Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Computer Support > Disabling Task Mgr. in Windows XP

Reply
Thread Tools

Disabling Task Mgr. in Windows XP

 
 
Bob H
Guest
Posts: n/a
 
      02-04-2006
Trying to edit the registry to disable TM. Following the
HKEY_CURRENT_USER there is no System listed under Policies. The process
I'm following as follows:

There is a registry hack to enable or disable Windows NT TaskManager.
The same registry hack applies to Windows 2000 and Windows XP.

Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies \System
Name: DisableTaskMgr
Type: REG_DWORD
Value: 1=Enablethis key, that is DISABLE TaskManager
Value: 0=Disablethis key, that is Don't Disable, Enable TaskManager

Reply

 
Reply With Quote
 
 
 
 
Duane Arnold
Guest
Posts: n/a
 
      02-04-2006
Bob H wrote:
> Trying to edit the registry to disable TM. Following the
> HKEY_CURRENT_USER there is no System listed under Policies. The process
> I'm following as follows:
>
> There is a registry hack to enable or disable Windows NT TaskManager.
> The same registry hack applies to Windows 2000 and Windows XP.
>
> Hive: HKEY_CURRENT_USER
> Key: Software\Microsoft\Windows\CurrentVersion\Policies \System
> Name: DisableTaskMgr
> Type: REG_DWORD
> Value: 1=Enablethis key, that is DISABLE TaskManager
> Value: 0=Disablethis key, that is Don't Disable, Enable TaskManager
>
> Reply
>


And what would be your reasoning for disabling Task Manager?

Duane
 
Reply With Quote
 
 
 
 
old jon
Guest
Posts: n/a
 
      02-04-2006

"Duane Arnold" <(E-Mail Removed)> wrote in message
news:B34Ff.4920$(E-Mail Removed) nk.net...
> Bob H wrote:
>> Trying to edit the registry to disable TM. Following the

>

snipped
>
> And what would be your reasoning for disabling Task Manager?
>

He doesn`t want to know what`s going on in his machine <G>.
>
> Duane



 
Reply With Quote
 
Bob H
Guest
Posts: n/a
 
      02-04-2006
What do I need it for for one and I seem to find lots of folks looking
to disable it. I inhereted a computer that has some 70 items listed in
TM. I am a single computer home user with no networking involved. Does
having 70 items in TM slow my computer down?

 
Reply With Quote
 
p-nut
Guest
Posts: n/a
 
      02-04-2006
Bob H wrote:
> What do I need it for for one and I seem to find lots of folks looking
> to disable it. I inhereted a computer that has some 70 items listed in
> TM. I am a single computer home user with no networking involved. Does
> having 70 items in TM slow my computer down?


Yes, very much so, 35-50 would be normal.
Disabling TM isn't going to help anything though as all 70 of those
processes would still be running, you just couldn't get to TM to see what
all is running.

Can't say I've ever heard of anyone wanting to disable TM before your post.


 
Reply With Quote
 
Toolman Tim
Guest
Posts: n/a
 
      02-04-2006
In news:zn4Ff.89472$(E-Mail Removed),
p-nut spewed forth:
> Bob H wrote:
>> What do I need it for for one and I seem to find lots of folks
>> looking to disable it. I inhereted a computer that has some 70 items
>> listed in TM. I am a single computer home user with no networking
>> involved. Does having 70 items in TM slow my computer down?

>
> Yes, very much so, 35-50 would be normal.
> Disabling TM isn't going to help anything though as all 70 of those
> processes would still be running, you just couldn't get to TM to see
> what all is running.
>
> Can't say I've ever heard of anyone wanting to disable TM before your
> post.


It's called 'hijackers' and 'malware programmers'. I've had systems come to
me for work that didn't display TM or control panel or anything - the
crapware on it had fracked the system to prevent access to the tools needed
to remove it.

--
If at first you don't succeed, redefine success.


 
Reply With Quote
 
Bob H
Guest
Posts: n/a
 
      02-04-2006
OK fair enough - let me rephrase the question. Of the 70 that are
running how do I find some guidance as to what I can disable to get
down to 30 to 50?

