Author Topic: THE BLUE SCREEN hijack file  (Read 521 times)

Offline Gummbee25

  • Newbie
  • *
  • Posts: 36
  • Karma: +0/-0
    • View Profile
THE BLUE SCREEN hijack file
« on: April 08, 2006, 09:51:40 PM »
today i got the blue screen that said windows was shutting down and dumping memory to prevent damage....
Kernal_data_inpage_error  i restart and all is ok but it hapopends again after 30 min or so.... not srue whats going on and help would be appricated

Logfile of HijackThis v1.99.1
Scan saved at 10:50:00 PM, on 4/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe
C:\DRIVERS\PRINTER\540\StatMon.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Computer Alarm Clock\cac.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\program files\steam\steam.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://myspace.com/
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [DellStatusMonitor] "C:\DRIVERS\PRINTER\540\StatMon.exe"
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Computer Alarm Clock] C:\Program Files\Computer Alarm Clock\cac.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - Global Startup: Exif Launcher.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,21/mcgdmgr.cab
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
THE BLUE SCREEN hijack file
« Reply #1 on: April 08, 2006, 09:56:53 PM »
Is this the same computer I asked you too post the exact error message you were having?

Can you do the following please
Right click on MyComputer icon on desktop
Left click properties
Click the Advanced tab>>Then select "Settings" under
Startup and Recovery

Under System Failure
Uncheck Automatically Restart
OK it and Apply

The next time you get a BSOD post the exact error message on the screen

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here


Offline Gummbee25

  • Newbie
  • *
  • Posts: 36
  • Karma: +0/-0
    • View Profile
THE BLUE SCREEN hijack file
« Reply #2 on: April 08, 2006, 11:28:23 PM »
ok my putter crashed again after running a clean up.... this is everything i saw on the blue screen.. i took a picture and hosted it...  

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
THE BLUE SCREEN hijack file
« Reply #3 on: April 09, 2006, 12:16:18 AM »
Taken from this page
http://www.updatexp.com/stop-messages.html

Here's a quote:
Quote
If the Stop message mentions the file Win32k.sys, the source of the error might be a third-party "remote control" program. If such software is installed, you might be able to disable it by starting the system in safe mode. If not, use Recovery Console to manually delete the system service file that is causing the problem.

Try the following:
Go to start>>run>>type in msconfig
Under the Startup tab
Uncheck [Computer Alarm Clock] C:\Program Files\Computer Alarm Clock\cac.exe

I just want to check and see if it's the cause of the problems
It might not be, but let's eliminate it
Apply it and close and reboot the computer
Did you pay for that program? If not I would uninstall it too make sure it doesn't conflict

Does that help?
Which Printer software are you running on this computer
Lexmark and Dell AIO Printer A920?
« Last Edit: April 09, 2006, 12:23:39 AM by guestolo »

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here


Offline Gummbee25

  • Newbie
  • *
  • Posts: 36
  • Karma: +0/-0
    • View Profile
THE BLUE SCREEN hijack file
« Reply #4 on: April 09, 2006, 12:31:00 AM »
no i didnt pay for it but i took it off startup tab and then decided i might as well uninstall just to be on the safe side.. im using AIO printer soft ware....

the blue screen came up when i was running "enwido".... or "clean up" cuz my computer is running slower then usuall all the sudden... my speed online is random.. i have cable.. should i try claning up my computer to see it that error screen comes up again?
« Last Edit: April 09, 2006, 12:33:09 AM by Gummbee25 »

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
THE BLUE SCREEN hijack file
« Reply #5 on: April 09, 2006, 01:02:25 AM »
Could you Download GetServices.zip
Unzip it to a folder
Double click on the Getservice.bat file to run it. This will create and open a text file named getservice.txt in the same folder.
getservice.txt will list all active Services

