEPENDENCIES    : Netman
          : NLA
          : RasMan
          : ALG
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ShellHWDetection
(null)
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : ShellSvcGroup
   TAG       : 0
   DISPLAY_NAME    : Shell Hardware Detection
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Spooler
Laster inn filer til minnet, for utskrift senere.
   TYPE       : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\spoolsv.exe
   LOAD_ORDER_GROUP : SpoolerGroup
   TAG       : 0
   DISPLAY_NAME    : Print Spooler
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 60000 seconds
          : Restart   DELAY: 60000 seconds
          : None   DELAY: 0 seconds

SERVICE_NAME: srservice
Utfører funksjoner for systemgjenoppretting. Hvis du vil stoppe tjenesten, deaktiverer du Systemgjenoppretting i kategorien Systemgjenoppretting i Min datamaskin->Egenskaper
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : System Restore Service
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SSDPSRV
Aktiverer oppdaging av UPnP-enheter på hjemmenettverket.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : SSDP Discovery Service
   DEPENDENCIES    :
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: stisvc
Utfører bildeinnhentingstjenester for skannere og kameraer.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k imgsvc
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Windows Image Acquisition (WIA)
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SwPrv
Administrerer programvarebaserte skyggekopier som tas av tjenesten Volume Snapshot. Hvis denne tjenesten er stoppet, kan ikke programvarebaserte skyggekopier administreres. Hvis tjenesten er deaktivert, vil alle tjenester som er avhengige av den, heller ikke kunne starte.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\System32\dllhost.exe /Processid:{5F9FD01B-208E-4AD3-A666-7C45512B47B1}
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : MS Software Shadow Copy Provider
   DEPENDENCIES    : rpcss
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SysmonLog
Samler ytelsesdata fra lokale eller eksterne datamaskiner basert på forhåndsdefinerte planparametere, og lagrer deretter dataene i en logg eller viser en advarsel. Hvis tjenesten stoppes, samles ikke ytelsesinformasjon inn. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\smlogsvc.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Performance Logs and Alerts
   DEPENDENCIES    :
   SERVICE_START_NAME: NT Authority\NetworkService

SERVICE_NAME: TapiSrv
Tilbyr støtte for telefoni-API (TAPI) for programmer som kontrollerer telefonienheter og IP-baserte telefonforbindelser på den lokale datamaskinen og - gjennom LAN - på servere som også kjører tjenesten.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Telephony
   DEPENDENCIES    : PlugPlay
          : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: TermService
Tillater at flere brukere er koblet interaktivt til en maskin, så vel som til skjermen som viser skrivebordet og programmer til eksterne datamaskiner. Støtten for eksternt skrivebord (inkludert eksternt skrivebord for administratorer), Fast User Switching, fjernhjelp og Terminal Server.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Terminal Services
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Themes
Tilbyr behandling av temaer for brukeropplevelse
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : UIGroup
   TAG       : 0
   DISPLAY_NAME    : Themes
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 60000 seconds
          : Restart   DELAY: 60000 seconds
          : None   DELAY: 0 seconds

SERVICE_NAME: TlntSvr
Gjør at en ekstern bruker kan logge på denne datamaskinen og kjøre programmer, og støtter forskjellige TCP/IP Telnet-klienter, inkludert UNIX-baserte og Windows-baserte datamaskiner. Hvis denne tjenesten stoppes, kan ekstern brukertilgang til programmer bli utilgjengelig. Hvis denne tjenesten deaktiveres, kommer ikke tjenester som er direkte avhengig av den, til å starte.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 4 DISABLED
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\tlntsvr.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Telnet
   DEPENDENCIES    : RPCSS
          : TCPIP
          : NTLMSSP
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: TrkWks
Opprettholder koblinger mellom NTFS-filer på en datamaskin eller på datamaskiner i et nettverksdomene.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Distributed Link Tracking Client
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: uploadmgr
Behandler synkrone og asynkrone filoverføringer mellom klienter og servere på nettverket. Hvis tjenesten stoppes, foretas ikke synkrone og asynkrone filoverføringer mellom klienter og servere på nettverket. Hvis tjenesten deaktiveres, kan ikke noen tjenester som er avhengig av den, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Upload Manager
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 100 seconds
          : Restart   DELAY: 100 seconds
          : None   DELAY: 100 seconds

SERVICE_NAME: upnphost
Gir mulighet til å støtte den universelle verten for Plug and Play-enheter.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Universal Plug and Play Device Host
   DEPENDENCIES    : SSDPSRV
   SERVICE_START_NAME: NT AUTHORITY\LocalService
   FAIL_RESET_PERIOD : -1 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 0 seconds

SERVICE_NAME: UPS
Administrerer en avbruddsfri strømforsyning (UPS) som er koblet til datamaskinen.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\ups.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Uninterruptible Power Supply
   DEPENDENCIES    :
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: VSS
Administrerer og implementerer skyggekopier for volum som brukes til sikkerhetskopiering og andre formål. Hvis tjenesten stoppes, er ikke skyggekopier tilgjengelig for sikkerhetskopiering, og dermed kan sikkerhetskopieringen mislykkes. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\vssvc.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Volume Shadow Copy
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: W32Time
Opprettholder synkronisering av dato og klokkeslett på alle klienter og servere i nettverket. Hvis denne tjenesten er stoppet, vil synkronisering av dato og klokkslett være utilgjengelig. Hvis denne tjenesten er deaktivert, vil enhver tjenesten som er avhengig av den, ikke kunne starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Windows Time
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WebClient
Windows-baserte programmer kan opprette, få tilgang til og redigere Internett-baserte filer. Hvis tjenesten stoppes, er ikke disse funksjonene tilgjengelige. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP : NetworkProvider
   TAG       : 0
   DISPLAY_NAME    : WebClient
   DEPENDENCIES    : MRxDAV
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: winmgmt
Tilbyr et felles grensesnitt og en objektmodell for å få tilgang til behandlingsinformasjon om operativsystem, enheter, programmer og tjenester. Hvis tjenesten stoppes, vil det meste av den Windows-baserte programvaren ikke fungere skikkelig. Hvis tjenesten deaktiveres, vil tjenester som avhenger av den, ikke kunne starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Windows Management Instrumentation
   DEPENDENCIES    : RPCSS
          : Eventlog
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 60000 seconds
          : Restart   DELAY: 60000 seconds

