Having Problems Again!!!

[ShadowPuterDude]

In addition, I have created a new installer that should extract ISeeYouXP correctly, now using a relative extraction path instead of an absolutely path. ISeeYouXP will not run after extraction. Instead the Installer will place a shortcut to ISeeYouXP on the Desktop. Double-click the ISeeYouXP shortcut to run ISeeYouXP.

[Pumpa]

Ok I need a new link to ProcessDll by Matt Chugg as the one in post 38 gives me a 404 error. have already downloaded the other two programs from the same post.

Cheers

[ShadowPuterDude]

Ok I need a new link to ProcessDll by Matt Chugg as the one in post 38 gives me a 404 error. have already downloaded the other two programs from the same post.

Cheers

Here you go http://downloads.malwareteks.com/ProcessDll.exe

[Pumpa]

[Pumpa]

[Pumpa]

Ok guys I've just tried twice to send the log but failed both times. The log is too big (100kb plus) as an attachment and by the looks to big to paste in the message.
Processdll failed. got an error message**The application failed to initialize properly(00xc0000135) Click to terminate the application) **
Need an email to send it to.
We could be running out of time here. Sorry.

Damian

[jholland1964]

For the ISeeYou log, split it up and paste it in multiple posts.

[Pumpa]

[Pumpa]

************************************************** **********************************
ISeeYouXP v2.0 Beta 13

ISeeYouXP v1.3.0-v2.0 Beta 13 Copyright - ShadowPuterDude
ISeeYouXP v1.2.9 and earlier Copyright - PhilliePhan
------------------------------------------------------------------------------------
**** PLEASE NOTE THAT MOST (if not ALL) OF THE ITEMS BELOW ARE NOT BADDIES! ****
**** PLEASE CONSULT A KNOWLEDGEABLE PERSON BEFORE TAKING ANY ACTION. ****
************************************************** **********************************

Windows/Browser/Java Versions:

Microsoft Windows XP Professional
Version: 5.1.2600
Service Pack: 2.0
Windows Directory: H:\WINDOWS

Internet Explorer
Version: 6.0.2900.2180
Build: 62900.2180
Language: English (United States)
Path: H:\Program Files\Internet Explorer


Boot State: Normal boot

Scan done at 18:21:12.18, Tue 27/11/2007

------------------------------------------------------------------------------------

ISeeYouXP installation folder and files

H:\ISEEYO~1\
bootst~1.vbs Mon 28 May 2007 14:26:48 A.... 359 0.35 K
change.log Wed 17 Oct 2007 18:49:26 A.... 4,902 4.79 K
chodefix.bat Wed 18 Apr 2007 13:57:18 A.... 5,387 5.26 K
fixchode.reg Wed 18 Apr 2007 13:22:12 A.... 528 0.52 K
fixexp~1.bat Sat 24 Feb 2007 13:29:40 A.... 487 0.47 K
getunk~1.bat Sat 12 Aug 2006 13:24:58 A.... 1,478 1.44 K
grep.exe Fri 24 Dec 2004 19:33:28 A.... 160,768 157.00 K
hideit.bat Wed 17 Oct 2007 21:00:56 A.... 1,072 1.05 K
ieinfo.vbs Mon 28 May 2007 13:51:28 A.... 514 0.50 K
iesecu~1.bat Sun 28 Oct 2007 22:52:32 A.... 72 0.07 K
iesecu~1.vbs Wed 7 Nov 2007 23:17:40 A.... 2,399 2.34 K
iseeyo~1.bat Wed 17 Oct 2007 21:00:34 A.... 209,237 204.33 K
libico~1.dll Tue 16 Mar 2004 18:37:50 A.... 898,048 877.00 K
libintl3.dll Sat 9 Oct 2004 12:25:46 A.... 101,888 99.50 K
locate.com Fri 14 Jan 2005 1:41:48 A.... 11,254 10.99 K
md5sum.exe Sun 5 Aug 2007 19:56:56 A.... 49,152 48.00 K
msconf~1.bat Sat 24 Feb 2007 1:40:10 A.... 578 0.56 K
osinfo.vbs Mon 28 May 2007 14:00:10 A.... 598 0.58 K
pcbutts.txt Sun 25 Mar 2007 9:04:02 A.... 5,167 5.04 K
pcre.dll Sun 14 Nov 2004 13:29:04 A.... 183,313 179.02 K
pv.exe Thu 2 Mar 2006 23:42:40 A.... 73,728 72.00 K
regedi~1.bat Fri 30 Mar 2007 20:16:02 A.... 650 0.63 K
regfix.bat Wed 18 Apr 2007 13:55:40 A.... 145 0.14 K
servic~1.vbs Mon 28 May 2007 17:06:48 A.... 672 0.66 K
showit.bat Wed 17 Oct 2007 21:01:22 A.... 1,013 0.99 K
swreg.exe Thu 5 Apr 2007 6:58:52 A.... 139,776 136.50 K
system~1.bat Wed 28 Feb 2007 21:55:02 A.... 369 0.36 K
taskmg~1.bat Sat 24 Feb 2007 13:24:08 A.... 288 0.28 K