Post the getservices.txt

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here


Offline Gummbee25

  • Newbie
  • *
  • Posts: 36
  • Karma: +0/-0
    • View Profile
THE BLUE SCREEN hijack file
« Reply #6 on: April 09, 2006, 01:10:21 AM »
PsService v1.1 - local and remote services viewer/controller
Copyright © 2001-2003 Mark Russinovich
Sysinternals - www.sysinternals.com

SERVICE_NAME: Alerter
Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Alerter
   DEPENDENCIES     : LanmanWorkstation
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: ALG
Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Windows Firewall.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\alg.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Application Layer Gateway Service
   DEPENDENCIES     :
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: AntiVirScheduler
Service for planning and controlling AntiVir PersonalEdition Classic scan- and update-jobs.
   TYPE        : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS  
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : AntiVir Scheduler
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: AntiVirService
Real time virus protection through H+BEDV AntiVir Engine
   TYPE        : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS  
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : AntiVir PersonalEdition Classic Service
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: AppMgmt
Provides software installation services such as Assign, Publish, and Remove.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Application Management
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: aspnet_state
Provides support for out-of-process session states for ASP.NET. If this service is stopped, out-of-process requests will not be processed. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : ASP.NET State Service
   DEPENDENCIES     :
   SERVICE_START_NAME: NT AUTHORITY\NetworkService

SERVICE_NAME: Ati HotKey Poller
(null)
   TYPE        : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS  
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\Ati2evxx.exe
   LOAD_ORDER_GROUP  : Event log
   TAG        : 0
   DISPLAY_NAME     : Ati HotKey Poller
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: AudioSrv
Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  : AudioGroup
   TAG        : 0
   DISPLAY_NAME     : Windows Audio
   DEPENDENCIES     : PlugPlay
           : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: BITS
Transfers data between clients and servers in the background. If BITS is disabled, features such as Windows Update will not work correctly.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Background Intelligent Transfer Service
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 0 seconds
   FAILURE_ACTIONS     : Restart   DELAY: 60000 seconds
           : Restart   DELAY: 60000 seconds
           : Restart   DELAY: 60000 seconds

SERVICE_NAME: Browser
Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Computer Browser
   DEPENDENCIES     : LanmanWorkstation
           : LanmanServer
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: CiSvc
Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.
   TYPE        : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS  
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\cisvc.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Indexing Service
   DEPENDENCIES     : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ClipSrv
Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 4  DISABLED
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\clipsrv.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : ClipBook
   DEPENDENCIES     : NetDDE
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: COMSysApp
Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : COM+ System Application
   DEPENDENCIES     : rpcss
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 30 seconds
   FAILURE_ACTIONS     : Restart   DELAY: 1000 seconds
           : Restart   DELAY: 5000 seconds
           : None   DELAY: 1000 seconds

SERVICE_NAME: CryptSvc
Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Cryptographic Services
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: DcomLaunch
Provides launch functionality for DCOM services.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost -k DcomLaunch
   LOAD_ORDER_GROUP  : Event Log
   TAG        : 0
   DISPLAY_NAME     : DCOM Server Process Launcher
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 0 seconds
   FAILURE_ACTIONS     : Reboot   DELAY: 60000 seconds

SERVICE_NAME: Dhcp
Manages network configuration by registering and updating IP addresses and DNS names.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  : TDI
   TAG        : 0
   DISPLAY_NAME     : DHCP Client
   DEPENDENCIES     : Tcpip
           : Afd
           : NetBT
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: dmadmin
Configures hard disk drives and volumes. The service only runs for configuration processes and then stops.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\dmadmin.exe /com
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Logical Disk Manager Administrative Service
   DEPENDENCIES     : RpcSs
           : PlugPlay
           : DmServer
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: dmserver
Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Logical Disk Manager
   DEPENDENCIES     : RpcSs
           : PlugPlay
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Dnscache
Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k NetworkService
   LOAD_ORDER_GROUP  : TDI
   TAG        : 0
   DISPLAY_NAME     : DNS Client
   DEPENDENCIES     : Tcpip
   SERVICE_START_NAME: NT AUTHORITY\NetworkService