SERVICE_NAME: WmdmPmSp
Henter serienummeret for den bærbare musikkspilleren som er koblet til datamaskinen
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Portable Media Serial Number
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Wmi
Leverer systemadministrasjonsinformasjon til og fra drivere.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Windows Management Instrumentation Driver Extensions
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WmiApSrv
Inneholder informasjon om ytelsesbibliotek fra WMI HiPerf-leverandører.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\wbem\wmiapsrv.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : WMI Performance Adapter
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: wuauserv
Aktiverer nedlasting og installasjon av viktige Windows-oppdateringer. Hvis tjenesten er deaktivert, kan operativsystemet oppdateres manuelt på Web-området Windows Update.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Automatiske oppdateringer
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WUOLService
(null)
   TYPE       : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\NOVELL\ZENRC\WUOLService.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : WUOLservice
   DEPENDENCIES    : WM
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WZCSVC
Inneholder automatisk konfigurasjon for 802.11-kort
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : TDI
   TAG       : 0
   DISPLAY_NAME    : Wireless Zero Configuration
   DEPENDENCIES    : RpcSs
          : Ndisuio
   SERVICE_START_NAME: LocalSystem

Best regards,

Gaute

guestolo · « **Reply #6 on:** October 16, 2004, 12:41:43 PM »

That looks a little better but your not there yet
Don't worry about the 017 entries right now, sometimes hijackers are found there
I just wanted to see if your ISP was possibly Telenor

Do you still have Nortons' AV installed, is it up to date?
It doesn't appear to be running, if it's outdated we can get a free solution that works great.....
You will want to completely uninstall Nortons' first however

On to the next step

Set Windows to Show Hidden Files and Folders

===Create a New folder on your desktop, call it Aboutbuster
Download to desktop About:Buster
by RubbeR Ducky
Unzip it to that new folder===Run this later

===Download and Install the free version of Ad-Aware
After installation-CHECK FOR UPDATES
We'll run this later, make sure you check for updates now!

===Open Notepad (START>>>RUN>>>type in notepad) hit Enter
Copy the contents of the Quote box to notepad
In Notepad click File>>Save as
Name the file as fix.reg
Change the Save as Type to All Files.
Save this file on the desktop, well need this later, don't run it yet

Quote

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA][-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\O?’ŽrtñåÈ²$Ó]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\O?’ŽrtñåÈ²$Ó]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\O?’ŽrtñåÈ²$Ó]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\O?’ŽrtñåÈ²$Ó]

You may want to print the rest of this out...

RESTART your Computer in SAFE MODE

===Next: Go to START>>>RUN>>>type in services.msc and hit Enter
In the next window, look on the right hand side for this service
name---- Workstation NetLogon Service

Double click on it--- STOP the service--
In the drop down menu, change the startup type to Disabled
from Automatic

==Open Hijackthis>>>Config>>Misc Tools>>>Open Process Manager
Kill these processes if still running
C:\WINDOWS\System32\svohost.exe <--Notice the spelling
C:\WINDOWS\System32\windll32.exe
C:\Documents and Settings\BRUKER\Programdata\adeu.exe

===Stay in safe mode and navigate to these files or folders and delete them if they exist
C:\WINDOWS\system32\ieve32.exe <--this file
C:\WINDOWS\System32\windll32.exe <-- file
C:\WINDOWS\msdfmap.ini <--file
C:\WINDOWS\system32\mfcik.exe <--file
C:\Documents and Settings\BRUKER\Programdata\adeu.exe <--file
C:\WINDOWS\System32\swchost.exe <--file
C:\WINDOWS\System32\svohost.exe <--file
C:\WINDOWS\svchost.exe <--this file in this directory if it exists

One Note: DO NOT try and delete svchost.exe in this directory
C:\WINDOWS\System32 folder, svchost.exe in the system32 folder is legitimate
Careful with the spelling on the files I asked you to delete above

===In safe mode
Do another Scan with Hijackthis and put a check next to these entries
and then FIX CHECKED when ALL other windows are closed

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\tidqx.dll/sp.html#29126

R3 - Default URLSearchHook is missing

F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\System32\svohost.exe

O2 - BHO: (no name) - {21EE8B1E-4826-CBD8-177D-882322CDB315} - C:\WINDOWS\appme.dll (file missing)

O4 - HKLM\..\Run: [ieve32.exe] C:\WINDOWS\system32\ieve32.exe

O4 - HKLM\..\Run: [load32] C:\WINDOWS\System32\swchost.exe

O4 - HKCU\..\Run: [windll32.exe] C:\WINDOWS\System32\windll32.exe
O4 - HKCU\..\Run: [Soae] C:\Documents and Settings\BRUKER\Programdata\adeu.exe
O4 - Startup: svchost.exe
O9 - Extra button: MOONS - {7CC7BC40-F3C1-11d5-92DC-0050BADF3970} - www.moonscape.com (file missing)

After you have FIX CHECKED and closed Hijackthis

Navigate to About:buster you unzipped earlier
===Start About:Buster and hit ok. Now for the scanning part. Hit Start and then Ok. The program should start scanning.Scan a Second time. Then hit exit

===Do a DiskCleanup>>START----Run---type in cleanmgr
Ensure that Temp and Temporary Internet Files are checked

===Double click on reg.fix that you saved earlier to desktop
and Allow it to merge to the Registry

===RESTART back in Normal mode
Do another Scan with About:buster
Open Ad-Aware and do a Full System Scan (ensure you checked for updates beforehand)
---Remove all Critical Objects
RESTART your computer again to finish the cleaning process

Download the The Hoster
Unzip it to a folder, Open it, Press "Restore Original Hosts" and press "OK". Exit Program. Note: if you were using a custom Hosts file you will need to replace any of those entries yourself---You don't appear to have a custom host file, I just want you to do this to be on the safe side

Could you do an Online virus scan at Housecall's
Set to Autoclean
http://housecall.trendmicro.com/
or at Panda's or do both
http://www.pandasoftware.com/activescan/co...n_principal.htm

When your all done can you post back a Fresh hijackthis log and also post the About:buster logs, thanks

Gaute · « **Reply #7 on:** October 16, 2004, 05:06:20 PM »

- Hi again Guestolo!
I must say it's admirable how much you help people on this forum.
And I would never have had the chance to fix my pc without your help.
Thank You!

- Yes - my ADSL provider is Telenor.

- I don't have Nortons' AV installed, because it made a lot of trouble with
my files. I tried to uninstall, but it's probably something left. (I didn't know...)
Would love another solution if you have a suggestion.