28 items found: 28 files, 0 directories.
Total of file sizes: 1,853,842 bytes 1.77 M
3 Dir(s) 139,142,103,040 bytes free

------------------------------------------------------------------------------------

System Environment Variables

ALLUSERSPROFILE=H:\Documents and Settings\All Users
APPDATA=H:\Documents and Settings\Damian\Application Data
CLASSPATH=.;H:\Program Files\QuickTime\QTSystem\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=H:\Program Files\Common Files
COMPUTERNAME=DT-32F7CC931ADE
ComSpec=H:\WINDOWS\system32\cmd.exe
errcode=0
FP_NO_HOST_CHECK=NO
HOMEDRIVE=H:
HOMEPATH=\Documents and Settings\Damian
LOGONSERVER=\\DT-32F7CC931ADE
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=H:\WINDOWS\system32;H:\WINDOWS;H:\WINDOWS\sys tem32\wbem;H:\Program Files\QuickTime\QTSystem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WS F;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0401
ProgramFiles=H:\Program Files
PROMPT=$P$G
QTJAVA=H:\Program Files\QuickTime\QTSystem\QTJava.zip
SESSIONNAME=Console
SystemDrive=H:
SystemRoot=H:\WINDOWS
TEMP=H:\DOCUME~1\Damian\LOCALS~1\Temp
TMP=H:\DOCUME~1\Damian\LOCALS~1\Temp
USERDOMAIN=DT-32F7CC931ADE
USERNAME=Damian
USERPROFILE=H:\Documents and Settings\Damian
windir=H:\WINDOWS

------------------------------------------------------------------------------------

Showing any Pocket Killbox backup files

H:\!KILLBOX\
sstts.dll Wed 14 Nov 2007 17:43:56 A.... 320,608 313.09 K
sstts~1.dll Wed 14 Nov 2007 17:43:56 A.... 320,608 313.09 K

2 items found: 2 files, 0 directories.
Total of file sizes: 641,216 bytes 626.19 K

------------------------------------------------------------------------------------

Displaying BOOT.INI:

[boot loader]
timeout=1
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect

------------------------------------------------------------------------------------

Displaying SYSTEM.INI:

; for 16-bit app support

[drivers]
wave=mmdrv.dll
timer=timer.drv

[mci]
[driver32]
[386enh]
woafont=app850.FON
EGA80WOA.FON=EGA80850.FON
EGA40WOA.FON=EGA40850.FON
CGA80WOA.FON=CGA80850.FON
CGA40WOA.FON=CGA40850.FON

------------------------------------------------------------------------------------

Displaying WIN.INI:

; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
CMCDLLNAME32=mapi32.dll
CMCDLLNAME=mapi.dll
CMC=1
MAPIX=1
MAPIXVER=1.0.0.1
OLEMessaging=1
[MCI Extensions.BAK]
aif=MPEGVideo
aifc=MPEGVideo
aiff=MPEGVideo
asf=MPEGVideo
asx=MPEGVideo
au=MPEGVideo
m1v=MPEGVideo
m3u=MPEGVideo
mp2=MPEGVideo
mp2v=MPEGVideo
mp3=MPEGVideo
mpa=MPEGVideo
mpe=MPEGVideo
mpeg=MPEGVideo
mpg=MPEGVideo
mpv2=MPEGVideo
snd=MPEGVideo
wax=MPEGVideo
wm=MPEGVideo
wma=MPEGVideo
wmv=MPEGVideo
wmx=MPEGVideo
wpl=MPEGVideo
wvx=MPEGVideo

------------------------------------------------------------------------------------

Displaying Running Processes:

