Possible Keylogger or spyware issue

Download Ewido Security Suite it is a trial version of the program.

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will now go to the main screen

You will need to update ewido to the latest definition files.

• On the left hand side of the main screen click update
• Then click on Start Update

The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates

Once the updates are installed do the following:

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• During some scans with ewido it is finding cases of false positives.
• You will need to step through the process of cleaning files one-by-one.
• If ewido detects a file you KNOW to be legitimate, select none as the action.
• DO NOT select "Perform action on all infections"
• If you are unsure of any entry found select none for now.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report
Click Save report.
Save the report .txt file to your desktop.
Now close ewido security suite and post the results here.

Then Click start > control panel > user accounts > change the way users log on or off > uncheck fast user switching > restart you computor.

Download, unzip and run 'RootkitRevealer' from Sysinternals:
http://www.sysinternals.com/Utilities/RootkitRevealer.html
Once the program has started, press Scan and let it run.
When the scan is done, use 'File > Save' to place the logfile in a convenient location (such as the desktop). The default filename will be 'RootkitReveal.txt'.

Save your Log File
Copy/Paste the contecnts of that logfile into your next reply

NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

That way you should have a much simpler and clearer log file in which to peruse and evaluate.

——————————————————— ewido anti-malware - Scan report ——————————————————— + Created on: 3:39:28 PM, 2/5/2006 + Report-Checksum: 95361CC2 + Scan result: No infected objects found. ::Report End I will start the second part of your request and will post the results as soon as they are available. BTW I have been doing alot of reading on this forum since I posted my original request and have removed several high rated viruses as well as spyware/adware. I have downloaded most if not all of the antivirus/spyware programs that this site uses. So I believe that my system is far more secure than it was on the 29th of Jan. I am not saying it is 100%. There is one issue that still continues to pop-up when I reboot my computer and run Ad-Aware SE Plus. See below. Ad-Aware finds a change in the registry that involves notepad. I'll start to work on the other requests now. Thanks for your help. Ad-Aware event log 2/5/2006 12:07:01 PM> Registry modification detected 2/5/2006 12:07:01 PM> 2/5/2006 12:07:01 PM> Root:HKEY_LOCAL_MACHINE 2/5/2006 12:07:01 PM> Key:SOFTWARE\Classes\regfile\shell\open\command 2/5/2006 12:07:01 PM> Value: 2/5/2006 12:07:01 PM> Data:regedit.exe "%1" 2/5/2006 12:07:01 PM> New Data:NOTEPAD.EXE %1 2/5/2006 12:07:01 PM> 2/5/2006 2:54:41 PM> Registry modification detected 2/5/2006 2:54:41 PM> 2/5/2006 2:54:41 PM> Root:HKEY_LOCAL_MACHINE 2/5/2006 2:54:41 PM> Key:SOFTWARE\Classes\regfile\shell\open\command 2/5/2006 2:54:41 PM> Value: 2/5/2006 2:54:41 PM> Data:regedit.exe "%1" 2/5/2006 2:54:41 PM> New Data:NOTEPAD.EXE %1 2/5/2006 2:54:41 PM> 2/5/2006 2:56:07 PM> Registry modification detected 2/5/2006 2:56:07 PM> 2/5/2006 2:56:07 PM> Root:HKEY_LOCAL_MACHINE 2/5/2006 2:56:07 PM> Key:SOFTWARE\Classes\regfile\shell\open\command 2/5/2006 2:56:07 PM> Value: 2/5/2006 2:56:07 PM> Data:regedit.exe "%1" 2/5/2006 2:56:07 PM> New Data:NOTEPAD.EXE %1 2/5/2006 2:56:07 PM> 2/5/2006 2:58:44 PM> Registry modification detected 2/5/2006 2:58:44 PM> 2/5/2006 2:58:44 PM> Root:HKEY_LOCAL_MACHINE 2/5/2006 2:58:44 PM> Key:SOFTWARE\Classes\regfile\shell\open\command 2/5/2006 2:58:44 PM> Value: 2/5/2006 2:58:44 PM> Data:regedit.exe "%1" 2/5/2006 2:58:44 PM> New Data:NOTEPAD.EXE %1 2/5/2006 2:58:44 PM>

Little Eagle, I ran RootKitRevealer and let it run as requested. It seems to be hung-up on a cleaning-up mode and has been that way for about 1.5 hrs. I shut down my spyware/adware and firewall programs, unhooked from my network and let it run. Do I need to let it run or abort and try something else?

Sorry for the delay I hope you let it run. have seen it take more than two hours depending on the speed of the PC.

little eagle, There is an issue I am experiencing with the save feature. I let the program run as requested. After 5 hrs it ended and said Scan complete: 1 discrepancy found. I saved it to my desktop. But it never appeared. I searched my entire computer but the file does not exist. I had closed the program, so I ran another scan and after 4.5 hrs it completed. I tried again to save it to my desktop as well as other locations. The Rootkit save window will show the txt file on my desktop, but it is not there. Please advise.

Can you do a search for RootkitReveal.txt Then post another log from hijackthis also.

You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download AproposFix © Swandog46 from here:
http://swandog46.geekstogo.com/aproposfix.exe

Save it to your desktop but do NOT run it yet.

Then please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Once in Safe Mode, please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.

When the tool is finished, please reboot back into normal mode, and post a new HijackThis log, along with the entire contents of the log.txt file in the aproposfix folder.

Remove spybot. Download the new version of spybot
Update it but do not run it yet.

In add and remove programs remove Webroot's Spy Sweeper, and Lavasoft's Ad-Aware SE Plus.
You have both of them running guards protecting your system.
They can be reinstalled latter.

Then run spybot and post the results of the scan here.