SERVICE_NAME: ERSvc
Allows error reporting for services and applictions running in non-standard environments.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 0  IGNORE
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Error Reporting Service
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Eventlog
Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\services.exe
   LOAD_ORDER_GROUP  : Event log
   TAG        : 0
   DISPLAY_NAME     : Event Log
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: EventSystem
Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  : Network
   TAG        : 0
   DISPLAY_NAME     : COM+ Event System
   DEPENDENCIES     : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ewido security suite control
(null)
   TYPE        : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS  
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 0  IGNORE
   BINARY_PATH_NAME  : C:\Program Files\ewido anti-malware\ewidoctrl.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : ewido security suite control
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: FastUserSwitchingCompatibility
Provides management for applications that require assistance in a multiple user environment.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Fast User Switching Compatibility
   DEPENDENCIES     : TermService
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Fax
Enables you to send and receive faxes, utilizing fax resources available on this computer or on the network.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\fxssvc.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Fax
   DEPENDENCIES     : TapiSrv
           : RpcSs
           : PlugPlay
           : Spooler
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: helpsvc
Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Help and Support
   DEPENDENCIES     : RPCSS
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS     : Restart   DELAY: 100 seconds
           : Restart   DELAY: 100 seconds
           : None   DELAY: 100 seconds

SERVICE_NAME: HidServ
Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 4  DISABLED
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Human Interface Device Access
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: HTTPFilter
This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service,  using the Secure Socket Layer (SSL).  If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k HTTPFilter
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : HTTP SSL
   DEPENDENCIES     : HTTP
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: IAANTMon
(null)
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 0  IGNORE
   BINARY_PATH_NAME  : C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : IAA Event Monitor
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ImapiService
Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\imapi.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : IMAPI CD-Burning COM Service
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: lanmanserver
Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Server
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: lanmanworkstation
Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  : NetworkProvider
   TAG        : 0
   DISPLAY_NAME     : Workstation
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: LexBceS
(null)
   TYPE        : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS  
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\LEXBCES.EXE
   LOAD_ORDER_GROUP  : SpoolerGroup
   TAG        : 0
   DISPLAY_NAME     : LexBce Server
   DEPENDENCIES     : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: LmHosts
Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP  : TDI
   TAG        : 0
   DISPLAY_NAME     : TCP/IP NetBIOS Helper
   DEPENDENCIES     : NetBT
           : Afd
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: Messenger
Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 4  DISABLED
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Messenger
   DEPENDENCIES     : LanmanWorkstation
           : NetBIOS
           : PlugPlay
           : RpcSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: mnmsrvc
Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS  
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\mnmsrvc.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : NetMeeting Remote Desktop Sharing
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: MSDTC
Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\msdtc.exe
   LOAD_ORDER_GROUP  : MS Transactions
   TAG        : 0
   DISPLAY_NAME     : Distributed Transaction Coordinator
   DEPENDENCIES     : RPCSS
           : SamSS
   SERVICE_START_NAME: NT AUTHORITY\NetworkService