PROCESS PID PRIO PATH
smss.exe 788 Normal H:\WINDOWS\System32\smss.exe
csrss.exe 840 Normal H:\WINDOWS\system32\csrss.exe
winlogon.exe 868 High H:\WINDOWS\system32\winlogon.exe
services.exe 912 Normal H:\WINDOWS\system32\services.exe
lsass.exe 924 Normal H:\WINDOWS\system32\lsass.exe
svchost.exe 1112 Normal H:\WINDOWS\system32\svchost.exe
svchost.exe 1196 Normal H:\WINDOWS\system32\svchost.exe
svchost.exe 1260 Normal H:\WINDOWS\System32\svchost.exe
svchost.exe 1384 Normal H:\WINDOWS\system32\svchost.exe
svchost.exe 1448 Normal H:\WINDOWS\system32\svchost.exe
ccProxy.exe 1500 Normal H:\Program Files\Common Files\Symantec Shared\ccProxy.exe
ccSetMgr.exe 1540 Normal H:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
ISSVC.exe 1552 Normal H:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
SNDSrvc.exe 1564 Normal H:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
ccEvtMgr.exe 1604 Normal H:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
Explorer.EXE 1912 Normal H:\WINDOWS\Explorer.EXE
spoolsv.exe 200 Normal H:\WINDOWS\system32\spoolsv.exe
SOUNDMAN.EXE 732 Normal H:\WINDOWS\SOUNDMAN.EXE
ALCWZRD.EXE 812 Normal H:\WINDOWS\ALCWZRD.EXE
ccApp.exe 992 Normal H:\Program Files\Common Files\Symantec Shared\ccApp.exe
VPTray.exe 1180 Normal H:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
RUNDLL32.EXE 1352 Normal H:\WINDOWS\system32\RUNDLL32.EXE
OfficeKB.EXE 1780 Normal H:\PROGRA~1\OfficeKB\OfficeKB.EXE
guard.exe 1876 Normal H:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
DefWatch.exe 232 Normal H:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
jusched.exe 444 Normal H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
LxrSII1s.exe 508 Normal H:\WINDOWS\system32\LxrSII1s.exe
MDM.EXE 520 Normal H:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
THGuard.exe 572 Normal H:\Program Files\TrojanHunter 5.0\THGuard.exe
ctfmon.exe 1124 Normal H:\WINDOWS\system32\ctfmon.exe
nvsvc32.exe 616 Normal H:\WINDOWS\system32\nvsvc32.exe
svchost.exe 820 Normal H:\WINDOWS\system32\svchost.exe
AnyDVD.exe 928 High H:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
Rtvscan.exe 1240 Normal H:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
SymSPort.exe 1364 Normal H:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
AcroTray.exe 1444 Normal H:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
K9.exe 2068 Normal H:\Program Files\KeirNet\K9\K9.exe
alg.exe 2984 Normal H:\WINDOWS\System32\alg.exe
igfxsrvc.exe 3292 Normal H:\WINDOWS\system32\igfxsrvc.exe
svchost.exe 3656 Normal H:\WINDOWS\System32\svchost.exe
WgaTray.exe 3760 Normal H:\WINDOWS\system32\WgaTray.exe
wuauclt.exe 3828 Normal H:\WINDOWS\system32\wuauclt.exe
wuauclt.exe 400 Normal H:\WINDOWS\system32\wuauclt.exe
cmd.exe 3260 Normal H:\WINDOWS\system32\cmd.exe
ntvdm.exe 2052 Normal H:\WINDOWS\system32\ntvdm.exe
wmiprvse.exe 3752 Normal H:\WINDOWS\system32\wbem\wmiprvse.exe
pv.exe 3964 Normal H:\ISEEYO~1\pv.exe

------------------------------------------------------------------------------------

[Pumpa]

Displaying Windows Services:

Name: Alerter
Display Name: Alerter
Description: Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\svchost.exe -k LocalService
Start Mode: Disabled
State: Stopped

Name: ALG
Display Name: Application Layer Gateway Service
Description: Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Windows Firewall.
Path Name: H:\WINDOWS\System32\alg.exe
Start Mode: Manual
State: Running

Name: AppMgmt
Display Name: Application Management
Description: Provides software installation services such as Assign, Publish, and Remove.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Stopped

Name: AudioSrv
Display Name: Windows Audio
Description: Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running

Name: AVG Anti-Spyware Guard
Display Name: AVG Anti-Spyware Guard
Description:
Path Name: H:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
Start Mode: Auto
State: Running

Name: BITS
Display Name: Background Intelligent Transfer Service
Description: Transfers data between clients and servers in the background. If BITS is disabled, features such as Windows Update will not work correctly.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Stopped

Name: Browser
Display Name: Computer Browser
Description: Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running

Name: ccEvtMgr
Display Name: Symantec Event Manager
Description: Event propagation and logging service
Path Name: "H:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
Start Mode: Auto
State: Running