3rd Part Service (registry key): Abiosdsk Start: 4 Type: 1 Error Control: 0 Service (registry key): abp480n5 Display name: abp480n5 Image path: \SystemRoot\system32\DRIVERS\ABP480N5.SYS Start: 4 Type: 1 Error Control: 1 Service (registry key): ACPI Display name: Microsoft ACPI Driver Image path: system32\DRIVERS\ACPI.sys Image size: 187776 Image MD5: A10C7534F7223F4A73A948967D00E69B Start: 0 Type: 1 Error Control: 1 Service (registry key): ACPIEC Start: 4 Type: 1 Error Control: 1 Service (registry key): adpu160m Display name: adpu160m Image path: \SystemRoot\system32\DRIVERS\adpu160m.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): aec Display name: Microsoft Kernel Acoustic Echo Canceller Image path: system32\drivers\aec.sys Image size: 142464 Image MD5: 841F385C6CFAF66B58FBD898722BB4F0 Start: 3 Type: 1 Error Control: 1 Service (registry key): AFD Display name: AFD Description: AFD Networking Support Environment Image path: \SystemRoot\System32\drivers\afd.sys Start: 1 Type: 1 Error Control: 1 Service (registry key): agp440 Display name: Intel AGP Bus Filter Image path: \SystemRoot\system32\DRIVERS\agp440.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): agpCPQ Display name: Compaq AGP Bus Filter Image path: \SystemRoot\system32\DRIVERS\agpCPQ.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): Aha154x Display name: Aha154x Image path: \SystemRoot\system32\DRIVERS\aha154x.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): aic78u2 Display name: aic78u2 Image path: \SystemRoot\system32\DRIVERS\aic78u2.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): aic78xx Display name: aic78xx Image path: \SystemRoot\system32\DRIVERS\aic78xx.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): Alerter Display name: Alerter Description: Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: NT AUTHORITY\LocalService Image path: %SystemRoot%\system32\svchost.exe -k LocalService Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 4 Type: 32 Error Control: 1 Depends On services: LanmanWorkstation Service (registry key): ALG Display name: Application Layer Gateway Service Description: Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Windows Firewall. Object name: NT AUTHORITY\LocalService Image path: %SystemRoot%\System32\alg.exe Image size: 44544 Image MD5: F1958FBF86D5C004CF19A5951A9514B7 Start: 3 Type: 16 Error Control: 1 Service (registry key): AliIde Display name: AliIde Image path: \SystemRoot\system32\DRIVERS\aliide.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): alim1541 Display name: ALI AGP Bus Filter Image path: \SystemRoot\system32\DRIVERS\alim1541.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): amdagp Display name: AMD AGP Bus Filter Driver Image path: \SystemRoot\system32\DRIVERS\amdagp.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): amsint Display name: amsint Image path: \SystemRoot\system32\DRIVERS\amsint.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): AppMgmt Display name: Application Management Description: Provides software installation services such as Assign, Publish, and Remove. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Service (registry key): Arp1394 Display name: 1394 ARP Client Protocol Description: 1394 ARP Client Protocol Image path: system32\DRIVERS\arp1394.sys Image size: 60800 Image MD5: F0D692B0BFFB46E30EB3CEA168BBC49F Start: 3 Type: 1 Error Control: 1 Depends On services: Tcpip Service (registry key): asc Display name: asc Image path: \SystemRoot\system32\DRIVERS\asc.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): asc3350p Display name: asc3350p Image path: \SystemRoot\system32\DRIVERS\asc3350p.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): asc3550 Display name: asc3550 Image path: \SystemRoot\system32\DRIVERS\asc3550.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): ASCTRM Display name: ASCTRM Start: 2 Type: 1 Error Control: 1 Service (registry key): ASP.NET Start: 0 Type: 0 Error Control: 0 Service (registry key): ASP.NET_1.1.4322 Start: 0 Type: 0 Error Control: 0 Service (registry key): aspnet_state Display name: ASP.NET State Service Description: Provides support for out-of-process session states for ASP.NET. If this service is stopped, out-of-process requests will not be processed. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: NT AUTHORITY\NetworkService Image path: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe Image size: 32768 Image MD5: E1A1206A4FB19B675E947B29CCD25FBA Start: 3 Type: 16 Error Control: 1 Service (registry key): aswTdi Start: 0 Type: 0 Error Control: 0 Service (registry key): AsyncMac Display name: RAS Asynchronous Media Driver Description: RAS Asynchronous Media Driver Image path: system32\DRIVERS\asyncmac.sys Image size: 14336 Image MD5: 02000ABF34AF4C218C35D257024807D6 Start: 3 Type: 1 Error Control: 1 Service (registry key): atapi Display name: Standard IDE/ESDI Hard Disk Controller Image path: system32\DRIVERS\atapi.sys Image size: 95360 Image MD5: CDFE4411A69C224BD1D11B2DA92DAC51 Start: 0 Type: 1 Error Control: 1 Service (registry key): Atdisk Start: 4 Type: 1 Error Control: 0 Service (registry key): Atmarpc Display name: ATM ARP Client Protocol Description: ATM ARP Client Protocol Image path: system32\DRIVERS\atmarpc.sys Image size: 59904 Image MD5: EC88DA854AB7D7752EC8BE11A741BB7F Start: 3 Type: 1 Error Control: 1 Depends On services: Tcpip Service (registry key): AudioSrv Display name: Windows Audio Description: Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: PlugPlay,RpcSs Service (registry key): audstub Display name: Audio Stub Driver Image path: system32\DRIVERS\audstub.sys Image size: 3072 Image MD5: D9F724AA26C010A217C97606B160ED68 Start: 3 Type: 1 Error Control: 1 Service (registry key): BattC Start: 0 Type: 0 Error Control: 0 Service (registry key): Beep Start: 1 Type: 1 Error Control: 1 Service (registry key): BITS Display name: Background Intelligent Transfer Service Description: Transfers data between clients and servers in the background. If BITS is disabled, features such as Windows Update will not work correctly. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Depends On services: RpcSs Service (registry key): Browser Display name: Computer Browser Description: Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: LanmanWorkstation,LanmanServer Service (registry key): bvrp_pci Start: 3 Type: 1 Error Control: 1 Service (registry key): CAISafe Display name: CA ISafe Object name: LocalSystem Image path: C:\WINDOWS\system32\ZoneLabs\isafe.exe Image size: 188416 Image MD5: F2AA32E37D59A5480A9C98B3C1D6A9B2 Start: 2 Type: 16 Error Control: 1 Service (registry key): cbidf Display name: cbidf Image path: \SystemRoot\system32\DRIVERS\cbidf2k.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): cbidf2k Start: 4 Type: 1 Error Control: 1 Service (registry key): cd20xrnt Display name: cd20xrnt Image path: \SystemRoot\system32\DRIVERS\cd20xrnt.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): Cdaudio Start: 1 Type: 1 Error Control: 0 Service (registry key): Cdfs Start: 4 Type: 2 Error Control: 1 Depends On group: "SCSI CDROM Class" Service (registry key): Cdrom Display name: CD-ROM Driver Image path: system32\DRIVERS\cdrom.sys Image size: 49536 Image MD5: AF9C19B3100FE010496B1A27181FBF72 Start: 1 Type: 1 Error Control: 1 Depends On group: "SCSI miniport" Service (registry key): Changer Start: 1 Type: 1 Error Control: 0 Service (registry key): CiSvc Display name: Indexing Service Description: Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language. Object name: LocalSystem Image path: %SystemRoot%\system32\cisvc.exe Image size: 5632 Image MD5: 3192BD04D032A9C4A85A3278C268A13A Start: 3 Type: 288 Error Control: 1 Depends On services: RPCSS Service (registry key): ClipSrv Display name: ClipBook Description: Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\system32\clipsrv.exe Image size: 33280 Image MD5: C8DEC22C4137D7A90F8BDF41CA4B82AE Start: 4 Type: 16 Error Control: 1 Depends On services: NetDDE Service (registry key): CmdIde Display name: CmdIde Image path: \SystemRoot\system32\DRIVERS\cmdide.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): COMSysApp Display name: COM+ System Application Description: Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} Image size: 5120 Image MD5: DD87DB7387B9EB441C5674888A0D840C Start: 3 Type: 16 Error Control: 1 Depends On services: rpcss Service (registry key): ContentFilter Start: 0 Type: 0 Error Control: 0 Service (registry key): ContentIndex Start: 0 Type: 0 Error Control: 0 Service (registry key): Cpqarray Display name: Cpqarray Image path: \SystemRoot\system32\DRIVERS\cpqarray.