Do any of these reg entries look abnormal?

  • Thread starter Thread starter Mark V
  • Start date Start date
M

Mark V

Joanna wrote in
Hi there,

I'm trying to solve the mystery of why a strange, title-less
window pops up on my PC before the logon window appears. I have
to click 'OK' on this blank window that has nothing but a 'zero'
as its 'message' in order for my PC to continue booting. I read
online that only services can run before the logon screen appears,
so that at least narrows it down to something that's loading from
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services (doesn't
it..?!). Anyway, I've spent all night trawling through every
single entry and I've made a list of all those that have an data
value of '2' in their "Start" D-Word value (as I discovered just
hours beforehand by trial and error that an entry of '2' =
'automatic' in services :-). I would like someone to tell me if
anything below looks weird (for example, I'm curious as to what
'Fips' might be!).
Click to expand...
[ snipped service list]

Firstly lots of things can run prior to a User logon. Not just
services.

But I suspect you are on the wrong track. It may be that you have a
"Legal Notice" set which would appear before the logon prompt.

Look at
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
\Winlogon\
for "LegalNoticeCaption", "LegalNoticeText" valunames and data.

Make a registry backup or at least export that key first. Then
remove the actual data from those valuenames. If this is a corporate
system consult with the administrators.

Or it could be something else of course. :-)
 
Hi there,

I'm trying to solve the mystery of why a strange, title-less window pops up
on my PC before the logon window appears. I have to click 'OK' on this
blank window that has nothing but a 'zero' as its 'message' in order for my
PC to continue booting. I read online that only services can run before the
logon screen appears, so that at least narrows it down to something that's
loading from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services (doesn't
it..?!).
Anyway, I've spent all night trawling through every single entry and I've
made a list of all those that have an data value of '2' in their "Start"
D-Word value (as I discovered just hours beforehand by trial and error that
an entry of '2' = 'automatic' in services :-). I would like someone to tell
me if anything below looks weird (for example, I'm curious as to what 'Fips'
might be!).

Thanks

Joanna

All services set to automatically run at boot:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD [AFD Networking
Support Environment]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASCTRM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgCore [My antivirus]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgFsh [My antivirus]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgServ [My antivirus]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver [Logical Disk
Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache [DNS Client]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem [COM+ Event
System]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fips
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver [Server]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation
[Workstation]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lbrtfdc [System Bus
Extender]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts [TCP/IP NetBIOS
Helper Service]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC [Distributed
Transaction Coordinator]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MxlW2k
[IDE\CdRomCompaq_DVD-ROM_DVD-113R]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman [Network
Connections]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtLmSsp [NT LM Security
Support Provider]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc [Removable
Storage]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ParVdm [Extended base]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PersFw [Kerio Personal
Firewall]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent [IPSEC
Policy Agent]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProtectedStorage
[Protected Storage]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto [Remote Access
Auto Connection Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan [Remote Access
Connection Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess [Routing
and Remote Access]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry [Remote
Registry Service]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator [Remote
Procedure Call (RPC) Locator]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs [Remote Procedure
Call (RPC)]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SamSs [Security
Accounts Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SchedulingAgent
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon [RunAs
Service]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS [System Event]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler [Print Spooler]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinMgmt [Windows
Management Instrumentation]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wmi [Windows Management
Instrumentation Driver Extensions]
 
Joanna wrote in
I'd read that earlier and hoped that's all it was, but there is no
entry for neither of the two names above in regedit. It's
definitely an error message as my PC was working fine until I done
a 'last known good configuration'. I installed Win 2k 6 days ago
and there was never any popup box like this, so I'm assuming it
has to be from a non-Microrsoft program, and since I've only been
using the OS 6 days, I haven't really had time to install new
software! I did try out 2 antivirus & 3 firewall programs, which
makes me suspect it's one of them that's the cuplrit.
Click to expand...

Okay.

I sure hope you've had your 6 day old system protected from the
Internet with a firewall or at least a NAT router since before it
first connected. If not, then anything could have happened in the
first 6 minutes.

I'll go back to the service list.
 
Joanna wrote in
Hi there,

I'm trying to solve the mystery of why a strange, title-less
window pops up on my PC before the logon window appears. I have
to click 'OK' on this blank window that has nothing but a 'zero'
as its 'message' in order for my PC to continue booting. I read
online that only services can run before the logon screen appears,
so that at least narrows it down to something that's loading from
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services (doesn't
it..?!). Anyway, I've spent all night trawling through every
single entry and I've made a list of all those that have an data
value of '2' in their "Start" D-Word value (as I discovered just
hours beforehand by trial and error that an entry of '2' =
'automatic' in services :-). I would like someone to tell me if
anything below looks weird (for example, I'm curious as to what
'Fips' might be!).