SERVICE_NAME: MSIServer
Adds, modifies, and removes applications provided as a Windows Installer (*.msi) package. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\msiexec.exe /V
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Windows Installer
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NetDDE
Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 4  DISABLED
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\netdde.exe
   LOAD_ORDER_GROUP  : NetDDEGroup
   TAG        : 0
   DISPLAY_NAME     : Network DDE
   DEPENDENCIES     : NetDDEDSDM
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NetDDEdsdm
Manages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 4  DISABLED
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\netdde.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Network DDE DSDM
   DEPENDENCIES     :
           : EGrLocalSystem
           : Network DDE DSDM
           : etwork DDE
           : workService
           : Distributed Transaction Coordinator
           : ion
           : es=C:\Pr^
           : 
           :  
           : 
           : h6
           : h6
           : ges Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
           :  
           : u
           : n
           : a
           : v
           : a
           : i
           : l
           : a
           : b
           : l
           : e
           : .
           :  
           : I
           : f
           :  
           : t
           : h
           : i
           : s
           :  
           : s
           : e
           : r
           : v
           : i
           : c
           : e
           :  
           : i
           : s
           :  
           : d
           : i
           : s
           : a
           : b
           : l
           : e
           : d
           : ,
           :  
           : a
           : n
           : y
           :  
           : s
           : e
           : r
           : v
           : i
           : c
           : e
           : s
           :  
           : t
           : h
           : a
           : t
           :  
           : e
           : x
           : p
           : l
           : i
           : c
           : i
           : t
           : l
           : y
           :  
           : d
           : e
           : p
           : e
           : n
           : d
           :  
           : o
           : n
           :  
           : i
           : t
           :  
           : w
           : i
           : l
           : l
           :  
           : f
           : a
           : i
           : l
           :  
           : t
           : o
           :  
           : s
           : t
           : a
           : r
           : t
           : .
           :  
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Netlogon
Supports pass-through authentication of account logon events for computers in a domain.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\lsass.exe
   LOAD_ORDER_GROUP  : RemoteValidation
   TAG        : 0
   DISPLAY_NAME     : Net Logon
   DEPENDENCIES     : LanmanWorkstation
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Netman
Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections.
   TYPE        : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS  
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Network Connections
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Nla
Collects and stores network configuration and location information, and notifies applications when this information changes.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Network Location Awareness (NLA)
   DEPENDENCIES     : Tcpip
           : Afd
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NtLmSsp
Provides security to remote procedure call (RPC) programs that use transports other than named pipes.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\lsass.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : NT LM Security Support Provider
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: NtmsSvc
(null)
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Removable Storage
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: PlugPlay
Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\services.exe
   LOAD_ORDER_GROUP  : PlugPlay
   TAG        : 0
   DISPLAY_NAME     : Plug and Play
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: PolicyAgent
Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\lsass.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : IPSEC Services
   DEPENDENCIES     : RPCSS
           : Tcpip
           : IPSec
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ProtectedStorage
Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users.
   TYPE        : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS  
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\lsass.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Protected Storage
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RasAuto
Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Remote Access Auto Connection Manager
   DEPENDENCIES     : RasMan
           : Tapisrv
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RasMan
Creates a network connection.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Remote Access Connection Manager
   DEPENDENCIES     : Tapisrv
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RDSessMgr
Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the Dependencies tab of the Properties dialog box.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\sessmgr.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Remote Desktop Help Session Manager
   DEPENDENCIES     : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RemoteAccess
Offers routing services to businesses in local area and wide area network environments.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 4  DISABLED
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Routing and Remote Access
   DEPENDENCIES     : RpcSS
           : +NetBIOSGroup
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: RpcLocator
Manages the RPC name service database.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\locator.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Remote Procedure Call (RPC) Locator
   DEPENDENCIES     : LanmanWorkstation
   SERVICE_START_NAME: NT AUTHORITY\NetworkService

SERVICE_NAME: RpcSs
Provides the endpoint mapper and other miscellaneous RPC services.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost -k rpcss
   LOAD_ORDER_GROUP  : COM Infrastructure
   TAG        : 0
   DISPLAY_NAME     : Remote Procedure Call (RPC)
   DEPENDENCIES     :
   SERVICE_START_NAME: NT AUTHORITY\NetworkService
   FAIL_RESET_PERIOD : 0 seconds
   FAILURE_ACTIONS     : Reboot   DELAY: 60000 seconds