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): Creative Service for CDROM Access Display name: Creative Service for CDROM Access Object name: LocalSystem Image path: C:\WINDOWS\system32\CTsvcCDA.EXE Image size: 44032 Image MD5: 3C8B6609712F4FF78E521F6DCFC4032B Start: 2 Type: 16 Error Control: 1 Service (registry key): CryptSvc Display name: Cryptographic Services Description: Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: RpcSs Service (registry key): ctac32k Display name: Creative AC3 Software Decoder Image path: system32\drivers\ctac32k.sys Image size: 501760 Image MD5: 595854931858CBAD4B17C2D4681E65A1 Start: 3 Type: 1 Error Control: 1 Service (registry key): ctaud2k Display name: Creative Audio Driver (WDM) Image path: system32\drivers\ctaud2k.sys Image size: 439424 Image MD5: 30A2B412A17D15C895047EBFEE04774B Start: 3 Type: 1 Error Control: 1 Service (registry key): ctdvda2k Display name: Creative DVD-Audio Device Driver Image path: system32\drivers\ctdvda2k.sys Image size: 340704 Image MD5: 5A0EEB00B02FC78605AA9D3590B24978 Start: 3 Type: 1 Error Control: 1 Service (registry key): ctprxy2k Display name: Creative Proxy Driver Image path: system32\drivers\ctprxy2k.sys Image size: 7168 Image MD5: BA73E372305F208BF91983B131DDA42C Start: 3 Type: 1 Error Control: 1 Service (registry key): ctsfm2k Display name: Creative SoundFont Management Device Driver Image path: system32\drivers\ctsfm2k.sys Image size: 142848 Image MD5: 3E587E7E749ED072160A4689D3A383A6 Start: 3 Type: 1 Error Control: 1 Service (registry key): dac2w2k Display name: dac2w2k Image path: \SystemRoot\system32\DRIVERS\dac2w2k.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): dac960nt Display name: dac960nt Image path: \SystemRoot\system32\DRIVERS\dac960nt.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): DcomLaunch Display name: DCOM Server Process Launcher Description: Provides launch functionality for DCOM services. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost -k DcomLaunch Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Service (registry key): Defrag32 Display name: Defrag32 Start: 2 Type: 2 Error Control: 1 Service (registry key): Defrag32b Display name: Defrag32Boot Start: 0 Type: 1 Error Control: 1 Service (registry key): Dhcp Display name: DHCP Client Description: Manages network configuration by registering and updating IP addresses and DNS names. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: Tcpip,Afd,NetBT Service (registry key): Disk Display name: Disk Driver Image path: system32\DRIVERS\disk.sys Image size: 36352 Image MD5: 00CA44E4534865F8A3B64F7C0984BFF0 Start: 0 Type: 1 Error Control: 1 Depends On group: "SCSI miniport" Service (registry key): dlcc_device Display name: dlcc_device Object name: LocalSystem Image path: C:\WINDOWS\system32\dlcccoms.exe -service Image size: 491520 Image MD5: FFA104BF98B9677516B38421EE2810EE Start: 3 Type: 272 Error Control: 1 Service (registry key): dmadmin Display name: Logical Disk Manager Administrative Service Description: Configures hard disk drives and volumes. The service only runs for configuration processes and then stops. Object name: LocalSystem Image path: %SystemRoot%\System32\dmadmin.exe /com Image size: 224768 Image MD5: 554C7CB178FE3BD12450B81AD63ADBC3 Start: 3 Type: 32 Error Control: 1 Depends On services: RpcSs,PlugPlay,DmServer Service (registry key): dmboot Image path: System32\drivers\dmboot.sys Image size: 799744 Image MD5: C0FBB516E06E243F0CF31F597E7EBF7D Start: 4 Type: 1 Error Control: 1 Service (registry key): dmio Display name: Logical Disk Manager Driver Image path: System32\drivers\dmio.sys Image size: 153344 Image MD5: F5E7B358A732D09F4BCF2824B88B9E28 Start: 0 Type: 1 Error Control: 1 Service (registry key): dmload Image path: System32\drivers\dmload.sys Image size: 5888 Image MD5: E9317282A63CA4D188C0DF5E09C6AC5F Start: 0 Type: 1 Error Control: 1 Service (registry key): dmserver Display name: Logical Disk Manager Description: Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: RpcSs,PlugPlay Service (registry key): DMusic Display name: Microsoft Kernel DLS Syntheiszer Image path: system32\drivers\DMusic.sys Image size: 52864 Image MD5: A6F881284AC1150E37D9AE47FF601267 Start: 3 Type: 1 Error Control: 1 Service (registry key): Dnscache Display name: DNS Client Description: Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: NT AUTHORITY\NetworkService Image path: %SystemRoot%\system32\svchost.exe -k NetworkService Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: Tcpip Service (registry key): dpti2o Display name: dpti2o Image path: \SystemRoot\system32\DRIVERS\dpti2o.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): drmkaud Display name: Microsoft Kernel DRM Audio Descrambler Image path: system32\drivers\drmkaud.sys Image size: 2944 Image MD5: 1ED4DBBAE9F5D558DBBA4CC450E3EB2E Start: 3 Type: 1 Error Control: 1 Service (registry key): drvmcdb Image path: system32\drivers\drvmcdb.sys Image size: 87488 Image MD5: E814854E6B246CCF498874839AB64D77 Start: 0 Type: 1 Error Control: 0 Service (registry key): drvncdb Start: 0 Type: 0 Error Control: 0 Service (registry key): drvnddm Image path: system32\drivers\drvnddm.sys Image size: 40480 Image MD5: EE83A4EBAE70BC93CF14879D062F548B Start: 2 Type: 2 Error Control: 0 Service (registry key): E100B Display name: Intel® PRO Adapter Driver Image path: system32\DRIVERS\e100b325.sys Image size: 117760 Image MD5: 3FCA03CBCA11269F973B70FA483C88EF Start: 3 Type: 1 Error Control: 1 Service (registry key): e1express Display name: Intel® PRO/1000 PCI Express Network Connection Driver Image path: system32\DRIVERS\e1e5132.sys Image size: 180736 Image MD5: 0849EACDC01487573ADD86F5E470806C Start: 3 Type: 1 Error Control: 1 Service (registry key): ehRecvr Display name: Media Center Receiver Service Description: Media Center Service for TV and FM broadcast reception Object name: LocalSystem Image path: C:\WINDOWS\eHome\ehRecvr.exe Image size: 237568 Image MD5: 8301243BDE5B6CD316D79C0191D50D9A Start: 2 Type: 16 Error Control: 0 Depends On services: RPCSS Service (registry key): ehSched Display name: Media Center Scheduler Service Object name: LocalSystem Image path: C:\WINDOWS\eHome\ehSched.exe Image size: 102912 Image MD5: A53243709439AC2A4C216B817F8D7411 Start: 2 Type: 16 Error Control: 1 Depends On services: RPCSS Service (registry key): emupia Display name: E-mu Plug-in Architecture Driver Image path: system32\drivers\emupia2k.sys Image size: 77824 Image MD5: F619495027664E696ACC47522E4D8B44 Start: 3 Type: 1 Error Control: 1 Service (registry key): ERSvc Display name: Error Reporting Service Description: Allows error reporting for services and applictions running in non-standard environments. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 0 Depends On services: RpcSs Service (registry key): Eventlog Display name: Event Log Description: Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped. Object name: LocalSystem Image path: %SystemRoot%\system32\services.exe Image size: 108032 Image MD5: C6CE6EEC82F187615D1002BB3BB50ED4 Start: 2 Type: 32 Error Control: 1 Service (registry key): EventSystem Display name: COM+ Event System Description: Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: C:\WINDOWS\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Depends On services: RPCSS Service (registry key): ewido security suite control Display name: ewido security suite control Object name: LocalSystem Image path: C:\Program Files\ewido anti-malware\ewidoctrl.exe Image size: 13888 Image MD5: 26830B750372AB1BF29C95DEEBEB802F Start: 2 Type: 272 Error Control: 0 Service (registry key): ewido security suite driver Display name: ewido security suite driver Image path: \??\C:\Program Files\ewido anti-malware\guard.sys Image size: 3072 Image MD5: 2FF233E31AEFFF332F187E8E2ABFA6C5 Start: 1 Type: 1 Error Control: 0 Service (registry key): ewido security suite guard Display name: ewido security suite guard Object name: LocalSystem Image path: C:\Program Files\ewido anti-malware\ewidoguard.exe Image size: 151616 Image MD5: 34A50717AD686900F078F5208F8E908E Start: 2 Type: 272 Error Control: 0 Service (registry key): Fastfat Start: 4 Type: 2 Error Control: 1 Service (registry key): FastUserSwitchingCompatibility Display name: Fast User Switching Compatibility Description: Provides management for applications that require assistance in a multiple user environment. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Depends On services: TermService Service (registry key): Fax Display name: Fax Description: Enables you to send and receive faxes, utilizing fax resources available on this computer or on the network. Object name: LocalSystem Image path: %systemroot%\system32\fxssvc.exe Image size: 267776 Image MD5: FCBD571FA0EE8DC238944AE5FAB74461 Start: 2 Type: 16 Error Control: 1 Depends On services: TapiSrv,RpcSs,PlugPlay,Spooler Service (registry key): Fdc Display name: Floppy Disk Controller Driver Image path: system32\DRIVERS\fdc.sys Image size: 27392 Image MD5: CED2E8396A8838E59D8FD529C680E02C Start: 3 Type: 1 Error Control: 1 Service (registry key): Fips Start: 1 Type: 1 Error Control: 1 Service (registry key): Flpydisk Display name: Floppy Disk Driver Image path: system32\DRIVERS\flpydisk.sys Image size: 20480 Image MD5: 0DD1DE43115B93F4D85E889D7A86F548 Start: 3 Type: 1 Error Control: 1 Service (registry key): FltMgr Display name: FltMgr Description: File System Filter Manager Driver Image path: system32\DRIVERS\fltMgr.sys Image size: 124800 Image MD5: 157754F0DF355A9E0A6F54721914F9C6 Start: 0 Type: 2 Error Control: 1 Service (registry key): Fs_Rec Start: 1 Type: 8 Error Control: 0 Service (registry key): Ftdisk Display name: Volume Manager Driver Image path: system32\DRIVERS\ftdisk.sys Image size: 125056 Image MD5: 6AC26732762483366C3969C9E4D2259D Start: 0 Type: 1 Error Control: 1 Service (registry key): GEARAspiWDM Display name: GEARAspiWDM Image path: System32\Drivers\GEARAspiWDM.sys Image size: 14408 Image MD5: 32A73A8952580B284A47290ADB62032A Start: 3 Type: 1 Error Control: 1 Service (registry key): Gpc Display name: Generic Packet Classifier Description: Generic Packet Classifier Image path: system32\DRIVERS\msgpc.sys Image size: 35072 Image MD5: C0F1D4A21DE5A415DF8170616703DEBF Start: 3 Type: 1 Error Control: 1 Service (registry key): ha20x2k Display name: Creative 20X HAL Driver Image path: system32\drivers\ha20x2k.sys Image size: 1093632 Image MD5: F66DFA0E91672E87708AA98162777ADD Start: 3 Type: 1 Error Control: 1 Service (registry key): helpsvc Display name: Help and Support Description: Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: RPCSS Service (registry key): HidServ Display name: HID Input Service Description: Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: RpcSs Service (registry key): HidUsb Display name: Microsoft HID Class Driver Image path: system32\DRIVERS\hidusb.sys Image size: 9600 Image MD5: 1DE6783B918F540149AA69943BDFEBA8 Start: 3 Type: 1 Error Control: 0 Service (registry key): hpn Display name: hpn Image path: \SystemRoot\system32\DRIVERS\hpn.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): HSFHWBS2 Image path: system32\DRIVERS\HSFHWBS2.sys Image size: 212224 Image MD5: 77E4FF0B73BC0AEAAF39BF0C8104231F Start: 3 Type: 1 Error Control: 0 Service (registry key): HSF_DP Image path: system32\DRIVERS\HSF_DP.sys Image size: 1042432 Image MD5: 60E1604729A15EF4A3B05F298427B3B1 Start: 3 Type: 1 Error Control: 0 Service (registry key): HTTP Display name: HTTP Description: This service implements the hypertext transfer protocol (HTTP). If this service is disabled, any services that explicitly depend on it will fail to start. Image path: System32\Drivers\HTTP.sys Image size: 262400 Image MD5: BFB7B73C942E816C4FB4A5A7BAE87136 Start: 3 Type: 1 Error Control: 1 Service (registry key): HTTPFilter Display name: HTTP SSL Description: This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service, using the Secure Socket Layer (SSL). If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k HTTPFilter Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Depends On services: HTTP Service (registry key): i2omgmt Start: 1 Type: 1 Error Control: 1 Service (registry key): i2omp Display name: i2omp Image path: \SystemRoot\system32\DRIVERS\i2omp.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): i8042prt Display name: i8042 Keyboard and PS/2 Mouse Port Driver Image path: system32\DRIVERS\i8042prt.sys Image size: 52736 Image MD5: 5502B58EEF7486EE6F93F3F164DCB808 Start: 1 Type: 1 Error Control: 1 Service (registry key): IAANTMon Display name: Intel® Matrix Storage Event Monitor Object name: LocalSystem Image path: C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe Image size: 86140 Image MD5: D43E91E271C041BB86A6223462A41D28 Start: 2 Type: 16 Error Control: 0 Service (registry key): iastor Display name: Intel AHCI Controller Image path: system32\drivers\iastor.sys Image size: 872064 Image MD5: 9A65E42664D1534B68512CAAD0EFE963 Start: 0 Type: 1 Error Control: 1 Service (registry key): IDriverT Display name: InstallDriver Table Manager Description: Provides support for the Running Object Table for InstallShield Drivers Object name: LocalSystem Image path: "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" Image size: 69632 Image MD5: 1CF03C69B49ACB70C722DF92755C0C8C Start: 3 Type: 16 Error Control: 0 Service (registry key): ILADFtmi Start: 0 Type: 0 Error Control: 0 Service (registry key): Imapi Display name: CD-Burning Filter Driver Image path: system32\DRIVERS\imapi.sys Image size: 41856 Image MD5: F8AA320C6A0409C0380E5D8A99D76EC6 Start: 1 Type: 1 Error Control: 1 Service (registry key): ImapiService Display name: IMAPI CD-Burning COM Service Description: Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: C:\WINDOWS\system32\imapi.exe Image size: 150016 Image MD5: FA788520BCAC0F5D9D5CDE5615C0D931 Start: 3 Type: 16 Error Control: 1 Service (registry key): inetaccs Start: 0 Type: 0 Error Control: 0 Service (registry key): ini910u Display name: ini910u Image path: \SystemRoot\system32\DRIVERS\ini910u.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): Inport Start: 0 Type: 0 Error Control: 0 Service (registry key): IntelIde Display name: IntelIde Image path: \SystemRoot\system32\DRIVERS\intelide.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): intelppm Display name: Intel Processor Driver Image path: system32\DRIVERS\intelppm.sys Image size: 36096 Image MD5: 279FB78702454DFF2BB445F238C048D2 Start: 1 Type: 1 Error Control: 1 Service (registry key): Ip6Fw Display name: IPv6 Windows Firewall Driver Description: Provides intrusion prevention service for a home or small office network. Image path: system32\DRIVERS\Ip6Fw.sys Image size: 29056 Image MD5: 4448006B6BC60E6C027932CFC38D6855 Start: 3 Type: 1 Error Control: 1 Service (registry key): IpFilterDriver Display name: IP Traffic Filter Driver Description: IP Traffic Filter Driver Image path: System32\DRIVERS\ipfltdrv.sys Image size: 32896 Image MD5: 731F22BA402EE4B62748ADAF6363C182 Start: 3 Type: 1 Error Control: 1 Depends On services: Tcpip Service (registry key): IpInIp Display name: IP in IP Tunnel Driver Description: IP in IP Tunnel Driver Image path: system32\DRIVERS\ipinip.sys Image size: 20992 Image MD5: E1EC7F5DA720B640CD8FB8424F1B14BB Start: 3 Type: 1 Error Control: 1 Depends On services: Tcpip Service (registry key): IpNat Display name: IP Network Address Translator Description: IP Network Address Translator Image path: system32\DRIVERS\ipnat.sys Image size: 134912 Image MD5: E2168CBC7098FFE963C6F23F472A3593 Start: 3 Type: 1 Error Control: 1 Depends On services: Tcpip Service (registry key): iPodService Display name: iPodService Description: iPod hardware management services Object name: LocalSystem Image path: C:\Program Files\iPod\bin\iPodService.exe Image size: 323584 Image MD5: EDA049739349F0E837D4F55E8879D665 Start: 3 Type: 16 Error Control: 1 Depends On services: RPCSS Service (registry key): IPSec Display name: IPSEC driver Description: IPSEC driver Image path: system32\DRIVERS\ipsec.sys Image size: 74752 Image MD5: 64537AA5C003A6AFEEE1DF819062D0D1 Start: 1 Type: 1 Error Control: 1 Service (registry key): IRENUM Display name: IR Enumerator Service Image path: system32\DRIVERS\irenum.sys Image size: 11264 Image MD5: 50708DAA1B1CBB7D6AC1CF8F56A24410 Start: 3 Type: 1 Error Control: 1 Service (registry key): ISAPISearch Start: 0 Type: 0 Error Control: 0 Service (registry key): isapnp Display name: PnP ISA/EISA Bus Driver Image path: system32\DRIVERS\isapnp.sys Image size: 35840 Image MD5: E504F706CCB699C2596E9A3DA1596E87 Start: 0 Type: 1 Error Control: 3 Service (registry key): Kbdclass Display name: Keyboard Class Driver Image path: system32\DRIVERS\kbdclass.sys Image size: 24576 Image MD5: EBDEE8A2EE5393890A1ACEE971C4C246 Start: 1 Type: 1 Error Control: 1 Service (registry key): kbdhid Display name: Keyboard HID Driver Image path: system32\DRIVERS\kbdhid.sys Image size: 14848 Image MD5: E182FA8E49E8EE41B4ADC53093F3C7E6 Start: 1 Type: 1 Error Control: 0 Service (registry key): kmixer Display name: Microsoft Kernel Wave Audio Mixer Image path: system32\drivers\kmixer.sys Image size: 171776 Image MD5: D93CAD07C5683DB066B0B2D2D3790EAD Start: 3 Type: 1 Error Control: 1 Service (registry key): KSecDD Start: 0 Type: 1 Error Control: 1 Service (registry key): lanmanserver Display name: Server Description: Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Service (registry key): lanmanworkstation Display name: Workstation Description: Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Service (registry key): lbrtfdc Start: 1 Type: 1 Error Control: 0 Service (registry key): ldap Start: 0 Type: 0 Error Control: 0