Thanks

Joanna

All services set to automatically run at boot:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD [AFD
Networking Support Environment]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASCTRM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgCore [My
antivirus]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgFsh [My
antivirus]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgServ [My
antivirus]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver
[Logical Disk Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache [DNS
Client]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem
[COM+ Event System]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fips
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver
[Server]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstat
ion [Workstation]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lbrtfdc
[System Bus Extender]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts
[TCP/IP NetBIOS Helper Service]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC
[Distributed Transaction Coordinator]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MxlW2k
[IDE\CdRomCompaq_DVD-ROM_DVD-113R]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman
[Network Connections]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtLmSsp [NT
LM Security Support Provider]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc
[Removable Storage]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ParVdm
[Extended base]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PersFw [Kerio
Personal Firewall]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
[IPSEC Policy Agent]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProtectedStora
ge [Protected Storage]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto
[Remote Access Auto Connection Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan
[Remote Access Connection Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess
[Routing and Remote Access]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry
[Remote Registry Service]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator
[Remote Procedure Call (RPC) Locator]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs [Remote
Procedure Call (RPC)]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SamSs
[Security Accounts Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SchedulingAgen
t HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon
[RunAs Service]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS [System
Event]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler
[Print Spooler]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinMgmt
[Windows Management Instrumentation]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wmi [Windows
Management Instrumentation Driver Extensions]
Click to expand...

This is Win2K?
I'll start by pointing you to
http://www.blkviper.com/WIN2K/servicecfg.htm
where you can get a better idea of what you need to run, may run,
should not (most likely) run. After you stop all the un-needed
stuff, is the problem still evident? There are a few above I have no
idea what they are.
 
Mark V said:
But I suspect you are on the wrong track. It may be that you have a
"Legal Notice" set which would appear before the logon prompt.

Look at
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
\Winlogon\
for "LegalNoticeCaption", "LegalNoticeText" valunames and data.
Click to expand...

I'd read that earlier and hoped that's all it was, but there is no entry for
neither of the two names above in regedit. It's definitely an error message
as my PC was working fine until I done a 'last known good configuration'. I
installed Win 2k 6 days ago and there was never any popup box like this, so
I'm assuming it has to be from a non-Microrsoft program, and since I've only
been using the OS 6 days, I haven't really had time to install new software!
I did try out 2 antivirus & 3 firewall programs, which makes me suspect it's
one of them that's the cuplrit.
 
Thanks for all the suggestions Mark, but I've decided to just concede defeat
and reinstall Win 2k. I probably should have mentioned that my system was
indeed hit by the MSBlast virus and the Win32 Worm within the first 6 hours
of going online after I furst installed Windows. I risked going online for
just a few minutes to download the latest version of my antivirus program
(the version I had on disk wasn't recognizing my password) and to download a
firewall. When I did finally install the antivirus it showed infected files
all over the place.
But I used my antivirus and the patch from Microsoft and everything was
running for fine for the following 3 days. The problem really seems to have
begun when I tried to manually remove Sygate and Bitdefender from my
registry and I think I may have deleted some necessary reg keys.
Anyway, I still have all my backups on floppies as this OS isn't even a week
old yet. I'll not be stupid enough to connect ever again without antivirus
and a firewall. I could have gotten away with it on Win98SE.

Joanna

Mark V said:
Joanna wrote in
Hi there,

I'm trying to solve the mystery of why a strange, title-less
window pops up on my PC before the logon window appears. I have
to click 'OK' on this blank window that has nothing but a 'zero'
as its 'message' in order for my PC to continue booting. I read
online that only services can run before the logon screen appears,
so that at least narrows it down to something that's loading from
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services (doesn't
it..?!). Anyway, I've spent all night trawling through every
single entry and I've made a list of all those that have an data
value of '2' in their "Start" D-Word value (as I discovered just
hours beforehand by trial and error that an entry of '2' =
'automatic' in services :-). I would like someone to tell me if
anything below looks weird (for example, I'm curious as to what
'Fips' might be!).

