124 replies to this topic

[Joecastle]

Nothing happens as well...

[sUΒs]

Have you rebooted the machine? You need to be more elaborate. The machine is in front of you, not me.

[Joecastle]

Sorry sUBs it was a long day & was tired of looking at the screen. After a hardboot ( I have to do this after the computer sits for a little while) & at the moment windows opens I went into task manager and could only see the WLservice.exe. So I ended the process and it would immediately pop up again as well as the Virtual memory & WLAN windows. Wouldn't it be ok to do a system restore point back to the day before we did the tcpip changes? Even though the computer may still have viruses or not have a network connection. I remember it being more stable than it is now... I am writing this from work at this moment so I would have to wait until I get home this evening to perform any changes. Thanks for your quick responses sUBs!!!

[sUΒs]

Wouldn't it be ok to do a system restore point back to the day before we did the tcpip changes?

Sounds like a plan. Yes, please do that.

We can get rid of any infections if they get restored. Ping me when you get home

[Joecastle]

Hello sUBs, Here at home now. I will do a restore point back to when we did the tcpip change, or should I do it as far back to when before I lost the connection?

[sUΒs]

Let's try going back to the time when the connection was active. Once the connection is active, disconnect the machine from the Internet. This prevents malware from updating itself. Then run ComboFix by double clicking on it. It'll let me know what's present on the machine.

[Joecastle]

Hi,

I cannot access system restore. Even in safemade. It says System Restore is unable to protect your computer. Please restart your computer, and then run System Restore again. lol. I have a canal in my backyard. I think that would work. lol

[sUΒs]

I have a canal in my backyard. I think that would work.

Tie a rock to it. It may not sink properly

Let's see if we can stop WLservice.exe from running. Earlier on, we changed it's StartUp type to 'OnDemand'. Let's disable it totally now.

Go to Start > Run - type in CMD.EXE to bring up the command prompt

Type in this line & press enter

SC CONFIG WUSB54GSCSVC START= DISABLED

SC STOP WUSB54GSCSVC

[Joecastle]

Ok,

I did as instructed in normal windows and after typing in the second cmd I get the following
[sc] ControlService FAILED 1053
The service has not been started.

In safe mode it is the same but with a FAILED 1062

[sUΒs]

No need to go to Safe Mode. It's too time consuming to keep booting to & fro

The service has not been started.

Means that this isn't the culprit.

Refering to post #24, are you able to access EventViewer?

[Joecastle]

I am in event viewer now. I clicked once on the bottom button below the arrows. How do I open clipboard in order to paste the info?

[sUΒs]

I clicked once on the bottom button below the arrows.

Clicking on that button saves the info to memory.

Open Notepad or any text editot. Then press Ctrl + V to paste it in

[Joecastle]

Refering to post #24, are you able to access EventViewer?
[/quote]


Ok,

The only way of doing this for noe is in safemode. Normal mode is too unstable (freezing & have to hard boot). Here is what I got,