- These were the only files I found and deleted:
C:\WINDOWS\System32\windll32.exe <-- file
C:\WINDOWS\msdfmap.ini <--file
C:\Documents and Settings\BRUKER\Programdata\adeu.exe <--file

- And on this subject:
(===Next: Go to START>>>RUN>>>type in services.msc and hit Enter
In the next window, look on the right hand side for this service
name---- Workstation NetLogon Service)

- I disabled the Workstation - not the file called Net Logon... was that right?

- The TrendMicro virusscan showed 7 infected files which were deleted.

- Here are the Aboutbuster logs:

Scanned at: 22:25:17 on: 16.10.2004

-- Scan 1 ---------------------------
About:Buster Version 3.0
Reference List : 15

No ADS found on system
Removed 1 Random Key Entries
Deleted 1 Service Keys Successfully!
Attempted Clean Of Temp folder.
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 3.0
Reference List : 15

No ADS found on system
Removed 1 Random Key Entries
Attempted Clean Of Temp folder.
Pages Reset... Done!

Scanned at: 23:01:50 on: 16.10.2004

-- Scan 1 ---------------------------
About:Buster Version 3.0
Reference List : 15

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset... Done!

-- Scan 2 ---------------------------
About:Buster Version 3.0
Reference List : 15

No ADS found on system
Attempted Clean Of Temp folder.
Pages Reset... Done!

- HIJACKTHIS log:

Logfile of HijackThis v1.98.2
Scan saved at 23:55:57, on 16.10.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\NOVELL\ZENRC\wuser32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\pctspk.exe
C:\Programfiler\D-Tools\daemon.exe
C:\WINDOWS\System32\dpmw32.exe
C:\WINDOWS\System32\NWTRAY.EXE
C:\MOONS\MPROTECT\PMMODE.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Programfiler\Messenger\msmsgs.exe
C:\Programfiler\Microsoft Office\Office\WINWORD.EXE
C:\Programfiler\Internet Explorer\iexplore.exe
C:\Programfiler\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programfiler\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\System32\dpmw32.exe
O4 - HKLM\..\Run: [ZENRC Tray Icon] zentray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [ZPMMode] C:\MOONS\MPROTECT\PMMODE.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [NAV CfgWiz] C:\PROGRA~1\NORTON~1\Cfgwiz.exe /R
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [THGuard] C:\Programfiler\TrojanHunter 4.0\THGuard.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\MSMSGS.EXE
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{27FF44F9-988C-475B-B1FD-23287C17E7C0}: NameServer = 130.67.15.198
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5CFF8CA-A6B0-425C-B019-871DEA59B464}: NameServer = 130.67.15.198
O17 - HKLM\System\CS1\Services\Tcpip\..\{27FF44F9-988C-475B-B1FD-23287C17E7C0}: NameServer = 130.67.15.198
O17 - HKLM\System\CS2\Services\Tcpip\..\{27FF44F9-988C-475B-B1FD-23287C17E7C0}: NameServer = 130.67.15.198

Again thanks for your help Guestsolo!

Best regards,
Gaute

guestolo · « **Reply #8 on:** October 16, 2004, 06:35:17 PM »

Hi again Gaute, as you can see by the GetServices.txt file there was a nasty service name called Workstation Netlogon Service
About:buster may of taken care of it

SERVICE_NAME: O?’ŽrtñåÈ²$Ó
(null)
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 0 IGNORE
BINARY_PATH_NAME : C:\WINDOWS\system32\mfcik.exe /s
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Workstation NetLogon Service
DEPENDENCIES :
SERVICE_START_NAME: LocalSystem

Let's make sure that service is gone
Can you do me a favor and go back to Services.msc
The service name called Workstation can you reset that back to Automatic
Leave Netlogon alone, it may be set at manual

While your there, can you Stop the services of the next 2 and set them to disabled
Messenger This is not msn messenger
and also Alerter

Before we get you to install any AV let's make sure that you have Norton's completely uninstalled
Go to Norton's site and follow the instructions carefully how to uninstall
I'm not sure what version of Norton's AV you had
This is complete instruction for
Nortons 2004

Also, let's make sure that your log is totally clean
You seem to be controlling startup entries with Msconfig
Not that there's anything wrong with that but you may be hiding some malicious activity unknowingly
Can you please go to START>>>RUN>>>Type in msconfig and then hit Enter
In the Next Window could you do a Normal Startup and restart your computer when prompted

Post back with a Fresh hijackthis log after Restart
Could you also delete your old Getservices.txt and produce a new one and post it too,thanks

One other thing, This hijacker likes to delete copies of shell.dll in the
C:\WINDOWS\System32 folder, can you take a look for it, if it's not there you will want to replace it.. I have links for the English Version of XP, yours may be different
Let me know if you find it---Don't get it confused with shell32.dll

guestolo · « **Reply #9 on:** October 16, 2004, 06:50:20 PM »

Can you also look for a copy of shell.dll in your
C:\WINDOWS\SYSTEM folder

Gaute · « **Reply #10 on:** October 17, 2004, 04:59:14 AM »

Good morning Guestolo!
For me as a green guy when it comes to computers, you make me feel like
I know what to do

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/wink.gif\' class=\'bbc_emoticon\' alt=\'

\' /> But seriously, I've learnt a whole lot. Thanks.

- Messenger and Alerter are disabled.

- I also managed to completely uninstall Norton Internet Security 2003.

- The shell.dll was found in the C:\W..\SYSTEM folder,
There was no sign of it in C:\WINDOWS\System32 folder (only the shell32.dll)

- The fresh HIJACKTHIS log:
Logfile of HijackThis v1.98.2
Scan saved at 11:40:32, on 17.10.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\NOVELL\ZENRC\wuser32.exe
C:\WINDOWS\System32\pctspk.exe
C:\Programfiler\D-Tools\daemon.exe
C:\WINDOWS\System32\dpmw32.exe
C:\WINDOWS\System32\NWTRAY.EXE
C:\MOONS\MPROTECT\PMMODE.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Programfiler\Messenger\msmsgs.exe
C:\Programfiler\Microsoft Office\Office\WINWORD.EXE
C:\Programfiler\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programfiler\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\System32\dpmw32.exe
O4 - HKLM\..\Run: [ZENRC Tray Icon] zentray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [ZPMMode] C:\MOONS\MPROTECT\PMMODE.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [THGuard] C:\Programfiler\TrojanHunter 4.0\THGuard.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\MSMSGS.EXE
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{27FF44F9-988C-475B-B1FD-23287C17E7C0}: NameServer = 130.67.15.198
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5CFF8CA-A6B0-425C-B019-871DEA59B464}: NameServer = 130.67.15.198
O17 - HKLM\System\CS1\Services\Tcpip\..\{27FF44F9-988C-475B-B1FD-23287C17E7C0}: NameServer = 130.67.15.198
O17 - HKLM\System\CS2\Services\Tcpip\..\{27FF44F9-988C-475B-B1FD-23287C17E7C0}: NameServer = 130.67.15.198