 
Reply With Quote
 
old jon
Guest
Posts: n/a
 
      02-04-2006

"Bob H" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) oups.com...
> OK fair enough - let me rephrase the question. Of the 70 that are
> running how do I find some guidance as to what I can disable to get
> down to 30 to 50?
>

OK Bob. Go here
www.majorgeeks.com/page.php?id=12

and download, and print out `Black Vipers` list of services, that are `safe`
to disable.
This list applies to most average users.

--
bw..OJ


 
Reply With Quote
 
Duane Arnold
Guest
Posts: n/a
 
      02-04-2006
Bob H wrote:
> What do I need it for for one and I seem to find lots of folks looking
> to disable it. I inhereted a computer that has some 70 items listed in
> TM. I am a single computer home user with no networking involved. Does
> having 70 items in TM slow my computer down?
>


Task Manager is just a graphical user interface that shows you what is
running on the machine. It in no way is slowing the machine down as it
only runs when you request it to run. If you have not requested that it
run by showing you the screens of what is running, then how can Task
Manager be slowing down the machine if it's not running all the time as
the 70 items or processes you're looking at are running?

The problem is those 70 processes that are running with one or more
processes slowing the machine down and not Task Manager itself.

Duane

 
Reply With Quote
 
NC
Guest
Posts: n/a
 
      02-05-2006
"Bob H" <(E-Mail Removed)> wrote:

>Trying to edit the registry to disable TM. Following the
>HKEY_CURRENT_USER there is no System listed under Policies. The process
>I'm following as follows:
>
>There is a registry hack to enable or disable Windows NT TaskManager.
>The same registry hack applies to Windows 2000 and Windows XP.
>
>Hive: HKEY_CURRENT_USER
>Key: Software\Microsoft\Windows\CurrentVersion\Policies \System
>Name: DisableTaskMgr
>Type: REG_DWORD
>Value: 1=Enablethis key, that is DISABLE TaskManager
>Value: 0=Disablethis key, that is Don't Disable, Enable TaskManager
>
>Reply



Inelegant without the PDF format.
Someone had their website stolen out from under them.

NC
(Doesn't mean people forget.)


___________________________
BlackViper's PDF sent to text follows.
___________________________

Windows XP Home and Professional Service Configurations


Original content created July 28, 2001
Last update was Sunday, August 31, 2003


Copyright © 2001-2003 by Black Viper
All Rights Reserved.


All trademarks mentioned in this document are property of their
respective owners.

Up to date content and contact information is located at
http://www.blkviper.com or http://www.blackviper.com

Table of contents:
This Page: Page 1
Notes for a Happier Computer and User: Page 2
Table Header Information: Page 3
Services Configuration Table: Pages 4-12
Services Information: Pages 13-58
Strange Processes Pages 59-64

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 1 Revision 5: Sunday, August 31, 2003


Notes for a Happier Computer and User:


Do NOT use “msconfig” to disable services, type “services.msc” in the
Run box
instead!

Before disabling any service, check out the information about each
starting on Page 13 of
this document.

Service settings are global, meaning changes apply to all users.

All of these services are “Standard” with Windows XP. If you discover
something other
than these listed here running, another program installed them. A few of
the more
common processes are listed starting on page 41.

Still unsure? Put your setting to “manual” or the listing under “Safe.”
Manual allows
Windows XP to start the service when it needs to (or when ever it feels
like it), but not at
boot up. Depending on your configuration, not all services will start
when required while
in “Manual” mode. If you find you need a service, place it in Automatic.

After adjusting your service settings, reboot your computer.

If you do not have some of these services listed, do not panic! If your
computer
manufacture “pre-installed” your XP, they choose not to have certain
services installed
for you. This is, in most cases, a fact with OEM versions of Windows XP
Home.

If you find this document helpful and you wish to use this information
(forums, web
sites), please link to http://www.blkviper.com and do not copy or
redistribute it. The
online information is up to date and I do not want anyone posting old
content.

Disabling all of the “unneeded services” frees up 12-70 MB of RAM,
depending on
system.

Do you mean that out of 89 services, 36 are set to Automatic as DEFAULT,
but, we
MAY only need 8 running?!? YES.
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 2 Revision 5: Sunday, August 31, 2003


Table Header Information:


Display Name ~ is how it displays in the Services Control Panel.