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/15/2007
Time: 4:00:25 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
Faulting application sed.cfexe, version 0.0.0.0, faulting module sed.cfexe, version 0.0.0.0, fault address 0x000106ac.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 65 64 ure sed
0018: 2e 63 66 65 78 65 20 30 .cfexe 0
0020: 2e 30 2e 30 2e 30 20 69 .0.0.0 i
0028: 6e 20 73 65 64 2e 63 66 n sed.cf
0030: 65 78 65 20 30 2e 30 2e exe 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 31 30 36 61 63 0d 0a 0106ac..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/15/2007
Time: 3:55:06 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
Faulting application sed.cfexe, version 0.0.0.0, faulting module sed.cfexe, version 0.0.0.0, fault address 0x000106ac.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 65 64 ure sed
0018: 2e 63 66 65 78 65 20 30 .cfexe 0
0020: 2e 30 2e 30 2e 30 20 69 .0.0.0 i
0028: 6e 20 73 65 64 2e 63 66 n sed.cf
0030: 65 78 65 20 30 2e 30 2e exe 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 31 30 36 61 63 0d 0a 0106ac..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/14/2007
Time: 3:56:37 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
Faulting application sed.cfexe, version 0.0.0.0, faulting module sed.cfexe, version 0.0.0.0, fault address 0x000106ac.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 65 64 ure sed
0018: 2e 63 66 65 78 65 20 30 .cfexe 0
0020: 2e 30 2e 30 2e 30 20 69 .0.0.0 i
0028: 6e 20 73 65 64 2e 63 66 n sed.cf
0030: 65 78 65 20 30 2e 30 2e exe 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 31 30 36 61 63 0d 0a 0106ac..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/14/2007
Time: 3:49:49 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
Faulting application sed.cfexe, version 0.0.0.0, faulting module sed.cfexe, version 0.0.0.0, fault address 0x000106ac.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 65 64 ure sed
0018: 2e 63 66 65 78 65 20 30 .cfexe 0
0020: 2e 30 2e 30 2e 30 20 69 .0.0.0 i
0028: 6e 20 73 65 64 2e 63 66 n sed.cf
0030: 65 78 65 20 30 2e 30 2e exe 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 31 30 36 61 63 0d 0a 0106ac..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/12/2007
Time: 8:47:20 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
Faulting application sed.cfexe, version 0.0.0.0, faulting module sed.cfexe, version 0.0.0.0, fault address 0x000106ac.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 65 64 ure sed
0018: 2e 63 66 65 78 65 20 30 .cfexe 0
0020: 2e 30 2e 30 2e 30 20 69 .0.0.0 i
0028: 6e 20 73 65 64 2e 63 66 n sed.cf
0030: 65 78 65 20 30 2e 30 2e exe 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 31 30 36 61 63 0d 0a 0106ac..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/12/2007
Time: 8:41:35 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
Faulting application sed.cfexe, version 0.0.0.0, faulting module sed.cfexe, version 0.0.0.0, fault address 0x000106ac.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 65 64 ure sed
0018: 2e 63 66 65 78 65 20 30 .cfexe 0
0020: 2e 30 2e 30 2e 30 20 69 .0.0.0 i
0028: 6e 20 73 65 64 2e 63 66 n sed.cf
0030: 65 78 65 20 30 2e 30 2e exe 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 31 30 36 61 63 0d 0a 0106ac..

Event Type: Error
Event Source: EventSystem
Event Category: (50)
Event ID: 4609
Date: 10/12/2007
Time: 8:18:46 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043B from line 44 of d:\nt_qxp\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

Event Type: Error
Event Source: EventSystem
Event Category: (50)
Event ID: 4609
Date: 10/12/2007
Time: 8:03:49 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043B from line 44 of d:\nt_qxp\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 10/11/2007
Time: 6:35:44 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
Faulting application sed.cfexe, version 0.0.0.0, faulting module sed.cfexe, version 0.0.0.0, fault address 0x000106ac.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 65 64 ure sed
0018: 2e 63 66 65 78 65 20 30 .cfexe 0
0020: 2e 30 2e 30 2e 30 20 69 .0.0.0 i
0028: 6e 20 73 65 64 2e 63 66 n sed.cf
0030: 65 78 65 20 30 2e 30 2e exe 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 31 30 36 61 63 0d 0a 0106ac..

Event Type: Error
Event Source: EventSystem
Event Category: (50)
Event ID: 4609
Date: 10/11/2007
Time: 6:35:10 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043B from line 44 of d:\nt_qxp\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.


System

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/17/2007
Time: 9:13:44 PM
User: ADMIN-ZCV957D57\admin
Computer: ADMIN-ZCV957D57
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service netman with arguments "" in order to run the server:
{BA126AE5-2166-11D1-B1D0-00805FC1270E}

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.


Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/17/2007
Time: 9:13:44 PM
User: NT AUTHORITY\SYSTEM
Computer: ADMIN-ZCV957D57
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

Event Type: Error
Event Source: ACPI
Event Category: None
Event ID: 5
Date: 10/17/2007
Time: 9:12:24 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
AMLI: ACPI BIOS is attempting to write to an illegal IO port address (0x4d0), which lies in the 0x4d0 - 0x4d1 protected address range. This could lead to system instability. Please contact your system vendor for technical assistance.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 00 00 00 00 04 00 52 00 ......R.
0008: 00 00 00 00 05 00 05 c0 .......À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: ACPI
Event Category: None
Event ID: 4
Date: 10/17/2007
Time: 9:12:24 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
AMLI: ACPI BIOS is attempting to read from an illegal IO port address (0x4d0), which lies in the 0x4d0 - 0x4d1 protected address range. This could lead to system instability. Please contact your system vendor for technical assistance.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 00 00 00 00 04 00 52 00 ......R.
0008: 00 00 00 00 04 00 05 c0 .......À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/17/2007
Time: 8:44:04 PM
User: ADMIN-ZCV957D57\admin
Computer: ADMIN-ZCV957D57
Description:
DCOM got error "The executable program that this service is configured to run in does not implement the service. " attempting to start the service netman with arguments "" in order to run the server:
{BA126AD1-2166-11D1-B1D0-00805FC1270E}

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/17/2007
Time: 8:43:36 PM
User: ADMIN-ZCV957D57\admin
Computer: ADMIN-ZCV957D57
Description:
DCOM got error "The executable program that this service is configured to run in does not implement the service. " attempting to start the service netman with arguments "" in order to run the server:
{BA126AE5-2166-11D1-B1D0-00805FC1270E}

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/17/2007
Time: 8:43:27 PM
User: ADMIN-ZCV957D57\admin
Computer: ADMIN-ZCV957D57
Description:
DCOM got error "The executable program that this service is configured to run in does not implement the service. " attempting to start the service netman with arguments "" in order to run the server:
{BA126AE5-2166-11D1-B1D0-00805FC1270E}

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 10/17/2007
Time: 8:43:27 PM
User: NT AUTHORITY\SYSTEM
Computer: ADMIN-ZCV957D57
Description:
DCOM got error "The executable program that this service is configured to run in does not implement the service. " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.

Event Type: Error
Event Source: ACPI
Event Category: None
Event ID: 5
Date: 10/17/2007
Time: 8:42:23 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
AMLI: ACPI BIOS is attempting to write to an illegal IO port address (0x4d0), which lies in the 0x4d0 - 0x4d1 protected address range. This could lead to system instability. Please contact your system vendor for technical assistance.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 00 00 00 00 04 00 52 00 ......R.
0008: 00 00 00 00 05 00 05 c0 .......À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: ACPI
Event Category: None
Event ID: 4
Date: 10/17/2007
Time: 8:42:23 PM
User: N/A
Computer: ADMIN-ZCV957D57
Description:
AMLI: ACPI BIOS is attempting to read from an illegal IO port address (0x4d0), which lies in the 0x4d0 - 0x4d1 protected address range. This could lead to system instability. Please contact your system vendor for technical assistance.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 00 00 00 00 04 00 52 00 ......R.
0008: 00 00 00 00 04 00 05 c0 .......À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

[sUΒs]

Drat !! It's not showing me much. Please do this ...

Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:

@echo off

Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:
Double click on fix.bat & allow it to run

Post back to tell me what it says

[Joecastle]

Here it is...

catchme 0.3.1169.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-17 22:13:26
Windows 5.1.2600

scanning processes ...

System [4]
C:\WINDOWS\System32\smss.exe [136] 0x8123C8E0
C:\WINDOWS\system32\csrss.exe [188] 0x8120F4F0
C:\WINDOWS\system32\winlogon.exe [212] 0x811E9398
C:\WINDOWS\system32\services.exe [256] 0x812043B0
C:\WINDOWS\system32\lsass.exe [268] 0x812038D0
C:\WINDOWS\system32\svchost.exe [428] 0x811FE020
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe [460] 0x811CC378
C:\WINDOWS\system32\svchost.exe [536] 0x811C1020
C:\WINDOWS\Explorer.EXE [692] 0x811CA020
C:\WINDOWS\System32\cmd.exe [1472] 0x8113F020
C:\WINDOWS\catchme.exe [1492] 0x811426F0