Name: ccProxy
Display Name: Symantec Network Proxy
Description: Symantec Proxy Service
Path Name: "H:\Program Files\Common Files\Symantec Shared\ccProxy.exe"
Start Mode: Auto
State: Running

Name: ccPwdSvc
Display Name: Symantec Password Validation
Description: User account management service
Path Name: "H:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"
Start Mode: Manual
State: Stopped

Name: ccSetMgr
Display Name: Symantec Settings Manager
Description: Settings storage and management service
Path Name: "H:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
Start Mode: Auto
State: Running

Name: CiSvc
Display Name: Indexing Service
Description: Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.
Path Name: H:\WINDOWS\system32\cisvc.exe
Start Mode: Manual
State: Stopped

Name: ClipSrv
Display Name: ClipBook
Description: Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\clipsrv.exe
Start Mode: Disabled
State: Stopped

Name: COMSysApp
Display Name: COM+ System Application
Description: Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
Start Mode: Manual
State: Stopped

Name: CryptSvc
Display Name: Cryptographic Services
Description: Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running

Name: DcomLaunch
Display Name: DCOM Server Process Launcher
Description: Provides launch functionality for DCOM services.
Path Name: H:\WINDOWS\system32\svchost -k DcomLaunch
Start Mode: Auto
State: Running

Name: DefWatch
Display Name: Symantec AntiVirus Definition Watcher
Description: Monitors and maintains virus definitions.
Path Name: "H:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe"
Start Mode: Auto
State: Running

Name: Dhcp
Display Name: DHCP Client
Description: Manages network configuration by registering and updating IP addresses and DNS names.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running

Name: dmadmin
Display Name: Logical Disk Manager Administrative Service
Description: Configures hard disk drives and volumes. The service only runs for configuration processes and then stops.
Path Name: H:\WINDOWS\System32\dmadmin.exe /com
Start Mode: Manual
State: Stopped

Name: dmserver
Display Name: Logical Disk Manager
Description: Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running

Name: Dnscache
Display Name: DNS Client
Description: Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\svchost.exe -k NetworkService
Start Mode: Auto
State: Running

Name: ERSvc
Display Name: Error Reporting Service
Description: Allows error reporting for services and applictions running in non-standard environments.
Path Name: H:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running

Name: Eventlog
Display Name: Event Log
Description: Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped.
Path Name: H:\WINDOWS\system32\services.exe
Start Mode: Auto
State: Running

Name: EventSystem
Display Name: COM+ Event System
Description: Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Running

Name: FastUserSwitchingCompatibility
Display Name: Fast User Switching Compatibility
Description: Provides management for applications that require assistance in a multiple user environment.
Path Name: H:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Manual
State: Running

Name: helpsvc
Display Name: Help and Support
Description: Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running

Name: HidServ
Display Name: HID Input Service
Description: Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running

Name: HTTPFilter
Display Name: HTTP SSL
Description: This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service, using the Secure Socket Layer (SSL). If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\System32\svchost.exe -k HTTPFilter
Start Mode: Manual
State: Running

Name: IDriverT
Display Name: InstallDriver Table Manager
Description: Provides support for the Running Object Table for InstallShield Drivers
Path Name: "H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"
Start Mode: Manual
State: Stopped

Name: ImapiService
Display Name: IMAPI CD-Burning COM Service
Description: Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\imapi.exe
Start Mode: Manual
State: Stopped

Name: ISSVC
Display Name: IS Service
Description: Internet Security Service
Path Name: "H:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe"
Start Mode: Auto
State: Running

Name: lanmanserver
Display Name: Server
Description: Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running

Name: lanmanworkstation
Display Name: Workstation
Description: Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Auto
State: Running

Name: LmHosts
Display Name: TCP/IP NetBIOS Helper
Description: Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.
Path Name: H:\WINDOWS\system32\svchost.exe -k LocalService
Start Mode: Auto
State: Running

Name: LxrSII1s
Display Name: Lexar Secure II
Description:
Path Name: LxrSII1s.exe
Start Mode: Auto
State: Running

Name: MDM
Display Name: Machine Debug Manager
Description: Supports local and remote debugging for Visual Studio and script debuggers. If this service is stopped, the debuggers will not function properly.
Path Name: "H:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"
Start Mode: Auto
State: Running

Name: Messenger
Display Name: Messenger
Description: Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Disabled
State: Stopped

Name: mnmsrvc
Display Name: NetMeeting Remote Desktop Sharing
Description: Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\mnmsrvc.exe
Start Mode: Manual
State: Stopped