The new GETSERVICES.txt

PsService v1.1 - local and remote services viewer/controller
Copyright © 2001-2003 Mark Russinovich
Sysinternals - www.sysinternals.com

SERVICE_NAME: Alerter
Varsler utvalgte brukere og datamaskiner om administrative varsler. Hvis tjenesten stoppes, får ikke programmer som bruker administrative varsler, disse. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 4 DISABLED
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Alerter
   DEPENDENCIES    : LanmanWorkstation
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: ALG
Støtter tredjepartsprotokoll-plugin-moduler for Deling av Internett-tilkobling og Brannmur for Internett-tilkobling
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\alg.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Application Layer Gateway Service
   DEPENDENCIES    :
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: AppMgmt
Tilbyr installasjonstjenester for programvare, som f.eks. Tilordne, Publiser og Fjern.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Application Management
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Ati HotKey Poller
(null)
   TYPE       : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\Ati2evxx.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Ati HotKey Poller
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: AudioSrv
Administrerer lydenheter ofr Windows-baserte programmer. Hvis denne tjenesten stoppes, vil ikke lydenheter og effekter fungere som de skal. Hvis denne tjenesten deaktiveres, vil andre tjenester som er avhengig av den, ikke kunne starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : AudioGroup
   TAG       : 0
   DISPLAY_NAME    : Windows Audio
   DEPENDENCIES    : PlugPlay
          : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: BITS
Bruker inaktiv nettverksbåndbredde til å overføre data.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Background Intelligent Transfer Service
   DEPENDENCIES    : LanmanWorkstation
          : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Browser
Vedlikeholder en oppdatert liste over datamaskiner på nettverket og leverer listen til datamaskiner som er oppnevnt som lesere. Hvis tjenesten stoppes, oppdateres eller vedlikeholdes ikke listen. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Computer Browser
   DEPENDENCIES    : LanmanWorkstation
          : LanmanServer
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: CiSvc
Indekserer innhold og egenskaper til filer på lokale og eksterne datamaskiner, og sørger for rask tilgang til filer med et fleksibelt spørringsspråk.
   TYPE       : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\cisvc.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Indexing Service
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ClipSrv
Utklippsbok kan lagre informasjon og dele den med eksterne datamaskiner. Hvis tjenesten stoppes, kan ikke Utklippsbok dele informasjon med eksterne datamaskiner. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\clipsrv.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : ClipBook
   DEPENDENCIES    : NetDDE
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: COMSysApp
Behandler konfigurasjon og sporing av COM+-baserte komponenter (COM = Component Object Model). Hvis tjenesten stoppes, vil de fleste COM+-komponenter ikke fungere på riktig måte. Hvis tjenesten deaktiveres, vil ingen tjenester som eksplisitt er avhengige av den, starte.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : COM+-systemapplikasjon
   DEPENDENCIES    : rpcss
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 30 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 1000 seconds
          : Restart   DELAY: 5000 seconds
          : None   DELAY: 1000 seconds

SERVICE_NAME: CryptSvc
Inneholder tre administrasjonstjenester: Katalogdatabasetjeneste, som bekrefter signatur av Windows-filer, beskyttet rottjeneste, som legger til og fjerner sertifikater fra godkjente rotsertifiseringsinstanser fra datamaskinen og nøkkeltjeneste, som hjelper deg med å registrere datamaskinen for sertifikater. Hvis tjenesten stoppes, fungerer ikke disse administrasjonstjenestene som de skal. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Cryptographic Services
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Dhcp
Behandler nettverkskonfigurasjon ved registrering og oppdatering av IP-adresser og DNS-navn.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : TDI
   TAG       : 0
   DISPLAY_NAME    : DHCP Client
   DEPENDENCIES    : Tcpip
          : Afd
          : NetBT
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: dmadmin
Konfigurerer harddiskstasjoner og volumer. Tjenesten kjører bare for konfigurasjonsprosesser. Deretter stopper den.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\dmadmin.exe /com
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Logical Disk Manager Administrative Service
   DEPENDENCIES    : RpcSs
          : PlugPlay
          : DmServer
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: dmserver
Oppdager og overvåker nye harddiskstasjoner og sender diskvoluminformasjon til Logical Disk Manager Administrative Service for konfigurasjon. Hvis tjenesten stoppes, kan dynamisk diskstatus og konfigurasjonsinformasjon utdateres. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Logical Disk Manager
   DEPENDENCIES    : RpcSs
          : PlugPlay
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Dnscache
Løser og hurtigbufrer DNS-navn for denne datamaskinen. Hvis tjenesten er stoppet, kan ikke datamaskinen løse DNS-navn og finne Active Directory-domenekontrollere. Hvis tjenesten er deaktivert, kan ikke tjenester som er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k NetworkService
   LOAD_ORDER_GROUP : TDI
   TAG       : 0
   DISPLAY_NAME    : DNS Client
   DEPENDENCIES    : Tcpip
   SERVICE_START_NAME: NT AUTHORITY\NetworkService

SERVICE_NAME: ERSvc
Tillater feilrapportering for tjenester og programmer som kjøres i ikke-standard miljøer.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Error Reporting Service
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Eventlog
Hendelsesloggmeldinger utstedt av Windows-baserte programmer og komponenter kan vises i Hendelsesvisning. Denne tjenesten kan ikke stoppes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\services.exe
   LOAD_ORDER_GROUP : Event log
   TAG       : 0
   DISPLAY_NAME    : Event Log
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: EventSystem
Støtter System Event Notification Service (SENS), som gir automatisk distribusjon av hendelser til COM-komponenter (Component Object Model) som abonnerer. Hvis tjenesten stoppes, vil SENS lukkes og ikke lenger være i stand til å tilby påloggings- og avloggingsvarslinger. Hvis tjenesten deaktiveres, vil ingen tjenester som eksplisitt er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : Network
   TAG       : 0
   DISPLAY_NAME    : COM+-hendelsessystem
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: FastUserSwitchingCompatibility
Tilbyr behandling av programmer som krever hjelp i et flerbrukermiljø.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Fast User Switching Compatibility
   DEPENDENCIES    : TermService
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: helpsvc
Aktiverer Hjelp og støtte på datamaskinen. Hvis denne tjenesten stoppes, er ikke Hjelp og støtte tilgjengelig lenger. Hvis tjenesten deaktiveres, kan ikke noen tjenester som er avhengig av den, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Help and Support
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 100 seconds
          : Restart   DELAY: 100 seconds
          : None   DELAY: 100 seconds