Thanks

Joanna

All services set to automatically run at boot:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD [AFD
Networking Support Environment]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASCTRM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgCore [My
antivirus]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgFsh [My
antivirus]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgServ [My
antivirus]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver
[Logical Disk Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache [DNS
Client]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem
[COM+ Event System]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fips
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver
[Server]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstat
ion [Workstation]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lbrtfdc
[System Bus Extender]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts
[TCP/IP NetBIOS Helper Service]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC
[Distributed Transaction Coordinator]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MxlW2k
[IDE\CdRomCompaq_DVD-ROM_DVD-113R]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman
[Network Connections]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtLmSsp [NT
LM Security Support Provider]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc
[Removable Storage]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ParVdm
[Extended base]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PersFw [Kerio
Personal Firewall]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
[IPSEC Policy Agent]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProtectedStora
ge [Protected Storage]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto
[Remote Access Auto Connection Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan
[Remote Access Connection Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess
[Routing and Remote Access]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry
[Remote Registry Service]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator
[Remote Procedure Call (RPC) Locator]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs [Remote
Procedure Call (RPC)]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SamSs
[Security Accounts Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SchedulingAgen
t HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon
[RunAs Service]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS [System
Event]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler
[Print Spooler]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinMgmt
[Windows Management Instrumentation]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wmi [Windows
Management Instrumentation Driver Extensions]
Click to expand...

This is Win2K?
I'll start by pointing you to
http://www.blkviper.com/WIN2K/servicecfg.htm
where you can get a better idea of what you need to run, may run,
should not (most likely) run. After you stop all the un-needed
stuff, is the problem still evident? There are a few above I have no
idea what they are.
Click to expand...
 
Joanna wrote in
Thanks for all the suggestions Mark, but I've decided to just
concede defeat and reinstall Win 2k. I probably should have
mentioned that my system was indeed hit by the MSBlast virus and
the Win32 Worm within the first 6 hours of going online after I
furst installed Windows. I risked going online for just a few
minutes to download the latest version of my antivirus program
(the version I had on disk wasn't recognizing my password) and to
download a firewall. When I did finally install the antivirus it
showed infected files all over the place.
But I used my antivirus and the patch from Microsoft and
everything was running for fine for the following 3 days. The
problem really seems to have begun when I tried to manually remove
Sygate and Bitdefender from my registry and I think I may have
deleted some necessary reg keys. Anyway, I still have all my
backups on floppies as this OS isn't even a week old yet. I'll
not be stupid enough to connect ever again without antivirus and a
firewall. I could have gotten away with it on Win98SE.
Click to expand...

The most important thing is in the lesson learned. Don't feel badly
as you are now way ahead of the "average" user. Good luck.

Joanna

Mark V said:
Joanna wrote in
Hi there,

I'm trying to solve the mystery of why a strange, title-less
window pops up on my PC before the logon window appears. I
have to click 'OK' on this blank window that has nothing but a
'zero' as its 'message' in order for my PC to continue booting.
I read online that only services can run before the logon
screen appears, so that at least narrows it down to something
that's loading from
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services (doesn't
it..?!). Anyway, I've spent all night trawling through every
single entry and I've made a list of all those that have an
data value of '2' in their "Start" D-Word value (as I
discovered just hours beforehand by trial and error that an
entry of '2' = 'automatic' in services :-). I would like
someone to tell me if anything below looks weird (for example,
I'm curious as to what 'Fips' might be!).

Thanks

Joanna

All services set to automatically run at boot:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD [AFD
Networking Support Environment]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASCTRM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgCore
[My antivirus]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgFsh [My
antivirus]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgServ
[My antivirus]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver
[Logical Disk Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache
[DNS Client]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem
[COM+ Event System]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fips
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserve
r [Server]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworks
tat ion [Workstation]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lbrtfdc
[System Bus Extender]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts
[TCP/IP NetBIOS Helper Service]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC
[Distributed Transaction Coordinator]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MxlW2k
[IDE\CdRomCompaq_DVD-ROM_DVD-113R]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman
[Network Connections]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtLmSsp
[NT LM Security Support Provider]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc
[Removable Storage]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ParVdm
[Extended base]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PersFw
[Kerio Personal Firewall]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
[IPSEC Policy Agent]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProtectedSt
ora ge [Protected Storage]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto
[Remote Access Auto Connection Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan
[Remote Access Connection Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAcces
s [Routing and Remote Access]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegis
try [Remote Registry Service]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator
[Remote Procedure Call (RPC) Locator]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs
[Remote Procedure Call (RPC)]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SamSs
[Security Accounts Manager]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SchedulingA
gen t
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon
[RunAs Service]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS
[System Event]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler
[Print Spooler]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinMgmt
[Windows Management Instrumentation]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wmi
[Windows Management Instrumentation Driver Extensions]
Click to expand...

This is Win2K?
I'll start by pointing you to
http://www.blkviper.com/WIN2K/servicecfg.htm
where you can get a better idea of what you need to run, may run,
should not (most likely) run. After you stop all the un-needed
stuff, is the problem still evident? There are a few above I
have no idea what they are.
Click to expand...
Click to expand...
 
Back
Top