Name: MSDTC
Display Name: Distributed Transaction Coordinator
Description: Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\msdtc.exe
Start Mode: Manual
State: Stopped

Name: MSIServer
Display Name: Windows Installer
Description: Adds, modifies, and removes applications provided as a Windows Installer (*.msi) package. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\msiexec.exe /V
Start Mode: Manual
State: Stopped

Name: NetDDE
Display Name: Network DDE
Description: Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\netdde.exe
Start Mode: Disabled
State: Stopped

Name: NetDDEdsdm
Display Name: Network DDE DSDM
Description: Manages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\netdde.exe
Start Mode: Disabled
State: Stopped

Name: Netlogon
Display Name: Net Logon
Description: Supports pass-through authentication of account logon events for computers in a domain.
Path Name: H:\WINDOWS\system32\lsass.exe
Start Mode: Manual
State: Stopped

Name: Netman
Display Name: Network Connections
Description: Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections.
Path Name: H:\WINDOWS\System32\svchost.exe -k netsvcs
Start Mode: Manual
State: Running

Name: Nla
Display Name: Network Location Awareness (NLA)
Description: Collects and stores network configuration and location information, and notifies applications when this information changes.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Running

Name: NtLmSsp
Display Name: NT LM Security Support Provider
Description: Provides security to remote procedure call (RPC) programs that use transports other than named pipes.
Path Name: H:\WINDOWS\system32\lsass.exe
Start Mode: Manual
State: Stopped

Name: NtmsSvc
Display Name: Removable Storage
Description:
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Stopped

Name: NVSvc
Display Name: WinFast(R) Display Driver Service
Description: Provides system and desktop level support to the WinFast(R) display driver
Path Name: H:\WINDOWS\system32\nvsvc32.exe
Start Mode: Auto
State: Running

Name: ose
Display Name: Office Source Engine
Description: Saves installation files used for updates and repairs and is required for the downloading of Setup updates and Watson error reports.
Path Name: "H:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
Start Mode: Manual
State: Stopped

Name: PlugPlay
Display Name: Plug and Play
Description: Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.
Path Name: H:\WINDOWS\system32\services.exe
Start Mode: Auto
State: Running

Name: PolicyAgent
Display Name: IPSEC Services
Description: Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver.
Path Name: H:\WINDOWS\system32\lsass.exe
Start Mode: Auto
State: Running

Name: ProtectedStorage
Display Name: Protected Storage
Description: Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users.
Path Name: H:\WINDOWS\system32\lsass.exe
Start Mode: Auto
State: Running

Name: RasAuto
Display Name: Remote Access Auto Connection Manager
Description: Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Stopped

Name: RasMan
Display Name: Remote Access Connection Manager
Description: Creates a network connection.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Manual
State: Running

Name: RDSessMgr
Display Name: Remote Desktop Help Session Manager
Description: Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the Dependencies tab of the Properties dialog box.
Path Name: H:\WINDOWS\system32\sessmgr.exe
Start Mode: Manual
State: Stopped

Name: RemoteAccess
Display Name: Routing and Remote Access
Description: Offers routing services to businesses in local area and wide area network environments.
Path Name: H:\WINDOWS\system32\svchost.exe -k netsvcs
Start Mode: Disabled
State: Stopped

Name: RemoteRegistry
Display Name: Remote Registry
Description: Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\system32\svchost.exe -k LocalService
Start Mode: Auto
State: Running

Name: RpcLocator
Display Name: Remote Procedure Call (RPC) Locator
Description: Manages the RPC name service database.
Path Name: H:\WINDOWS\system32\locator.exe
Start Mode: Manual
State: Stopped

Name: RpcSs
Display Name: Remote Procedure Call (RPC)
Description: Provides the endpoint mapper and other miscellaneous RPC services.
Path Name: H:\WINDOWS\system32\svchost -k rpcss
Start Mode: Auto
State: Running

Name: RSVP
Display Name: QoS RSVP
Description: Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets.
Path Name: H:\WINDOWS\system32\rsvp.exe
Start Mode: Manual
State: Stopped

Name: SamSs
Display Name: Security Accounts Manager
Description: Stores security information for local user accounts.
Path Name: H:\WINDOWS\system32\lsass.exe
Start Mode: Auto
State: Running

Name: SavRoam
Display Name: SAVRoam
Description: Symantec AntiVirus Roaming Service
Path Name: "H:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe"
Start Mode: Manual
State: Stopped

Name: SCardSvr
Display Name: Smart Card
Description: Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start.
Path Name: H:\WINDOWS\System32\SCardSvr.exe
Start Mode: Manual
State: Stopped