SERVICE_NAME: HidServ
Aktiverer generisk inndatatilgang for HID (Human Interface Devices), som aktiverer og vedlikeholder bruken av forhåndsdefinerte hurtigknapper på tastaturer, eksterne kontroller og andre multimedieenheter. Hvis denne tjenesten stoppes, fungerer ikke hurtigknapper kontrollert av tjenesten, lenger. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 4 DISABLED
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Human Interface Device Access
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ImapiService
Administrerer CD-ROM-brenning gjennom IMAPI-grensesnittet (Image Mastering Applications Programming Interface) Hvis tjenesten stoppes, kan datamaskinen bli ute av stand til å brenne CD-ROMer. Hvis tjenesten deaktiveres, vil tjenester som uttrykkelig avhenger av denne, ikke kunne starte.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\imapi.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : IMAPI CD-Burning COM Service
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: lanmanserver
Støtter deling av filer, utskrift og navngitte datakanaler over nettverket for denne datamaskinen. Hvis tjenesten stoppes, blir disse funksjonene utilgjengelige. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Server
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: lanmanworkstation
Oppretter og vedlikeholder klientens nettverkstilkoblinger til eksterne servere. Hvis tjenesten stoppes, blir tilkoblingene utilgjengelige. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : NetworkProvider
   TAG       : 0
   DISPLAY_NAME    : Workstation
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: LmHosts
Aktiverer støtte for NetBIOS over tjenesten TCP/IP (NetBT) og NetBIOS-navneløsing.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP : TDI
   TAG       : 0
   DISPLAY_NAME    : TCP/IP NetBIOS Helper
   DEPENDENCIES    : NetBT
          : Afd
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: Messenger
Overfører meldinger fra tjenestene Net Send og Alerter mellom klienter og servere. Denne tjenesten er ikke relatert til Windows Messenger. Hvis tjenesten stoppes, overføres ikke meldinger fra Alerter. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengige av den, starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 4 DISABLED
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Messenger
   DEPENDENCIES    : LanmanWorkstation
          : NetBIOS
          : PlugPlay
          : RpcSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: mnmsrvc
Lar godkjente brukere få ekstern tilgang til Windows-skrivebordet med NetMeeting.
   TYPE       : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\mnmsrvc.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : NetMeeting Remote Desktop Sharing
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: MSDTC
Koordinerer transaksjoner som inkluderer flere ressursbehandlere, for eksempel meldingskøer og filsystemer. Hvis tjenesten stoppes, vil disse transaksjonene ikke finne sted. Hvis tjenesten deaktiveres, vil ingen tjenester som eksplisitt er avhengige av den, starte.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\msdtc.exe
   LOAD_ORDER_GROUP : MS Transactions
   TAG       : 0
   DISPLAY_NAME    : Distributed Transaction Coordinator
   DEPENDENCIES    : RPCSS
          : SamSS
   SERVICE_START_NAME: NT AUTHORITY\NetworkService

SERVICE_NAME: MSIServer
Installerer, reparerer og fjerner programvare i henhold til instruksjoner i MSI-filer.
   TYPE       : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\msiexec.exe /V
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Windows Installer
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NetDDE
Inneholder nettverkstransport og sikkerhet for DDE (Dynamic Data Exchange) for programmer som kjører på samme datamaskin eller andre datamaskiner. Hvis tjenesten stoppes, er ikke DDE-transport og -sikkerhet tilgjengelig. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\netdde.exe
   LOAD_ORDER_GROUP : NetDDEGroup
   TAG       : 0
   DISPLAY_NAME    : Network DDE
   DEPENDENCIES    : NetDDEDSDM
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NetDDEdsdm
Administrerer delte DDE-nettverksressurser (Dynamic Data Exchange). Hvis tjenesten stoppes, er ikke delte DDE-nettverksressurser tilgjengelige. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, starter.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\netdde.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Network DDE DSDM
   DEPENDENCIES    :
          : EGrLocalSystem
          : Network DDE DSDM
          : etwork DDE
          : workService
          : Distributed Transaction Coordinator
          : on
          : ler\FelleZ
          :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Netlogon
Støtter godkjenning av kontopåloggingshendelser for datamaskiner i et domene.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe
   LOAD_ORDER_GROUP : RemoteValidation
   TAG       : 0
   DISPLAY_NAME    : Net Logon
   DEPENDENCIES    : LanmanWorkstation
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Netman
Behandler objekter i nettverket og i mappen Nettverk og eksterne tilkoblinger, hvor du kan vise både lokalnettilkoblinger og eksterne tilkoblinger.
   TYPE       : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Network Connections
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Nla
Samler og lagrer nettverkskonfigurasjon og plasseringsinformasjon, og gir beskjed til programmer når denne informasjonen endres.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Network Location Awareness (NLA)
   DEPENDENCIES    : Tcpip
          : Afd
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Novell WUser Agent
(null)
   TYPE       : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\NOVELL\ZENRC\wuser32.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Remote management
   DEPENDENCIES    :
          : k nLocalSystem
          : Remote management
          : ystem
          : Network Location Awareness (NLA)
          : ransaction Coordinator
          : on
          : ler\FelleZ
          :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NtLmSsp
Tilbyr sikkerhet til eksterne prosedyrekall (RPC)-programmer som bruker andre transporter enn navngitte datakanaler.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : NT LM Security Support Provider
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NtmsSvc
(null)
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Removable Storage
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: PlugPlay
En datamaskin kan godkjenne og tilpasse seg maskinvareendringer med liten eller ingen brukerdeltakelse. Hvis tjenesten stoppes eller deaktiveres, blir systemet ustabilt.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\services.exe
   LOAD_ORDER_GROUP : PlugPlay
   TAG       : 0
   DISPLAY_NAME    : Plug and Play
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: PolicyAgent
Behandler IP-sikkerhetspolicy og starter ISAKMP/Oakley (IKE) og IP-sikkerhetsdriveren.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\lsass.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : IPSEC Services
   DEPENDENCIES    : RPCSS
          : Tcpip
          : IPSec
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ProtectedStorage
Tilbyr beskyttet lagring for sensitive data som f.eks. privatnøkler, for å hindre tilgang fra uautoriserte tjenester, prosesser eller brukere.
   TYPE       : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\lsass.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Protected Storage
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RasAuto
Oppretter en tilkobling til et eksternt nettverk når et program refererer et eksternt DNS- eller NetBIOS-navn eller -adresse.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Remote Access Auto Connection Manager
   DEPENDENCIES    : RasMan
          : Tapisrv
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RasMan
Oppretter en nettverkstilkobling.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Remote Access Connection Manager
   DEPENDENCIES    : Tapisrv
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RDSessMgr
Styrer og kontrollerer fjernhjelp. Hvis tjenesten er stoppet, er fjernhjelpen utilgjengelig. Før du stopper tjenesten, bør du se kategorien Avhengigheter i dialogboksen Egenskaper.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\sessmgr.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Remote Desktop Help Session Manager
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RemoteAccess
Tilbyr rutingstjenester til firmaer i lokale nettverksmiljøer og regionnettmiljøer.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 4 DISABLED
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Routing and Remote Access
   DEPENDENCIES    : RpcSS
          : +NetBIOSGroup
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RemoteRegistry
Eksterne brukere kan redigere registerinnstillinger på datamaskinen. Hvis tjenesten stoppes, kan registret bare redigeres av brukere på denne datamaskinen. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Remote Registry
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: NT AUTHORITY\LocalService
   FAIL_RESET_PERIOD : 0 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 1000 seconds