SERVICE_NAME: RSVP
Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\rsvp.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : QoS RSVP
   DEPENDENCIES     : TcpIp
           : Afd
           : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SamSs
Stores security information for local user accounts.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\lsass.exe
   LOAD_ORDER_GROUP  : LocalValidation
   TAG        : 0
   DISPLAY_NAME     : Security Accounts Manager
   DEPENDENCIES     : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SCardSvr
Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 0  IGNORE
   BINARY_PATH_NAME  : C:\WINDOWS\System32\SCardSvr.exe
   LOAD_ORDER_GROUP  : SmartCardGroup
   TAG        : 0
   DISPLAY_NAME     : Smart Card
   DEPENDENCIES     : PlugPlay
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: Schedule
Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  : SchedulerGroup
   TAG        : 0
   DISPLAY_NAME     : Task Scheduler
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS     : Restart   DELAY: 6000 seconds
           : Restart   DELAY: 60000 seconds
           : None   DELAY: 0 seconds

SERVICE_NAME: seclogon
Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 120 WIN32_SHARE_PROCESS INTERACTIVE_PROCESS  
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 0  IGNORE
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Secondary Logon
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SENS
Tracks system events such as Windows logon, network, and power events.  Notifies COM+ Event System subscribers of these events.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  : Network
   TAG        : 0
   DISPLAY_NAME     : System Event Notification
   DEPENDENCIES     : EventSystem
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SharedAccess
Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Windows Firewall/Internet Connection Sharing (ICS)
   DEPENDENCIES     : Netman
           : WinMgmt
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: ShellHWDetection
Provides notifications for AutoPlay hardware events.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 0  IGNORE
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  : ShellSvcGroup
   TAG        : 0
   DISPLAY_NAME     : Shell Hardware Detection
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Spooler
Loads files to memory for later printing.
   TYPE        : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS  
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\spoolsv.exe
   LOAD_ORDER_GROUP  : SpoolerGroup
   TAG        : 0
   DISPLAY_NAME     : Print Spooler
   DEPENDENCIES     : LexBceS
           : RPCSS
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS     : Restart   DELAY: 60000 seconds
           : Restart   DELAY: 60000 seconds
           : None   DELAY: 0 seconds

SERVICE_NAME: srservice
Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : System Restore Service
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SSDPSRV
Enables discovery of UPnP devices on your home network.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : SSDP Discovery Service
   DEPENDENCIES     : HTTP
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: stisvc
Provides image acquisition services for scanners and cameras.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k imgsvc
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Windows Image Acquisition (WIA)
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SwPrv
Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 0  IGNORE
   BINARY_PATH_NAME  : C:\WINDOWS\system32\dllhost.exe /Processid:{A445BD1E-49EE-4607-B370-5CCA447377C4}
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : MS Software Shadow Copy Provider
   DEPENDENCIES     : rpcss
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: SysmonLog
Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\smlogsvc.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Performance Logs and Alerts
   DEPENDENCIES     :
   SERVICE_START_NAME: NT Authority\NetworkService

SERVICE_NAME: TapiSrv
Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Telephony
   DEPENDENCIES     : PlugPlay
           : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: TermService
Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost -k DComLaunch
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Terminal Services
   DEPENDENCIES     : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: Themes
Provides user experience theme management.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  : UIGroup
   TAG        : 0
   DISPLAY_NAME     : Themes
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS     : Restart   DELAY: 60000 seconds
           : Restart   DELAY: 60000 seconds
           : None   DELAY: 0 seconds

SERVICE_NAME: TrkWks
Maintains links between NTFS files within a computer or across computers in a network domain.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Distributed Link Tracking Client
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: upnphost
Provides support to host Universal Plug and Play devices.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Universal Plug and Play Device Host
   DEPENDENCIES     : SSDPSRV
           : HTTP
   SERVICE_START_NAME: NT AUTHORITY\LocalService
   FAIL_RESET_PERIOD : -1 seconds
   FAILURE_ACTIONS     : Restart   DELAY: 0 seconds

SERVICE_NAME: UPS
Manages an uninterruptible power supply (UPS) connected to the computer.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\ups.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Uninterruptible Power Supply
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: vsmon
Monitors internet traffic and generates alerts for disallowed access.
   TYPE        : 110 WIN32_OWN_PROCESS INTERACTIVE_PROCESS  
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe -service
   LOAD_ORDER_GROUP  : TrueVector Group
   TAG        : 0
   DISPLAY_NAME     : TrueVector Internet Monitor
   DEPENDENCIES     : Afd
           : RpcSs
           : vsdatant
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: VSS
Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\vssvc.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Volume Shadow Copy
   DEPENDENCIES     : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: w32time
Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.