4th and final part Service (registry key): LHidKe Display name: Logitech SetPoint HID Mouse Filter Driver Image path: system32\DRIVERS\LHidKE.Sys Image size: 25600 Image MD5: 31B582394DA3290DFF300F10952E9A4D Start: 3 Type: 1 Error Control: 1 Service (registry key): LicenseService Start: 0 Type: 0 Error Control: 0 Service (registry key): LmHosts Display name: TCP/IP NetBIOS Helper Description: Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution. Object name: NT AUTHORITY\LocalService Image path: %SystemRoot%\system32\svchost.exe -k LocalService Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: NetBT,Afd Service (registry key): LMouKE Display name: Logitech SetPoint Mouse Filter Driver Image path: system32\DRIVERS\LMouKE.Sys Image size: 68352 Image MD5: 90A794D0A0BF3531C4BA1C0510449629 Start: 3 Type: 1 Error Control: 1 Service (registry key): McrdSvc Display name: Media Center Extender Service Object name: NT AUTHORITY\LocalService Image path: C:\WINDOWS\ehome\mcrdsvc.exe Image size: 99328 Image MD5: DF0A511F38F16016BF658FCA0090CB87 Start: 2 Type: 16 Error Control: 1 Depends On services: RPCSS,SSDPSRV Service (registry key): MDM Display name: Machine Debug Manager Description: Supports local and remote debugging for Visual Studio and script debuggers. If this service is stopped, the debuggers will not function properly. Object name: LocalSystem Image path: "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" Image size: 322120 Image MD5: 11F714F85530A2BD134074DC30E99FCA Start: 2 Type: 272 Error Control: 1 Depends On services: RPCSS Service (registry key): mdmxsdk Image path: system32\DRIVERS\mdmxsdk.sys Image size: 11043 Image MD5: EEAEA6514BA7C9D273B5E87C4E1AAB30 Start: 2 Type: 1 Error Control: 0 Service (registry key): Messenger Display name: Messenger Description: Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 4 Type: 32 Error Control: 1 Depends On services: LanmanWorkstation,NetBIOS,PlugPlay,RpcSS Service (registry key): MHN Display name: MHN Description: Multimedia Home Networking (MHN) is a networking platform for Audio Video (AV) streaming applications on IP home networks. MHN enhances AV streaming performance and reliability by ensuring network quality-of-service (QoS) for AV applications by providing mechanisms for admission control, run time monitoring and enforcement, application feedback, and traffic prioritization. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Depends On services: TcpIp,Afd,RpcSs,mhndrv Service (registry key): MHNDRV Display name: MHN driver Description: Multimedia Home Network component driver Image path: system32\DRIVERS\mhndrv.sys Image size: 11008 Image MD5: 7F2F1D2815A6449D346FCCCBC569FBD6 Start: 3 Type: 1 Error Control: 1 Service (registry key): mnmdd Start: 1 Type: 1 Error Control: 0 Service (registry key): mnmsrvc Display name: NetMeeting Remote Desktop Sharing Description: Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: C:\WINDOWS\system32\mnmsrvc.exe Image size: 32768 Image MD5: F6415361201915B9FE3896B0E4E724FF Start: 3 Type: 272 Error Control: 1 Service (registry key): Modem Start: 3 Type: 1 Error Control: 0 Service (registry key): MODEMCSA Display name: Unimodem Streaming Filter Device Image path: system32\drivers\MODEMCSA.sys Image size: 16128 Image MD5: 1992E0D143B09653AB0F9C5E04B0FD65 Start: 3 Type: 1 Error Control: 1 Service (registry key): Mouclass Display name: Mouse Class Driver Image path: system32\DRIVERS\mouclass.sys Image size: 23040 Image MD5: 34E1F0031153E491910E12551400192C Start: 1 Type: 1 Error Control: 1 Service (registry key): mouhid Display name: Mouse HID Driver Image path: system32\DRIVERS\mouhid.sys Image size: 12160 Image MD5: B1C303E17FB9D46E87A98E4BA6769685 Start: 3 Type: 1 Error Control: 0 Service (registry key): MountMgr Start: 0 Type: 1 Error Control: 1 Service (registry key): mraid35x Display name: mraid35x Image path: \SystemRoot\system32\DRIVERS\mraid35x.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): MRxDAV Display name: WebDav Client Redirector Description: WebDav Client Redirector Image path: system32\DRIVERS\mrxdav.sys Image size: 181248 Image MD5: 46EDCC8F2DB2F322C24F48785CB46366 Start: 3 Type: 2 Error Control: 1 Service (registry key): MRxSmb Display name: MRXSMB Description: MRXSMB Image path: system32\DRIVERS\mrxsmb.sys Image size: 451584 Image MD5: 5DDC9A1B2EB5A4BF010CE8C019A18C1F Start: 1 Type: 2 Error Control: 1 Service (registry key): MSDTC Display name: Distributed Transaction Coordinator Description: Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: NT AUTHORITY\NetworkService Image path: C:\WINDOWS\system32\msdtc.exe Image size: 6144 Image MD5: C7C3D89EB0A6F3DBA622EA737FA335B1 Start: 3 Type: 16 Error Control: 1 Depends On services: RPCSS,SamSS Service (registry key): Msfs Start: 1 Type: 2 Error Control: 1 Service (registry key): MSIServer Display name: Windows Installer Description: Adds, modifies, and removes applications provided as a Windows Installer (*.msi) package. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: C:\WINDOWS\system32\msiexec.exe /V Image size: 78848 Image MD5: F5F0146580E7023ADB963879840777F8 Start: 3 Type: 32 Error Control: 1 Depends On services: RpcSs Service (registry key): MSKSSRV Display name: Microsoft Streaming Service Proxy Image path: system32\drivers\MSKSSRV.sys Image size: 7552 Image MD5: AE431A8DD3C1D0D0610CDBAC16057AD0 Start: 3 Type: 1 Error Control: 1 Service (registry key): MSPCLOCK Display name: Microsoft Streaming Clock Proxy Image path: system32\drivers\MSPCLOCK.sys Image size: 5376 Image MD5: 13E75FEF9DFEB08EEDED9D0246E1F448 Start: 3 Type: 1 Error Control: 1 Service (registry key): MSPQM Display name: Microsoft Streaming Quality Manager Proxy Image path: system32\drivers\MSPQM.sys Image size: 4992 Image MD5: 1988A33FF19242576C3D0EF9CE785DA7 Start: 3 Type: 1 Error Control: 1 Service (registry key): mssmbios Display name: Microsoft System Management BIOS Driver Image path: system32\DRIVERS\mssmbios.sys Image size: 15488 Image MD5: 469541F8BFD2B32659D5D463A6714BCE Start: 3 Type: 1 Error Control: 1 Service (registry key): Mup Display name: Mup Start: 0 Type: 2 Error Control: 1 Service (registry key): NDIS Display name: NDIS System Driver Start: 0 Type: 1 Error Control: 1 Service (registry key): NdisTapi Display name: Remote Access NDIS TAPI Driver Description: Remote Access NDIS TAPI Driver Image path: system32\DRIVERS\ndistapi.sys Image size: 9600 Image MD5: 08D43BBDACDF23F34D79E44ED35C1B4C Start: 3 Type: 1 Error Control: 1 Service (registry key): Ndisuio Display name: NDIS Usermode I/O Protocol Description: NDIS Usermode I/O Protocol Image path: system32\DRIVERS\ndisuio.sys Image size: 14592 Image MD5: EEFA1CE63805D2145978621BE5C6D955 Start: 3 Type: 1 Error Control: 1 Service (registry key): NdisWan Display name: Remote Access NDIS WAN Driver Description: Remote Access NDIS WAN Driver Image path: system32\DRIVERS\ndiswan.sys Image size: 91776 Image MD5: 0B90E255A9490166AB368CD55A529893 Start: 3 Type: 1 Error Control: 1 Service (registry key): NDProxy Start: 3 Type: 1 Error Control: 1 Service (registry key): NetBIOS Display name: NetBIOS Interface Description: NetBIOS Interface Image path: system32\DRIVERS\netbios.sys Image size: 34560 Image MD5: 3A2ACA8FC1D7786902CA434998D7CEB4 Start: 1 Type: 2 Error Control: 1 Service (registry key): NetBT Display name: NetBios over Tcpip Description: NetBios over Tcpip Image path: system32\DRIVERS\netbt.sys Image size: 162816 Image MD5: 0C80E410CD2F47134407EE7DD19CC86B Start: 1 Type: 1 Error Control: 1 Depends On services: Tcpip Service (registry key): NetDDE Display name: Network DDE Description: Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\system32\netdde.exe Image size: 111104 Image MD5: 05AFB5AD06462257BEA7495283C86D50 Start: 4 Type: 32 Error Control: 1 Depends On services: NetDDEDSDM Service (registry key): NetDDEdsdm Display name: Network DDE DSDM Description: Manages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\system32\netdde.exe Image size: 111104 Image MD5: 05AFB5AD06462257BEA7495283C86D50 Start: 4 Type: 32 Error Control: 1 Service (registry key): Netlogon Display name: Net Logon Description: Supports pass-through authentication of account logon events for computers in a domain. Object name: LocalSystem Image path: %SystemRoot%\system32\lsass.exe Image size: 13312 Image MD5: 84885F9B82F4D55C6146EBF6065D75D2 Start: 3 Type: 32 Error Control: 1 Depends On services: LanmanWorkstation Service (registry key): Netman Display name: Network Connections Description: Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 288 Error Control: 1 Depends On services: RpcSs Service (registry key): NetSvc Display name: Intel NCS NetService Description: Supports Intel® PROSet for Wired Connections. Object name: LocalSystem Image path: C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe Image size: 147456 Image MD5: 9DA26B773BD04B867A8E9F427CD048FC Start: 3 Type: 272 Error Control: 1 Depends On services: RPCSS Service (registry key): NIC1394 Display name: 1394 Net Driver Image path: system32\DRIVERS\nic1394.sys Image size: 61824 Image MD5: 5C5C53DB4FEF16CF87B9911C7E8C6FBC Start: 3 Type: 1 Error Control: 1 Service (registry key): Nla Display name: Network Location Awareness (NLA) Description: Collects and stores network configuration and location information, and notifies applications when this information changes. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Depends On services: Tcpip,Afd Service (registry key): Npfs Start: 1 Type: 2 Error Control: 1 Service (registry key): Ntfs Start: 4 Type: 2 Error Control: 1 Service (registry key): NtLmSsp Display name: NT LM Security Support Provider Description: Provides security to remote procedure call (RPC) programs that use transports other than named pipes. Object name: LocalSystem Image path: %SystemRoot%\system32\lsass.exe Image size: 13312 Image MD5: 84885F9B82F4D55C6146EBF6065D75D2 Start: 3 Type: 32 Error Control: 1 Service (registry key): NtmsSvc Display name: Removable Storage Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Depends On services: RpcSs Service (registry key): Null Start: 1 Type: 1 Error Control: 1 Service (registry key): nv Image path: system32\DRIVERS\nv4_mini.sys Image size: 3198304 Image MD5: 0A83977B8909FDA12E45112575A59BA7 Start: 3 Type: 1 Error Control: 0 Service (registry key): NVSvc Display name: NVIDIA Display Driver Service Description: Provides system and desktop level support to the NVIDIA display driver Object name: LocalSystem Image path: %SystemRoot%\system32\nvsvc32.exe Image size: 127043 Image MD5: 153C0BA143A174B38CB06338C6EF4CC5 Start: 2 Type: 16 Error Control: 1 Service (registry key): NwlnkFlt Display name: IPX Traffic Filter Driver Description: IPX Traffic Filter Driver Image path: system32\DRIVERS\nwlnkflt.sys Image size: 12416 Image MD5: B305F3FAD35083837EF46A0BBCE2FC57 Start: 3 Type: 1 Error Control: 1 Depends On services: NwlnkFwd Service (registry key): NwlnkFwd Display name: IPX Traffic Forwarder Driver Description: IPX Traffic Forwarder Driver Image path: system32\DRIVERS\nwlnkfwd.sys Image size: 32512 Image MD5: C99B3415198D1AAB7227F2C88FD664B9 Start: 3 Type: 1 Error Control: 1 Service (registry key): ohci1394 Display name: OHCI Compliant IEEE 1394 Host Controller Image path: system32\DRIVERS\ohci1394.sys Image size: 61056 Image MD5: 0951DB8E5823EA366B0E408D71E1BA2A Start: 0 Type: 1 Error Control: 1 Service (registry key): ose Display name: Office Source Engine Description: Saves installation files used for updates and repairs and is required for the downloading of Setup updates and Watson error reports. Object name: LocalSystem Image path: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" Image size: 89136 Image MD5: 7A56CF3E3F12E8AF599963B16F50FB6A Start: 3 Type: 16 Error Control: 1 Service (registry key): ossrv Display name: Creative OS Services Driver Image path: system32\drivers\ctoss2k.sys Image size: 114688 Image MD5: 1752C4130471B5D0BDE3CA21DD0C9088 Start: 3 Type: 1 Error Control: 1 Service (registry key): Outlook Start: 0 Type: 0 Error Control: 0 Service (registry key): Parport Display name: Parallel port driver Image path: system32\DRIVERS\parport.sys Image size: 80128 Image MD5: 29744EB4CE659DFE3B4122DEB45BC478 Start: 3 Type: 1 Error Control: 0 Service (registry key): PartMgr Start: 0 Type: 1 Error Control: 1 Service (registry key): ParVdm Start: 4 Type: 1 Error Control: 0 Depends On services: Parport Depends On group: "Parallel arbitrator" Service (registry key): PCI Display name: PCI Bus Driver Image path: system32\DRIVERS\pci.sys Image size: 68224 Image MD5: 8086D9979234B603AD5BC2F5D890B234 Start: 0 Type: 1 Error Control: 3 Service (registry key): PCIDump Start: 1 Type: 1 Error Control: 0 Service (registry key): PCIIde Image path: system32\DRIVERS\pciide.sys Image size: 3328 Image MD5: CCF5F451BB1A5A2A522A76E670000FF0 Start: 0 Type: 1 Error Control: 1 Service (registry key): Pcmcia Start: 4 Type: 1 Error Control: 1 Service (registry key): PDCOMP Start: 3 Type: 1 Error Control: 0 Service (registry key): PDEngine Display name: PDEngine Object name: LocalSystem Image path: "C:\Program Files\Raxco\PerfectDisk\PDEngine.exe" Image size: 483397 Image MD5: 97490FE14E2F0240D61D580B92766B88 Start: 3 Type: 272 Error Control: 1 Depends On services: RPCSS Service (registry key): PDFRAME Start: 3 Type: 1 Error Control: 0 Service (registry key): PDRELI Start: 3 Type: 1 Error Control: 0 Service (registry key): PDRFRAME Start: 3 Type: 1 Error Control: 0 Service (registry key): PDSched Display name: PDScheduler Object name: LocalSystem Image path: "C:\Program Files\Raxco\PerfectDisk\PDSched.exe" Image size: 241731 Image MD5: 5AB37FA77C0E6E382CA16299F4A198BA Start: 2 Type: 272 Error Control: 1 Depends On services: PDEngine Service (registry key): perc2 Display name: perc2 Image path: \SystemRoot\system32\DRIVERS\perc2.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): perc2hib Display name: perc2hib Image path: \SystemRoot\system32\DRIVERS\perc2hib.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): PerfDisk Start: 0 Type: 0 Error Control: 0 Service (registry key): PerfNet Start: 0 Type: 0 Error Control: 0 Service (registry key): PerfOS Start: 0 Type: 0 Error Control: 0 Service (registry key): PerfProc Start: 0 Type: 0 Error Control: 0 Service (registry key): PlugPlay Display name: Plug and Play Description: Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. Object name: LocalSystem Image path: %SystemRoot%\system32\services.exe Image size: 108032 Image MD5: C6CE6EEC82F187615D1002BB3BB50ED4 Start: 2 Type: 32 Error Control: 1 Service (registry key): PolicyAgent Display name: IPSEC Services Description: Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver. Object name: LocalSystem Image path: %SystemRoot%\system32\lsass.exe Image size: 13312 Image MD5: 84885F9B82F4D55C6146EBF6065D75D2 Start: 2 Type: 32 Error Control: 1 Depends On services: RPCSS,Tcpip,IPSec Service (registry key): PptpMiniport Display name: WAN Miniport (PPTP) Description: WAN Miniport (PPTP) Image path: system32\DRIVERS\raspptp.sys Image size: 48384 Image MD5: 1C5CC65AAC0783C344F16353E60B72AC Start: 3 Type: 1 Error Control: 1 Service (registry key): ProtectedStorage Display name: Protected Storage Description: Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users. Object name: LocalSystem Image path: %SystemRoot%\system32\lsass.exe Image size: 13312 Image MD5: 84885F9B82F4D55C6146EBF6065D75D2 Start: 2 Type: 288 Error Control: 1 Depends On services: RpcSs Service (registry key): PSched Display name: QoS Packet Scheduler Description: QoS Packet Scheduler Image path: system32\DRIVERS\psched.sys Image size: 69120 Image MD5: 48671F327553DCF1D27F6197F622A668 Start: 3 Type: 1 Error Control: 1 Depends On services: Gpc Service (registry key): Ptilink Display name: Direct Parallel Link Driver Description: Direct Parallel Link Driver Image path: system32\DRIVERS\ptilink.sys Image size: 17792 Image MD5: 80D317BD1C3DBC5D4FE7B1678C60CADD Start: 3 Type: 1 Error Control: 1 Service (registry key): PxHelp20 Display name: PxHelp20 Image path: System32\Drivers\PxHelp20.sys Image size: 20640 Image MD5: 86724469CD077901706854974CD13C3E Start: 0 Type: 1 Error Control: 1 Service (registry key): ql1080 Display name: ql1080 Image path: \SystemRoot\system32\DRIVERS\ql1080.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): Ql10wnt Display name: Ql10wnt Image path: \SystemRoot\system32\DRIVERS\ql10wnt.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): ql12160 Display name: ql12160 Image path: \SystemRoot\system32\DRIVERS\ql12160.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): ql1240 Display name: ql1240 Image path: \SystemRoot\system32\DRIVERS\ql1240.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): ql1280 Display name: ql1280 Image path: \SystemRoot\system32\DRIVERS\ql1280.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): RasAcd Display name: Remote Access Auto Connection Driver Description: Remote Access Auto Connection Driver Image path: system32\DRIVERS\rasacd.sys Image size: 8832 Image MD5: FE0D99D6F31E4FAD8159F690D68DED9C Start: 1 Type: 1 Error Control: 1 Service (registry key): RasAuto Display name: Remote Access Auto Connection Manager Description: Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Depends On services: RasMan,Tapisrv Service (registry key): Rasl2tp Display name: WAN Miniport (L2TP) Description: WAN Miniport (L2TP) Image path: system32\DRIVERS\rasl2tp.sys Image size: 51328 Image MD5: 98FAEB4A4DCF812BA1C6FCA4AA3E115C Start: 3 Type: 1 Error Control: 1 Service (registry key): RasMan Display name: Remote Access Connection Manager Description: Creates a network connection. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Depends On services: Tapisrv Service (registry key): RasPppoe Display name: Remote Access PPPOE Driver Description: Remote Access PPPOE Driver Image path: system32\DRIVERS\raspppoe.sys Image size: 41472 Image MD5: 7306EEED8895454CBED4669BE9F79FAA Start: 3 Type: 1 Error Control: 1 Service (registry key): Raspti Display name: Direct Parallel Description: Direct Parallel Image path: system32\DRIVERS\raspti.sys Image size: 16512 Image MD5: FDBB1D60066FCFBB7452FD8F9829B242 Start: 3 Type: 1 Error Control: 1 Service (registry key): Rdbss Display name: Rdbss Description: Rdbss Image path: system32\DRIVERS\rdbss.sys Image size: 174592 Image MD5: 809CA45CAA9072B3176AD44579D7F688 Start: 1 Type: 2 Error Control: 1 Service (registry key): RDPCDD Image path: System32\DRIVERS\RDPCDD.sys Image size: 4224 Image MD5: 4912D5B403614CE99C28420F75353332 Start: 1 Type: 1 Error Control: 0 Service (registry key): RDPDD Start: 0 Type: 0 Error Control: 0 Service (registry key): rdpdr Display name: Terminal Server Device Redirector Driver Image path: system32\DRIVERS\rdpdr.sys Image size: 196864 Image MD5: A2CAE2C60BC37E0751EF9DDA7CEAF4AD Start: 3 Type: 1 Error Control: 1 Service (registry key): RDPNP Start: 0 Type: 0 Error Control: 0 Service (registry key): RDPWD Start: 3 Type: 1 Error Control: 0 Service (registry key): RDSessMgr Display name: Remote Desktop Help Session Manager Description: Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the Dependencies tab of the Properties dialog box. Object name: LocalSystem Image path: C:\WINDOWS\system32\sessmgr.exe Image size: 140800 Image MD5: 729798E0933076B8FCFCD9934698F164 Start: 3 Type: 16 Error Control: 1 Depends On services: RPCSS Service (registry key): redbook Display name: Digital CD Audio Playback Filter Driver Image path: system32\DRIVERS\redbook.sys Image size: 57472 Image MD5: B31B4588E4086D8D84ADBF9845C2402B Start: 1 Type: 1 Error Control: 1 Service (registry key): RemoteAccess Display name: Routing and Remote Access Description: Offers routing services to businesses in local area and wide area network environments. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 4 Type: 32 Error Control: 1 Depends On services: RpcSS Depends On group: NetBIOSGroup Service (registry key): RemoteRegistry Display name: Remote Registry Description: Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: NT AUTHORITY\LocalService Image path: %SystemRoot%\system32\svchost.exe -k LocalService Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 4 Type: 32 Error Control: 1 Depends On services: RPCSS Service (registry key): RetroLauncher Display name: Retrospect Launcher Description: Launches Retrospect automatically when scripts are waiting to run. Object name: LocalSystem Image path: C:\Program Files\Dantz\Retrospect\retrorun.exe Image size: 49152 Image MD5: 6FB9B33D20A2AAC7C89884246A0E25FB Start: 2 Type: 272 Error Control: 1 Service (registry key): Retrospect Helper Display name: Retrospect Helper Description: Helps Retrospect with various tasks. Object name: LocalSystem Image path: "C:\Program Files\Dantz\Retrospect\rthlpsvc.exe" Image size: 110592 Image MD5: 5B767DF028DC39D4246F09F5628D7FDD Start: 2 Type: 272 Error Control: 1 Service (registry key): RetroWDSvc Display name: Retrospect WD Service Description: Provide Retrospect interface to Western Digital drives. Object name: LocalSystem Image path: C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe Image size: 46592 Image MD5: 6F5386267113FE4E0F87A882DE48C577 Start: 2 Type: 272 Error Control: 1 Service (registry key): RpcLocator Display name: Remote Procedure Call (RPC) Locator Description: Manages the RPC name service database. Object name: NT AUTHORITY\NetworkService Image path: %SystemRoot%\system32\locator.exe Image size: 75264 Image MD5: 793F04A09B15E7C6C11DBDFFAF06C0AB Start: 3 Type: 16 Error Control: 1 Depends On services: LanmanWorkstation Service (registry key): RpcSs Display name: Remote Procedure Call (RPC) Description: Provides the endpoint mapper and other miscellaneous RPC services. Object name: NT AUTHORITY\NetworkService Image path: %SystemRoot%\system32\svchost -k rpcss Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Service (registry key): RSVP Display name: QoS RSVP Description: Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets. Object name: LocalSystem Image path: %SystemRoot%\system32\rsvp.exe Image size: 132608 Image MD5: 471B3F9741D762ABE75E9DEEA4787E47 Start: 3 Type: 16 Error Control: 1 Depends On services: TcpIp,Afd,RpcSs Service (registry key): SamSs Display name: Security Accounts Manager Description: Stores security information for local user accounts. Object name: LocalSystem Image path: %SystemRoot%\system32\lsass.exe Image size: 13312 Image MD5: 84885F9B82F4D55C6146EBF6065D75D2 Start: 2 Type: 32 Error Control: 1 Depends On services: RPCSS Service (registry key): SCardSvr Display name: Smart Card Description: Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: NT AUTHORITY\LocalService Image path: %SystemRoot%\System32\SCardSvr.exe Image size: 95744 Image MD5: 25D8DE134DF108E3DBC8D7D23B1AA58E Start: 3 Type: 32 Error Control: 0 Depends On services: PlugPlay Service (registry key): Schedule Display name: Task Scheduler Description: Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: RpcSs Service (registry key): Secdrv Display name: Secdrv Description: SafeDisc driver Image path: system32\DRIVERS\secdrv.sys Image size: 27440 Image MD5: D26E26EA516450AF9D072635C60387F4 Start: 3 Type: 1 Error Control: 1 Service (registry key): seclogon Display name: Secondary Logon Description: Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 288 Error Control: 0 Service (registry key): SENS Display name: System Event Notification Description: Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: EventSystem Service (registry key): serenum Display name: Serenum Filter Driver Image path: system32\DRIVERS\serenum.sys Image size: 15488 Image MD5: A2D868AEEFF612E70E213C451A70CAFB Start: 3 Type: 1 Error Control: 1 Service (registry key): Serial Display name: Serial port driver Image path: system32\DRIVERS\serial.sys Image size: 64896 Image MD5: CD9404D115A00D249F70A371B46D5A26 Start: 1 Type: 1 Error Control: 0 Service (registry key): Sfloppy Start: 1 Type: 1 Error Control: 0 Depends On group: "SCSI miniport" Service (registry key): SharedAccess Display name: Windows Firewall/Internet Connection Sharing (ICS) Description: Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: Netman,WinMgmt Service (registry key): ShellHWDetection Display name: Shell Hardware Detection Description: Provides notifications for AutoPlay hardware events. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 0 Depends On services: RpcSs Service (registry key): Simbad Start: 4 Type: 1 Error Control: 1 Service (registry key): sisagp Display name: SIS AGP Bus Filter Image path: \SystemRoot\system32\DRIVERS\sisagp.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): SNMP Display name: SNMP Service Description: Includes agents that monitor the activity in network devices and report to the network console workstation. Object name: LocalSystem Image path: %SystemRoot%\System32\snmp.exe Image size: 32768 Image MD5: D923BF27723E28E3C121B77F52DB4BCE Start: 2 Type: 16 Error Control: 1 Depends On services: EventLog Service (registry key): SNMPTRAP Display name: SNMP Trap Service Description: Receives trap messages generated by local or remote SNMP agents and forwards the messages to SNMP management programs running on this computer. Object name: NT AUTHORITY\LocalService Image path: %SystemRoot%\System32\snmptrap.exe Image size: 8704 Image MD5: 6F591DBEFD11F7697042907B516F1212 Start: 3 Type: 16 Error Control: 1 Depends On services: EventLog Service (registry key): Sparrow Display name: Sparrow Image path: \SystemRoot\system32\DRIVERS\sparrow.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): splitter Display name: Microsoft Kernel Audio Splitter Image path: system32\drivers\splitter.sys Image size: 6400 Image MD5: 8E186B8F23295D1E42C573B82B80D548 Start: 3 Type: 1 Error Control: 1 Service (registry key): Spooler Display name: Print Spooler Description: Loads files to memory for later printing. Object name: LocalSystem Image path: %SystemRoot%\system32\spoolsv.exe Image size: 57856 Image MD5: DA81EC57ACD4CDC3D4C51CF3D409AF9F Start: 2 Type: 272 Error Control: 1 Depends On services: RPCSS Service (registry key): sr Display name: System Restore Filter Driver Image path: system32\DRIVERS\sr.sys Image size: 73472 Image MD5: E41B6D037D6CD08461470AF04500DC24 Start: 0 Type: 2 Error Control: 1 Service (registry key): srservice Display name: System Restore Service Description: Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: RpcSs Service (registry key): Srv Display name: Srv Description: Srv Image path: system32\DRIVERS\srv.sys Image size: 332544 Image MD5: 553007ECCE7F6565BBE645BEB66D3B69 Start: 3 Type: 2 Error Control: 1 Service (registry key): sscdbhk5 Image path: system32\drivers\sscdbhk5.sys Image size: 5627 Image MD5: D7968049BE0ADBB6A57CEE3960320911 Start: 1 Type: 2 Error Control: 0 Service (registry key): SSDPSRV Display name: SSDP Discovery Service Description: Enables discovery of UPnP devices on your home network. Object name: NT AUTHORITY\LocalService Image path: %SystemRoot%\system32\svchost.exe -k LocalService Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 16 Error Control: 1 Depends On services: HTTP Service (registry key): ssrtln Image path: system32\drivers\ssrtln.sys Image size: 23545 Image MD5: C3FFD65ABFB6441E7606CF74F1155273 Start: 1 Type: 2 Error Control: 0 Service (registry key): stisvc Display name: Windows Image Acquisition (WIA) Description: Provides image acquisition services for scanners and cameras. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k imgsvc Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: RpcSs Service (registry key): swenum Display name: Software Bus Driver Image path: system32\DRIVERS\swenum.sys Image size: 4352 Image MD5: 03C1BAE4766E2450219D20B993D6E046 Start: 3 Type: 1 Error Control: 1 Service (registry key): swmidi Display name: Microsoft Kernel GS Wavetable Synthesizer Image path: system32\drivers\swmidi.sys Image size: 54272 Image MD5: 94ABC808FC4B6D7D2BBF42B85E25BB4D Start: 3 Type: 1 Error Control: 1 Service (registry key): SwPrv Display name: MS Software Shadow Copy Provider Description: Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: C:\WINDOWS\system32\dllhost.exe /Processid:{6F6160A9-C71A-4D34-91A0-5B9E71074979} Image size: 5120 Image MD5: DD87DB7387B9EB441C5674888A0D840C Start: 3 Type: 16 Error Control: 0 Depends On services: rpcss Service (registry key): symc810 Display name: symc810 Image path: \SystemRoot\system32\DRIVERS\symc810.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): symc8xx Display name: symc8xx Image path: \SystemRoot\system32\DRIVERS\symc8xx.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): sym_hi Display name: sym_hi Image path: \SystemRoot\system32\DRIVERS\sym_hi.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): sym_u3 Display name: sym_u3 Image path: \SystemRoot\system32\DRIVERS\sym_u3.