SteelWerX Registry Console Tool 2.0
Written by Bobbi Flekman 2006 ©

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost
LocalService REG_MULTI_SZ AlerterWebClientLmHostsRemoteRegistryupnphostSSDPSRV\
NetworkService REG_MULTI_SZ DnsCache\
netsvcs REG_MULTI_SZ helpsvcgpejsjbqhelpsvc\
rpcss REG_MULTI_SZ RpcSs\
imgsvc REG_MULTI_SZ StiSvc\
termsvcs REG_MULTI_SZ TermService\
HTTPFilter REG_MULTI_SZ HTTPFilter\

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\DComLaunch
CoInitializeSecurityParam REG_DWORD 1 (0x1)
DefaultRpcStackSize REG_DWORD 8 (0x8)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\HTTPFilter
CoInitializeSecurityParam REG_DWORD 1 (0x1)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalService
CoInitializeSecurityParam REG_DWORD 1 (0x1)
AuthenticationCapabilities REG_DWORD 8192 (0x2000)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\netsvcs
CoInitializeSecurityParam REG_DWORD 1 (0x1)
AuthenticationCapabilities REG_DWORD 12320 (0x3020)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\PCHealth
CoInitializeSecurityParam REG_DWORD 2 (0x2)
AuthenticationCapabilities REG_DWORD 64 (0x40)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\termsvcs
CoInitializeSecurityParam REG_DWORD 1 (0x1)
DefaultRpcStackSize REG_DWORD 8 (0x8)

------ Services [Running]

SERVICE_NAME: AVG Anti-Spyware Guard
SERVICE_NAME: Eventlog
SERVICE_NAME: helpsvc
SERVICE_NAME: PlugPlay
SERVICE_NAME: RpcSs

------ Services [Stopped]

SERVICE_NAME: Alerter
SERVICE_NAME: ALG
SERVICE_NAME: AOL ACS
SERVICE_NAME: AOL TopSpeedMonitor
SERVICE_NAME: AOLService
SERVICE_NAME: AppMgmt
SERVICE_NAME: AudioSrv
SERVICE_NAME: BITS
SERVICE_NAME: Browser
SERVICE_NAME: cisvc
SERVICE_NAME: ClipSrv
SERVICE_NAME: COMSysApp
SERVICE_NAME: CryptSvc
SERVICE_NAME: Dhcp
SERVICE_NAME: dmadmin
SERVICE_NAME: dmserver
SERVICE_NAME: Dnscache
SERVICE_NAME: ERSvc
SERVICE_NAME: EventSystem
SERVICE_NAME: FastUserSwitchingCompatibility
SERVICE_NAME: GoogleDesktopManager
SERVICE_NAME: gusvc
SERVICE_NAME: HidServ
SERVICE_NAME: HTTPFilter
SERVICE_NAME: ImapiService
SERVICE_NAME: Irmon
SERVICE_NAME: lanmanserver
SERVICE_NAME: lanmanworkstation
SERVICE_NAME: LmHosts
SERVICE_NAME: Messenger
SERVICE_NAME: mnmsrvc
SERVICE_NAME: MSDTC
SERVICE_NAME: MSIServer
SERVICE_NAME: NetDDE
SERVICE_NAME: NetDDEdsdm
SERVICE_NAME: Netlogon
SERVICE_NAME: Netman
SERVICE_NAME: Nla
SERVICE_NAME: NtLmSsp
SERVICE_NAME: NtmsSvc
SERVICE_NAME: ose
SERVICE_NAME: PolicyAgent
SERVICE_NAME: ProtectedStorage
SERVICE_NAME: RasAuto
SERVICE_NAME: RasMan
SERVICE_NAME: RDSessMgr
SERVICE_NAME: RemoteAccess
SERVICE_NAME: RemoteRegistry
SERVICE_NAME: RpcLocator
SERVICE_NAME: RSVP
SERVICE_NAME: SamSs
SERVICE_NAME: SCardSvr
SERVICE_NAME: Schedule
SERVICE_NAME: seclogon
SERVICE_NAME: SENS
SERVICE_NAME: SharedAccess
SERVICE_NAME: ShellHWDetection
SERVICE_NAME: Spooler
SERVICE_NAME: srservice
SERVICE_NAME: SSDPSRV
SERVICE_NAME: stisvc
SERVICE_NAME: SwPrv
SERVICE_NAME: SysmonLog
SERVICE_NAME: TapiSrv
SERVICE_NAME: TermService
SERVICE_NAME: Themes
SERVICE_NAME: TlntSvr
SERVICE_NAME: TrkWks
SERVICE_NAME: uploadmgr
SERVICE_NAME: upnphost
SERVICE_NAME: UPS
SERVICE_NAME: VSS
SERVICE_NAME: W32Time
SERVICE_NAME: WebClient
SERVICE_NAME: winmgmt
SERVICE_NAME: WmdmPmSN
SERVICE_NAME: WmdmPmSp
SERVICE_NAME: Wmi
SERVICE_NAME: WmiApSrv
SERVICE_NAME: wuauserv
SERVICE_NAME: WUSB54GSCSVC
SERVICE_NAME: WZCSVC