Service Name ~ is what the service’s “short” name is and what displays
in the registry.

Process Name ~ name of the Process running in the background (displays
in Task
Manager by hitting Ctrl+Alt+Del).

Dependencies ~ describe what other services this service needs to run.

Default Home ~ this is what runs by default on Windows XP Home.

Default Pro ~ this is what runs by default on Windows XP Professional.

“SAFE” Configuration ~ this is the configuration that 95% of the people
will be able to
use with little or no side effects. It will also minimizes the amount of
“errors” that is
reported in the Event Viewer. This does NOT guarantee it will work for
you, but if this
scares you, this configuration would be a good starting point.

Internet Gateway Configuration ~ setup to allow multiple computers on a
network to
share one access point using Microsoft's “Internet Connection Sharing
and Personal
Firewall” software. If you do not have this type of setup, compare the
differences
between “SAFE” and “GAMING” to find a middle ground that works for your
system.
Other software or hardware type firewall and gateway software may
require a slightly
different configuration.

Gaming Configuration ~ this is the power user setup. This setup is a
system that
connects through a network (such as a gateway / router) to the internet,
provides file and
print sharing resources and gaming enjoyment. Some things MAY not
function with this
setup. No passwords save. Its use is not for a computer with analog
modems or some
direct DSL/cable connections. Try “Internet Gateway” Configuration
first.

Super Tweak Configuration ~ this is the Super Geek setup. This setup is
a system that
connects through a network (such as a gateway / router) to the internet
with a static IP
address. This system does not provide file and print sharing resources,
nor have the
ability to print. Its use is not for a computer with analog modems or
many direct
DSL/cable connections. You can use this configuration for extreme
tweaking and testing
purposes. Many things MAY not function with this setup. No passwords
save. The Event
Log may display “errors” of not being able to start certain services.
CDRW functions
may no longer work. Please do not ask, “How do I fix” questions while
using this
configuration. The answer will be “Use SAFE.” This information’s
intention is for
reference only. However, I use this configuration on a daily basis.

Automatic ~ With a service in this state, it will start at boot time.
Some services, when
no longer required, will also automatically stop when not needed.
However, this is very
rare. If you find you do not need a service, place it into Manual or
Disabled.

Manual ~ Manual mode allows Windows to start a service when needed.
However, very
few services will start up when required in Manual mode. If you find you
need a service,
place it into Automatic.

Disabled ~ This setting will stop a service from starting, even if
needed. Errors in the
Event Viewer will show up complaining of that fact. Some services, while
Disabled, will
constantly complain. However, this situation is taken care of if placed
in Manual. The
service descriptions identifies those that should be in Manual vice
Disabled.
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 3 Revision 5: Sunday, August 31, 2003


Display Name Service Name Process
Name Dependencies Default
Home
Default
Pro “SAFE” Internet
Gateway Gaming Super
Tweak
Alerter Alerter services.exe Workstation Manual Manual Disabled Disabled
Disabled Disabled
Application Layer
Gateway Service ALG Alg.exe None Manual Manual Manual Automatic Disabled
Disabled
Application
Management AppMgmt svchost.exe None Manual Manual Manual Manual Manual
Manual
Automatic
Updates wuauserv svchost.exe None Automatic Automatic Automatic
Automatic Disabled Disabled
Background
Intelligent
Transfer Service
BITS svchost.exe
Remote Procedure
Call (RPC),
Workstation
Manual Manual Disabled Disabled Disabled Disabled
ClipBook ClipSrv clipsrv.exe Network DDE Manual Manual Disabled Disabled
Disabled Disabled
COM+ Event
System EventSystem svchost.exe Remote Procedure
Call (RPC) Manual Manual Manual Manual Disabled Disabled
COM+ System
Application COMSysApp dllhost.exe Remote Procedure
Call (RPC) Manual Manual Manual Manual Disabled Disabled
Computer
Browser Browser svchost.exe Server, Workstation Automatic Automatic
Disabled Automatic Disabled Disabled
Cryptographic
Services CryptSvc svchost.exe Remote Procedure
Call (RPC) Automatic Automatic Automatic Automatic Disabled Disabled
DHCP Client Dhcp svchost.exe
AFD Networking
Support Environment,
NetBios over TCP/IP,
TCP/IP Protocol
Driver
Automatic Automatic Automatic Disabled Automatic Disabled