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): sysaudio Display name: Microsoft Kernel System Audio Device Image path: system32\drivers\sysaudio.sys Image size: 60800 Image MD5: 650AD082D46BAC0E64C9C0E0928492FD Start: 3 Type: 1 Error Control: 1 Service (registry key): SysmonLog Display name: Performance Logs and Alerts Description: Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: NT Authority\NetworkService Image path: %SystemRoot%\system32\smlogsvc.exe Image size: 89600 Image MD5: 8B54AA346D1B1B113FFAA75501B8B1B2 Start: 3 Type: 16 Error Control: 1 Service (registry key): TapiSrv Display name: Telephony Description: Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Depends On services: PlugPlay,RpcSs Service (registry key): Tcpip Display name: TCP/IP Protocol Driver Description: TCP/IP Protocol Driver Image path: system32\DRIVERS\tcpip.sys Image size: 359808 Image MD5: 88763A98A4C26C409741B4AA162720C9 Start: 1 Type: 1 Error Control: 1 Depends On services: IPSec Service (registry key): TDPIPE Start: 3 Type: 1 Error Control: 0 Service (registry key): TDTCP Start: 3 Type: 1 Error Control: 0 Service (registry key): TermDD Display name: Terminal Device Driver Image path: system32\DRIVERS\termdd.sys Image size: 40840 Image MD5: A540A99C281D933F3D69D55E48727F47 Start: 1 Type: 1 Error Control: 1 Service (registry key): TermService Display name: Terminal Services Description: Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost -k DComLaunch Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Depends On services: RPCSS Service (registry key): tfsnboio Image path: system32\dla\tfsnboio.sys Image size: 25883 Image MD5: 30698355067D07DA5F9EB81132C9FDD6 Start: 2 Type: 2 Error Control: 0 Service (registry key): tfsncofs Image path: system32\dla\tfsncofs.sys Image size: 34843 Image MD5: FB9D825BB4A2ABDF24600F7505050E2B Start: 2 Type: 2 Error Control: 0 Service (registry key): tfsndrct Image path: system32\dla\tfsndrct.sys Image size: 4123 Image MD5: CAFD8CCA11AA1E8B6D2EA1BA8F70EC33 Start: 2 Type: 2 Error Control: 0 Service (registry key): tfsndres Image path: system32\dla\tfsndres.sys Image size: 2239 Image MD5: 8DB1E78FBF7C426D8EC3D8F1A33D6485 Start: 2 Type: 2 Error Control: 0 Service (registry key): tfsnifs Image path: system32\dla\tfsnifs.sys Image size: 86586 Image MD5: B92F67A71CC8176F331B8AA8D9F555AD Start: 2 Type: 2 Error Control: 0 Service (registry key): tfsnopio Image path: system32\dla\tfsnopio.sys Image size: 15227 Image MD5: 85985FAA9A71E2358FCC2EDEFC2A3C5C Start: 2 Type: 2 Error Control: 0 Service (registry key): tfsnpool Image path: system32\dla\tfsnpool.sys Image size: 6363 Image MD5: BBA22094F0F7C210567EFDAF11F64495 Start: 2 Type: 2 Error Control: 0 Service (registry key): tfsnudf Image path: system32\dla\tfsnudf.sys Image size: 98714 Image MD5: 81340BEF80B9811E98CE64611E67E3FF Start: 2 Type: 2 Error Control: 0 Service (registry key): tfsnudfa Image path: system32\dla\tfsnudfa.sys Image size: 100603 Image MD5: C035FD116224CCC8325F384776B6A8BB Start: 2 Type: 2 Error Control: 0 Service (registry key): Themes Display name: Themes Description: Provides user experience theme management. Object name: LocalSystem Image path: %SystemRoot%\System32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Service (registry key): TlntSvr Display name: Telnet Description: Enables a remote user to log on to this computer and run programs, and supports various TCP/IP Telnet clients, including UNIX-based and Windows-based computers. If this service is stopped, remote user access to programs might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: C:\WINDOWS\system32\tlntsvr.exe Image size: 73216 Image MD5: 37DB0A7D097310E8B4DE803FC3119C78 Start: 4 Type: 16 Error Control: 1 Depends On services: RPCSS,TCPIP,NTLMSSP Service (registry key): TosIde Display name: TosIde Image path: \SystemRoot\system32\DRIVERS\toside.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): TrkWks Display name: Distributed Link Tracking Client Description: Maintains links between NTFS files within a computer or across computers in a network domain. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: RpcSs Service (registry key): TSDDD Start: 0 Type: 0 Error Control: 0 Service (registry key): Udfs Start: 4 Type: 2 Error Control: 1 Service (registry key): ultra Display name: ultra Image path: \SystemRoot\system32\DRIVERS\ultra.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): UMWdf Display name: Windows User Mode Driver Framework Description: Enables Windows user mode drivers. Object name: NT AUTHORITY\LocalService Image path: C:\WINDOWS\system32\wdfmgr.exe Image size: 38912 Image MD5: 6634C460C56EC7E48D6BE20B745DC03A Start: 3 Type: 16 Error Control: 1 Depends On services: RpcSs Service (registry key): Update Display name: Microcode Update Driver Image path: system32\DRIVERS\update.sys Image size: 209408 Image MD5: AFF2E5045961BBC0A602BB6F95EB1345 Start: 3 Type: 1 Error Control: 1 Service (registry key): upnphost Display name: Universal Plug and Play Device Host Description: Provides support to host Universal Plug and Play devices. Object name: NT AUTHORITY\LocalService Image path: %SystemRoot%\system32\svchost.exe -k LocalService Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 3 Type: 32 Error Control: 1 Depends On services: SSDPSRV,HTTP Service (registry key): UPS Display name: Uninterruptible Power Supply Description: Manages an uninterruptible power supply (UPS) connected to the computer. Object name: NT AUTHORITY\LocalService Image path: %SystemRoot%\System32\ups.exe Image size: 18432 Image MD5: 3F5DF65B0758675F95A2D43918A740A3 Start: 3 Type: 16 Error Control: 1 Service (registry key): usb Start: 0 Type: 0 Error Control: 0 Service (registry key): usbccgp Display name: Microsoft USB Generic Parent Driver Image path: system32\DRIVERS\usbccgp.sys Image size: 31616 Image MD5: BFFD9F120CC63BCBAA3D840F3EEF9F79 Start: 3 Type: 1 Error Control: 1 Service (registry key): usbehci Display name: Microsoft USB 2.0 Enhanced Host Controller Miniport Driver Image path: system32\DRIVERS\usbehci.sys Image size: 26624 Image MD5: 15E993BA2F6946B2BFBBFCD30398621E Start: 3 Type: 1 Error Control: 1 Service (registry key): usbhub Display name: Microsoft USB Standard Hub Driver Image path: system32\DRIVERS\usbhub.sys Image size: 57600 Image MD5: C72F40947F92CEA56A8FB532EDF025F1 Start: 3 Type: 1 Error Control: 1 Service (registry key): usbprint Display name: Microsoft USB PRINTER Class Image path: system32\DRIVERS\usbprint.sys Image size: 25856 Image MD5: A42369B7CD8886CD7C70F33DA6FCBCF5 Start: 3 Type: 1 Error Control: 1 Service (registry key): usbscan Display name: USB Scanner Driver Image path: system32\DRIVERS\usbscan.sys Image size: 15104 Image MD5: A6BC71402F4F7DD5B77FD7F4A8DDBA85 Start: 3 Type: 1 Error Control: 1 Service (registry key): USBSTOR Display name: USB Mass Storage Driver Image path: system32\DRIVERS\USBSTOR.SYS Image size: 26496 Image MD5: 6CD7B22193718F1D17A47A1CD6D37E75 Start: 3 Type: 1 Error Control: 1 Service (registry key): usbuhci Display name: Microsoft USB Universal Host Controller Miniport Driver Image path: system32\DRIVERS\usbuhci.sys Image size: 20480 Image MD5: F8FD1400092E23C8F2F31406EF06167B Start: 3 Type: 1 Error Control: 1 Service (registry key): VET-FILT Display name: VET File System Filter Start: 1 Type: 1 Error Control: 1 Service (registry key): VET-REC Display name: VET File System Recognizer Start: 1 Type: 1 Error Control: 1 Service (registry key): VETFDDNT Display name: VET Floppy Boot Sector Monitor Start: 1 Type: 1 Error Control: 1 Service (registry key): VETMONNT Display name: VET File and Macro Monitor Start: 1 Type: 1 Error Control: 1 Service (registry key): VgaSave Image path: \SystemRoot\System32\drivers\vga.sys Start: 1 Type: 1 Error Control: 0 Service (registry key): viaagp Display name: VIA AGP Bus Filter Image path: \SystemRoot\system32\DRIVERS\viaagp.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): ViaIde Display name: ViaIde Image path: \SystemRoot\system32\DRIVERS\viaide.sys Start: 4 Type: 1 Error Control: 1 Service (registry key): VolSnap Start: 0 Type: 1 Error Control: 1 Service (registry key): vsdatant Display name: vsdatant Image path: System32\vsdatant.sys Image size: 372816 Image MD5: 3B169081214C8C39E0A36E590D934C32 Start: 1 Type: 1 Error Control: 1 Depends On services: TCPIP Service (registry key): vsmon Display name: TrueVector Internet Monitor Description: Monitors internet traffic and generates alerts for disallowed access. Object name: LocalSystem Image path: C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service Image size: 1693448 Image MD5: 7E9C8F0BF97910E04A078799837BB6F2 Start: 2 Type: 272 Error Control: 1 Depends On services: Afd,RpcSs,vsdatant Service (registry key): VSS Display name: Volume Shadow Copy Description: Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\System32\vssvc.exe Image size: 289792 Image MD5: 3EE00364AE0FD8D604F46CBAF512838A Start: 3 Type: 16 Error Control: 1 Depends On services: RPCSS Service (registry key): w32time Display name: Windows Time Description: Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %SystemRoot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Service (registry key): W3SVC Start: 0 Type: 0 Error Control: 0 Service (registry key): Wanarp Display name: Remote Access IP ARP Driver Description: Remote Access IP ARP Driver Image path: system32\DRIVERS\wanarp.sys Image size: 34560 Image MD5: 984EF0B9788ABF89974CFED4BFBAACBC Start: 3 Type: 1 Error Control: 1 Service (registry key): wanatw Display name: WAN Miniport (ATW) Image path: system32\DRIVERS\wanatw4.sys Start: 3 Type: 1 Error Control: 1 Service (registry key): WDICA Start: 3 Type: 1 Error Control: 0 Service (registry key): wdmaud Display name: Microsoft WINMM WDM Audio Compatibility Driver Image path: system32\drivers\wdmaud.sys Image size: 82944 Image MD5: 2797F33EBF50466020C430EE4F037933 Start: 3 Type: 1 Error Control: 1 Service (registry key): WebClient Display name: WebClient Description: Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: NT AUTHORITY\LocalService Image path: %SystemRoot%\system32\svchost.exe -k LocalService Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 1 Depends On services: MRxDAV Service (registry key): winachsf Image path: system32\DRIVERS\HSF_CNXT.sys Image size: 680704 Image MD5: F59ED5A43B988A18EF582BB07B2327A7 Start: 3 Type: 1 Error Control: 0 Service (registry key): winmgmt Display name: Windows Management Instrumentation Description: Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Object name: LocalSystem Image path: %systemroot%\system32\svchost.exe -k netsvcs Image size: 14336 Image MD5: 8F078AE4ED187AAABC0A305146DE6716 Start: 2 Type: 32 Error Control: 0 Depends On services: RPCSS Service (registry key): Winsock Start: 3 Type: 4 Error Control: 1 Service (registry key): WinSock2 Start: 0 Type: 0 Error Control: 0 Service (registry key): WinTrust Start: 0 Type: 0 Error Control: 0 Service (registry key): WmdmPmS