   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Windows Time
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WebClient
Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k LocalService
   LOAD_ORDER_GROUP  : NetworkProvider
   TAG        : 0
   DISPLAY_NAME     : WebClient
   DEPENDENCIES     : MRxDAV
   SERVICE_START_NAME: NT AUTHORITY\LocalService

SERVICE_NAME: winmgmt
Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 0  IGNORE
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Windows Management Instrumentation
   DEPENDENCIES     : RPCSS
   SERVICE_START_NAME: LocalSystem
   FAIL_RESET_PERIOD : 86400 seconds
   FAILURE_ACTIONS     : Restart   DELAY: 60000 seconds
           : Restart   DELAY: 60000 seconds

SERVICE_NAME: WmdmPmSN
Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Portable Media Serial Number Service
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WmiApSrv
Provides performance library information from WMI HiPerf providers.
   TYPE        : 10 WIN32_OWN_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\wbem\wmiapsrv.exe
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : WMI Performance Adapter
   DEPENDENCIES     : RPCSS
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: wscsvc
Monitors system security settings and configurations.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Security Center
   DEPENDENCIES     : RpcSs
           : winmgmt
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: wuauserv
Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\system32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Automatic Updates
   DEPENDENCIES     :
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: WZCSVC
Provides automatic configuration for the 802.11 adapters
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 2  AUTO_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  : TDI
   TAG        : 0
   DISPLAY_NAME     : Wireless Zero Configuration
   DEPENDENCIES     : RpcSs
           : Ndisuio
   SERVICE_START_NAME: LocalSystem

SERVICE_NAME: xmlprov
Manages XML configuration files on a domain basis for automatic network provisioning.
   TYPE        : 20 WIN32_SHARE_PROCESS
   START_TYPE     : 3  DEMAND_START
   ERROR_CONTROL     : 1  NORMAL
   BINARY_PATH_NAME  : C:\WINDOWS\System32\svchost.exe -k netsvcs
   LOAD_ORDER_GROUP  :
   TAG        : 0
   DISPLAY_NAME     : Network Provisioning Service
   DEPENDENCIES     : RpcSs
   SERVICE_START_NAME: LocalSystem

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
THE BLUE SCREEN hijack file
« Reply #7 on: April 09, 2006, 11:25:59 AM »
What version of CleanUp! are you using, if unsure, open it and it should inform you in the main window

Let's try the following and see if it helps at all
Go to START>>>RUN>>>type in services.msc
Hit OK
In the next window, look on the right hand side for this service
name---- LexBce Server

Double click on it--- STOP the service--If running
In the drop down menu, change the startup type to Disabled

Do the same for this one, you may be able to use Ewido anyways even if it informs you that you need this running
ewido security suite control

Go back into msconfig
Under the Startup tab
If this entry is still present and unchecked, recheck it
[Computer Alarm Clock] C:\Program Files\Computer Alarm Clock\cac.exe

Apply it and close but DON'T restart the computer yet
Instead
We're going to do some troubleshooting with Hijackthis
Hijackthis will make backups, so don't delete hijackthis or the backup folder

Do a "System scan only" with Hijackthis and put a check next to these entries:

O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Computer Alarm Clock] C:\Program Files\Computer Alarm Clock\cac.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k


After you have ticked the above entry, close All other open windows
Including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Reboot the computer
Your running Zone Alarm for firewall software, that's a good idea
Can you double check to ensure that the built in XP firewall is disabled in the Windows Control Panel
You don't need both running at the same time

If your running Windows CleanUp! 4.0
Can you uninstall it from Add/Remove programs
You can install the latest version CleanUp! 4.5 from This Link

See if any of the above helps out

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here