SERVICE_NAME: RpcLocator
Administrerer RCP-navnetjenestedatabasen.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\locator.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Remote Procedure Call (RPC) Locator
   DEPENDENCIES    : LanmanWorkstation
   SERVICE_START_NAME: NT AUTHORITY\NetworkService

SERVICE_NAME: RpcSs
Tilbyr endepunktstilordneren og diverse andre RPC-tjenester.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost -k rpcss
   LOAD_ORDER_GROUP : COM Infrastructure
   TAG       : 0
   DISPLAY_NAME    : Remote Procedure Call (RPC)
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 0 seconds
   FAILURE_ACTIONS    : Reboot   DELAY: 60000 seconds

SERVICE_NAME: RSVP
Tilbyr nettverkssignalisering og lokal trafikkontroll for programmer og kontrollappleter som støtter QoS.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\rsvp.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : QoS RSVP
   DEPENDENCIES    : TcpIp
          : Afd
          : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SamSs
Lagrer sikkerhetsinformasjon for lokale brukerkontoer.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\lsass.exe
   LOAD_ORDER_GROUP : LocalValidation
   TAG       : 0
   DISPLAY_NAME    : Security Accounts Manager
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SCardDrv
Aktiverer støtte for eldre ikke plug-and-play smartkort-lesere som er brukt av denne datamaskinen. Hvis denne tjenesten stoppes, kan ikke denne maskinen støtte den eldre leseren og tjenester som er avhengig av den, vil ikke kunne starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\System32\SCardSvr.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Smart Card Helper
   DEPENDENCIES    : +Smart Card Reader
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: SCardSvr
Administrerer tilgang til smartkortleser ved denne datamaskinen. Hvis tjenesten stoppes, kan ikke denne maskinen lese smartkort. Hvis denne tjenesten er deaktivert, vil ikke tjenester som er avhengig av den kunne starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\System32\SCardSvr.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Smart Card
   DEPENDENCIES    : PlugPlay
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: Schedule
En bruker kan konfigurere og planlegge automatiske oppgaver på datamaskinen. Hvis tjenesten stoppes, kjøres ikke disse oppgavene på faste tidspunkter. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : SchedulerGroup
   TAG       : 0
   DISPLAY_NAME    : Task Scheduler
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: seclogon
Aktiverer startprosesser under alternative legitimasjonsbeskrivelser. Hvis denne tjenesten er stoppet, vil ikke denne typen påloggingstilgang være tilgjengelig. Hvis tjenesten er deaktivert, vil tjenester som er avhengig av den, ikke kunne starte.
   TYPE       : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Secondary Logon
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SENS
Sporer systemhendelser som f.eks. Windows-pålogging, nettverk og strømhendelser. Varsler abonnenter av COM+ Event System om disse hendelsene.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : Network
   TAG       : 0
   DISPLAY_NAME    : System Event Notification
   DEPENDENCIES    : EventSystem
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SharedAccess
Tilbyr nettverksadresseløsing (NAT), adressering, navneløsingstjenester og/eller tjenester til forhindring av inntrenging for hjemmenettverk eller små kontornettverk.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
   DEPENDENCIES    : Netman
          : NLA
          : RasMan
          : ALG
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ShellHWDetection
(null)
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : ShellSvcGroup
   TAG       : 0
   DISPLAY_NAME    : Shell Hardware Detection
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Spooler
Laster inn filer til minnet, for utskrift senere.
   TYPE       : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\spoolsv.exe
   LOAD_ORDER_GROUP : SpoolerGroup
   TAG       : 0
   DISPLAY_NAME    : Print Spooler
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 60000 seconds
          : Restart   DELAY: 60000 seconds
          : None   DELAY: 0 seconds

SERVICE_NAME: srservice
Utfører funksjoner for systemgjenoppretting. Hvis du vil stoppe tjenesten, deaktiverer du Systemgjenoppretting i kategorien Systemgjenoppretting i Min datamaskin->Egenskaper
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : System Restore Service
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SSDPSRV
Aktiverer oppdaging av UPnP-enheter på hjemmenettverket.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : SSDP Discovery Service
   DEPENDENCIES    :
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: stisvc
Utfører bildeinnhentingstjenester for skannere og kameraer.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k imgsvc
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Windows Image Acquisition (WIA)
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SwPrv
Administrerer programvarebaserte skyggekopier som tas av tjenesten Volume Snapshot. Hvis denne tjenesten er stoppet, kan ikke programvarebaserte skyggekopier administreres. Hvis tjenesten er deaktivert, vil alle tjenester som er avhengige av den, heller ikke kunne starte.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\System32\dllhost.exe /Processid:{5F9FD01B-208E-4AD3-A666-7C45512B47B1}
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : MS Software Shadow Copy Provider
   DEPENDENCIES    : rpcss
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SysmonLog
Samler ytelsesdata fra lokale eller eksterne datamaskiner basert på forhåndsdefinerte planparametere, og lagrer deretter dataene i en logg eller viser en advarsel. Hvis tjenesten stoppes, samles ikke ytelsesinformasjon inn. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\smlogsvc.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Performance Logs and Alerts
   DEPENDENCIES    :
   SERVICE_START_NAME: NT Authority\NetworkService