------ Drivers [Running]

SERVICE_NAME: ACPI
SERVICE_NAME: AliIde
SERVICE_NAME: alim1541
SERVICE_NAME: atapi
SERVICE_NAME: AvgAsCln
SERVICE_NAME: Beep
SERVICE_NAME: catchme
SERVICE_NAME: Cdfs
SERVICE_NAME: Cdrom
SERVICE_NAME: Compbatt
SERVICE_NAME: Disk
SERVICE_NAME: dmio
SERVICE_NAME: dmload
SERVICE_NAME: Fastfat
SERVICE_NAME: Fdc
SERVICE_NAME: Flpydisk
SERVICE_NAME: Ftdisk
SERVICE_NAME: i8042prt
SERVICE_NAME: isapnp
SERVICE_NAME: Kbdclass
SERVICE_NAME: KSecDD
SERVICE_NAME: Mouclass
SERVICE_NAME: MountMgr
SERVICE_NAME: Msfs
SERVICE_NAME: Mup
SERVICE_NAME: NDIS
SERVICE_NAME: Npfs
SERVICE_NAME: Null
SERVICE_NAME: PartMgr
SERVICE_NAME: PCI
SERVICE_NAME: Pcmcia
SERVICE_NAME: rdpdr
SERVICE_NAME: redbook
SERVICE_NAME: sr
SERVICE_NAME: swenum
SERVICE_NAME: TermDD
SERVICE_NAME: Update
SERVICE_NAME: usbhub
SERVICE_NAME: usbohci
SERVICE_NAME: USBSTOR
SERVICE_NAME: VgaSave
SERVICE_NAME: VolSnap

------ Drivers [Stopped]