SERVICE_NAME: TapiSrv
Tilbyr støtte for telefoni-API (TAPI) for programmer som kontrollerer telefonienheter og IP-baserte telefonforbindelser på den lokale datamaskinen og - gjennom LAN - på servere som også kjører tjenesten.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Telephony
   DEPENDENCIES    : PlugPlay
          : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: TermService
Tillater at flere brukere er koblet interaktivt til en maskin, så vel som til skjermen som viser skrivebordet og programmer til eksterne datamaskiner. Støtten for eksternt skrivebord (inkludert eksternt skrivebord for administratorer), Fast User Switching, fjernhjelp og Terminal Server.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Terminal Services
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Themes
Tilbyr behandling av temaer for brukeropplevelse
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : UIGroup
   TAG       : 0
   DISPLAY_NAME    : Themes
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 60000 seconds
          : Restart   DELAY: 60000 seconds
          : None   DELAY: 0 seconds

SERVICE_NAME: TlntSvr
Gjør at en ekstern bruker kan logge på denne datamaskinen og kjøre programmer, og støtter forskjellige TCP/IP Telnet-klienter, inkludert UNIX-baserte og Windows-baserte datamaskiner. Hvis denne tjenesten stoppes, kan ekstern brukertilgang til programmer bli utilgjengelig. Hvis denne tjenesten deaktiveres, kommer ikke tjenester som er direkte avhengig av den, til å starte.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 4 DISABLED
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\tlntsvr.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Telnet
   DEPENDENCIES    : RPCSS
          : TCPIP
          : NTLMSSP
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: TrkWks
Opprettholder koblinger mellom NTFS-filer på en datamaskin eller på datamaskiner i et nettverksdomene.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Distributed Link Tracking Client
   DEPENDENCIES    : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: uploadmgr
Behandler synkrone og asynkrone filoverføringer mellom klienter og servere på nettverket. Hvis tjenesten stoppes, foretas ikke synkrone og asynkrone filoverføringer mellom klienter og servere på nettverket. Hvis tjenesten deaktiveres, kan ikke noen tjenester som er avhengig av den, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Upload Manager
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 100 seconds
          : Restart   DELAY: 100 seconds
          : None   DELAY: 100 seconds

SERVICE_NAME: upnphost
Gir mulighet til å støtte den universelle verten for Plug and Play-enheter.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Universal Plug and Play Device Host
   DEPENDENCIES    : SSDPSRV
   SERVICE_START_NAME: NT AUTHORITY\LocalService
   FAIL_RESET_PERIOD : -1 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 0 seconds

SERVICE_NAME: UPS
Administrerer en avbruddsfri strømforsyning (UPS) som er koblet til datamaskinen.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\ups.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Uninterruptible Power Supply
   DEPENDENCIES    :
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: VSS
Administrerer og implementerer skyggekopier for volum som brukes til sikkerhetskopiering og andre formål. Hvis tjenesten stoppes, er ikke skyggekopier tilgjengelig for sikkerhetskopiering, og dermed kan sikkerhetskopieringen mislykkes. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\vssvc.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Volume Shadow Copy
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: W32Time
Opprettholder synkronisering av dato og klokkeslett på alle klienter og servere i nettverket. Hvis denne tjenesten er stoppet, vil synkronisering av dato og klokkslett være utilgjengelig. Hvis denne tjenesten er deaktivert, vil enhver tjenesten som er avhengig av den, ikke kunne starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Windows Time
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WebClient
Windows-baserte programmer kan opprette, få tilgang til og redigere Internett-baserte filer. Hvis tjenesten stoppes, er ikke disse funksjonene tilgjengelige. Hvis tjenesten deaktiveres, kan ikke tjenester som er avhengig av denne, startes.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP : NetworkProvider
   TAG       : 0
   DISPLAY_NAME    : WebClient
   DEPENDENCIES    : MRxDAV
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: winmgmt
Tilbyr et felles grensesnitt og en objektmodell for å få tilgang til behandlingsinformasjon om operativsystem, enheter, programmer og tjenester. Hvis tjenesten stoppes, vil det meste av den Windows-baserte programvaren ikke fungere skikkelig. Hvis tjenesten deaktiveres, vil tjenester som avhenger av den, ikke kunne starte.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 0 IGNORE
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Windows Management Instrumentation
   DEPENDENCIES    : RPCSS
          : Eventlog
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS    : Restart   DELAY: 60000 seconds
          : Restart   DELAY: 60000 seconds

SERVICE_NAME: WmdmPmSp
Henter serienummeret for den bærbare musikkspilleren som er koblet til datamaskinen
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Portable Media Serial Number
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Wmi
Leverer systemadministrasjonsinformasjon til og fra drivere.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Windows Management Instrumentation Driver Extensions
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WmiApSrv
Inneholder informasjon om ytelsesbibliotek fra WMI HiPerf-leverandører.
   TYPE       : 10 WIN32_OWN_PROCESS
   START_TYPE    : 3 DEMAND_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\wbem\wmiapsrv.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : WMI Performance Adapter
   DEPENDENCIES    : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: wuauserv
Aktiverer nedlasting og installasjon av viktige Windows-oppdateringer. Hvis tjenesten er deaktivert, kan operativsystemet oppdateres manuelt på Web-området Windows Update.
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : Automatiske oppdateringer
   DEPENDENCIES    :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WUOLService
(null)
   TYPE       : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\NOVELL\ZENRC\WUOLService.exe
   LOAD_ORDER_GROUP :
   TAG       : 0
   DISPLAY_NAME    : WUOLservice
   DEPENDENCIES    : WM
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WZCSVC
Inneholder automatisk konfigurasjon for 802.11-kort
   TYPE       : 20 WIN32_SHARE_PROCESS
   START_TYPE    : 2 AUTO_START
   ERROR_CONTROL    : 1 NORMAL
   BINARY_PATH_NAME : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP : TDI
   TAG       : 0
   DISPLAY_NAME    : Wireless Zero Configuration
   DEPENDENCIES    : RpcSs
          : Ndisuio
   SERVICE_START_NAME: LocalSystem

This is like a detective novel. The private eye has to go around and get things
done and find information. And along the way he gets help from a Deepthroat
who stands in the shadow, smokes cigarettes and lead him on the right track.
But in this case - your both the Sherlock Holmes and Deepthroat. I'm Sherlocks
sidekick Dr.Watson

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'

\' />

Anyways, I hope this looks better.

Gaute.

guestolo · « **Reply #11 on:** October 17, 2004, 06:57:16 AM »

Morning Dr. Watson

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/tongue.gif\' class=\'bbc_emoticon\' alt=\'

\' />

Can you let me know what this is
It looks like it could be related to an old game or something
C:\MOONS\MPROTECT\PMMODE.EXE

We don't want you without AV protection for too long
I recommend that you install one of these 2 free Anti-Viruses
Also make sure that XP's firewall is enabled if your not using any third party firewall
Go to Network Connections in Control Panel>>Right click on your connection>>left click properties>>>Advanced tab

I really like this AV
AVAST
It comes with 5 scanners
All of which I don't use, these are up to you

Standard Shield---Leave Enabled
Internet Mail Shield-- Leave Enabled---I use Outlook Express
Outlook shield---I have Disabled--I don't use Outlook
P2P Shield---I have Disabled---Rarely use file sharing and scan everything I download
Instant Messaging Shield---I have Disabled---Don't use Instant Messaging that much

OR

I like this one too
AVG by Grisoft
Scroll to the bottom of the page and click NEXT

If you go with Avast you will want to know your Email settings thru your ISP
In OE
Open Outlook Express>>>Tools>>Accounts>>>Mail Tab>>Highlight your ISP mail account(If it's POP3) <--it should be
Click Properties>>>Servers tab
The info you will need is "Incoming Mail" (POP3)
"Outgoing Mail"(SMTP)

Remember you only need ONE Anti-Virus

Run a Full Scan after Installation
With Either AV, when registering, ensure you supply them with a legitimate email address, you may want to make it one from your ISP and not a webbased such as Email Removed <--I tried to use Email Removed once and never received notification

Before you install your new AV could you go back to your
C:\WINDOWS\System folder

Left click once on shell.dll to highlight it and then Right click on it and select Copy
Next go over to your
C:\WINDOWS\System32 folder and Paste a copy of it there

Besides that, your log looks clean

I always recommend installing these 2 applications
These will help prevent the spyware from ever reaching your machine
They add extra security while
silently protecting you, without running in the background

SpywareBlaster by JavaCool---will block bad ActiveX and malevolent cookies
Install---Check for Updates---Enable all protection
http://www.javacoolsoftware.com/spywareblaster.html

IE-Spyad---IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
Here is a tutorial and download link
TUTORIAL==Link to Tutorial
Download link==Download link
Scroll down and click on IE-SPYAD.EXE Free!

With both, Check for updates every couple of weeks

Let me know how you make out, if you don't get back to me
Stay safe

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/biggrin.gif\' class=\'bbc_emoticon\' alt=\'

\' />

guestolo · « **Reply #12 on:** October 17, 2004, 07:14:30 AM »

I think I found out what that program was related too, I've never heard of it before, I was just curious
http://www.moonscape.com/

Gaute · « **Reply #13 on:** October 17, 2004, 02:33:59 PM »

Hello Sherlock!
I copied the shell.dll to the right folder, downloaded the two programs and
the AVast virus-killer.
When I ran a deep scan it found 117 infected files. Different sorts of Trojans.
So they evidently they keep coming back every time I go on net... Strange.
Hope that AVast killed them all this time, and that my computer will live
happily ever after

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/wink.gif\' class=\'bbc_emoticon\' alt=\'

\' /> I'll drop you a note.

Moonscape is a program they use at the university to format the machine and
start it up again in no time. I think they have a mirror file of my whole C-disc...
But yeah, it sounds like an old Sierra game or something, or a bad John Carpenter
film...

Thanks for everything Guestsolo! You get my vote for the Nobel prize.
This forum wouldn't be the same without you. I see that you help a lot
of people here. Very kind!

Take care, and drop me a note if you wonder about anything.

Best wishes,

Gaute

guestolo · « **Reply #14 on:** October 17, 2004, 03:14:50 PM »

Hi again Gaute, I'm suspecting that Avast is finding some nasties in your System Volume Information folder
Anti-Virus software can't touch this folder

If everything is running good you should Disable System Restore---Restart your computer into Safe Mode---Run another scan with Avast----Restart back up into Normal mode----Enable System Restore
http://vil.nai.com/vil/SystemHelpDocs/Disa...eSysRestore.htm

This will create a fresh System Restore Point and ensure you don't restore any of those nasties

If you find anything else that you can't remove post back and let me know the locations
Take care

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/wink.gif\' class=\'bbc_emoticon\' alt=\'

\' />

And don't forget to do a Disk Defrag on your computer every couple of months or so
START>>>ALL PROGRAMS>>>ACCESSORIES>>>SYSTEM TOOLS>>>DISK DEFRAGMENTER

C.D.E. · « **Reply #15 on:** November 05, 2004, 05:21:46 PM »

i had the same about:blank problem, and i installed numerous spyware removal programs and edited the registry so many times. if the problem is recent, as mine was, a quick system restore did the trick. i could kick myself for not trying that first. im glad i kept system restore on, it actually worked well for a change. just find a checkpoint well before you started having trouble.

TheTechGuide Forum

News:

Author Topic: Help needed with about:blank/ home search - trojan (Read 1959 times)

Gaute

Help needed with about:blank/ home search - trojan

guestolo

Help needed with about:blank/ home search - trojan

guestolo

Help needed with about:blank/ home search - trojan

Gaute

Help needed with about:blank/ home search - trojan

Guest

Help needed with about:blank/ home search - trojan

Guest

Help needed with about:blank/ home search - trojan

guestolo

Help needed with about:blank/ home search - trojan

Gaute

Help needed with about:blank/ home search - trojan

guestolo

Help needed with about:blank/ home search - trojan

guestolo

Help needed with about:blank/ home search - trojan

Gaute

Help needed with about:blank/ home search - trojan

guestolo

Help needed with about:blank/ home search - trojan

guestolo

Help needed with about:blank/ home search - trojan

Gaute

Help needed with about:blank/ home search - trojan

guestolo

Help needed with about:blank/ home search - trojan

C.D.E.

Help needed with about:blank/ home search - trojan