SERVICE_NAME: Abiosdsk
SERVICE_NAME: abp480n5
SERVICE_NAME: ACPIEC
SERVICE_NAME: adpu160m
SERVICE_NAME: aec
SERVICE_NAME: AegisP
SERVICE_NAME: AFD
SERVICE_NAME: Aha154x
SERVICE_NAME: aic78u2
SERVICE_NAME: aic78xx
SERVICE_NAME: ALiADWDM
SERVICE_NAME: amsint
SERVICE_NAME: asc
SERVICE_NAME: asc3350p
SERVICE_NAME: asc3550
SERVICE_NAME: ASCTRM
SERVICE_NAME: AsyncMac
SERVICE_NAME: Atdisk
SERVICE_NAME: Atmarpc
SERVICE_NAME: audstub
SERVICE_NAME: Auq68
SERVICE_NAME: AVG Anti-Spyware Driver
SERVICE_NAME: BCM42RLY
SERVICE_NAME: cbidf2k
SERVICE_NAME: cd20xrnt
SERVICE_NAME: Cdaudio
SERVICE_NAME: Changer
SERVICE_NAME: CmBatt
SERVICE_NAME: CmdIde
SERVICE_NAME: Cpqarray
SERVICE_NAME: dac960nt
SERVICE_NAME: dmboot
SERVICE_NAME: DMusic
SERVICE_NAME: dpti2o
SERVICE_NAME: drmkaud
SERVICE_NAME: E100B
SERVICE_NAME: Fips
SERVICE_NAME: gmer
SERVICE_NAME: Gpc
SERVICE_NAME: GTNDIS5
SERVICE_NAME: hpn
SERVICE_NAME: hpt3xx
SERVICE_NAME: HTTP
SERVICE_NAME: i2omgmt
SERVICE_NAME: i2omp
SERVICE_NAME: Imapi
SERVICE_NAME: ini910u
SERVICE_NAME: IntelIde
SERVICE_NAME: ip6fw
SERVICE_NAME: IpFilterDriver
SERVICE_NAME: IpInIp
SERVICE_NAME: IpNat
SERVICE_NAME: IPSec
SERVICE_NAME: irda
SERVICE_NAME: IRENUM
SERVICE_NAME: kmixer
SERVICE_NAME: lbrtfdc
SERVICE_NAME: mnmdd
SERVICE_NAME: Modem
SERVICE_NAME: mraid35x
SERVICE_NAME: MRxDAV
SERVICE_NAME: MRxSmb
SERVICE_NAME: MSKSSRV
SERVICE_NAME: MSPCLOCK
SERVICE_NAME: MSPQM
SERVICE_NAME: mssmbios
SERVICE_NAME: NdisTapi
SERVICE_NAME: Ndisuio
SERVICE_NAME: NdisWan
SERVICE_NAME: NDProxy
SERVICE_NAME: NetBIOS
SERVICE_NAME: NetBT
SERVICE_NAME: Ntfs
SERVICE_NAME: NwlnkFlt
SERVICE_NAME: NwlnkFwd
SERVICE_NAME: P3
SERVICE_NAME: Parport
SERVICE_NAME: ParVdm
SERVICE_NAME: PCIDump
SERVICE_NAME: PCIIde
SERVICE_NAME: PDCOMP
SERVICE_NAME: PDFRAME
SERVICE_NAME: PDRELI
SERVICE_NAME: PDRFRAME
SERVICE_NAME: perc2
SERVICE_NAME: perc2hib
SERVICE_NAME: PptpMiniport
SERVICE_NAME: PSched
SERVICE_NAME: Ptilink
SERVICE_NAME: ql1080
SERVICE_NAME: Ql10wnt
SERVICE_NAME: ql12160
SERVICE_NAME: ql1240
SERVICE_NAME: ql1280
SERVICE_NAME: RasAcd
SERVICE_NAME: Rasirda
SERVICE_NAME: Rasl2tp
SERVICE_NAME: RasPppoe
SERVICE_NAME: Raspti
SERVICE_NAME: Rdbss
SERVICE_NAME: RDPCDD
SERVICE_NAME: RDPWD
SERVICE_NAME: ROOTMODEM
SERVICE_NAME: Secdrv
SERVICE_NAME: serenum
SERVICE_NAME: Serial
SERVICE_NAME: Sfloppy
SERVICE_NAME: Simbad
SERVICE_NAME: SMCIRDA
SERVICE_NAME: Sparrow
SERVICE_NAME: splitter
SERVICE_NAME: Srv
SERVICE_NAME: swmidi
SERVICE_NAME: symc810
SERVICE_NAME: symc8xx
SERVICE_NAME: sym_hi
SERVICE_NAME: sym_u3
SERVICE_NAME: sysaudio
SERVICE_NAME: Tcpip
SERVICE_NAME: TDPIPE
SERVICE_NAME: TDTCP
SERVICE_NAME: TOSHIBASoftModem
SERVICE_NAME: TosIde
SERVICE_NAME: trid3d
SERVICE_NAME: Udfs
SERVICE_NAME: ultra
SERVICE_NAME: USB_RNDIS
SERVICE_NAME: ViaIde
SERVICE_NAME: Wanarp
SERVICE_NAME: wanatw
SERVICE_NAME: WDICA
SERVICE_NAME: wdmaud