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 4 Revision 5: Sunday, August 31, 2003


Display Name Service Name Process
Name Dependencies Default
Home
Default
Pro “SAFE” Internet
Gateway Gaming Super
Tweak
Distributed Link
Tracking Client TrkWks svchost.exe Remote Procedure
Call (RPC) Automatic Automatic Manual Manual Disabled Disabled
Distributed Remote Procedure
Transaction MSDTC msdtc.exe Call (RPC), Security Manual Manual Manual
Manual Disabled Disabled
Coordinator Accounts Manager
DNS Client Dnscache svchost.exe TCP/IP Protocol
Driver Automatic Automatic Automatic Automatic Disabled Disabled
Error Reporting
Service ERSvc svchost.exe Remote Procedure
Call (RPC) Automatic Automatic Disabled Disabled Disabled Disabled
Event Log Eventlog services.exe None Automatic Automatic Automatic
Automatic Automatic Automatic
Fast User
Switching
Compatibility
FastUserSwitching
Compatibility svchost.exe Terminal Services Manual Manual Manual Manual
Disabled Disabled
Fax Service FAX fxssvc.exe
Plug and Play, Print
Spooler, Remote
Procedure Call
(RPC), Telephony
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
FTP Publishing
Service NA inetinfo.exe IIS Admin Not
Available
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Help and Support helpsvc svchost.exe Remote Procedure
Call (RPC) Automatic Automatic Disabled Disabled Disabled Disabled
Human Interface
Device Access HidServ svchost.exe Remote Procedure
Call (RPC) Disabled Disabled Disabled Disabled Disabled Disabled
IIS Admin IISADMIN inetinfo.exe
Remote Procedure
Call (RPC), Security
Accounts Manager
Not
Available
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 5 Revision 5: Sunday, August 31, 2003


Display Name Service Name Process
Name Dependencies Default
Home
Default
Pro “SAFE” Internet
Gateway Gaming Super
Tweak
IMAPI CD-
Burning COM
Service
ImapiService imapi.exe None Manual Manual Automatic Automatic Disabled
Disabled
Indexing Service Cisvc cisvc.exe Remote Procedure
Call (RPC) Manual Manual Disabled Disabled Disabled Disabled
Internet
Connection
Firewall/Internet
Connection
Sharing
SharedAccess svchost.exe
Application Layer
Gateway Service,
Network
Connections,
Network Location
Awareness, Remote
Access Connection
Manager
Manual Automatic Automatic Automatic Disabled Disabled
IPSEC Services PolicyAgent lsass.exe
IPSEC driver,
Remote Procedure
Call (RPC), TCP/IP
Protocol Driver
Automatic Automatic Disabled Disabled Disabled Disabled
Logical Disk
Manager dmserver svchost.exe
Plug and Play,
Remote Procedure
Call (RPC)
Manual Automatic Manual Manual Disabled Disabled
Logical Disk
Manager
Administrative
Service
dmadmin dmadmin.exe
Logical Disk
Manager, Plug and
Play, Remote
Procedure Call (RPC)
Manual Manual Manual Manual Disabled Disabled

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 6 Revision 5: Sunday, August 31, 2003


Display Name Service Name Process
Name Dependencies Default
Home
Default
Pro “SAFE” Internet
Gateway Gaming Super
Tweak
Message Queuing NA mqsvc.exe
Distributed
Transaction
Coordinator, Message
Queuing access
control, NT LM
Security Support
Provider, Reliable
Multicast Protocol
driver, Remote
Procedure Call
(RPC), Server
Not
Available
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Message Queuing
Triggers NA mqtgsvc.exe Message Queuing Not
Available
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Messenger Messenger svchost.exe
NetBIOS Interface,
Plug and Play,
Remote Procedure
Call (RPC),
Workstation
Automatic Automatic Disabled Disabled Disabled Disabled
MS Software
Shadow Copy
Provider
SwPrv dllhost.exe Remote Procedure
Call (RPC) Manual Manual Manual Manual Disabled Disabled
Net Login Netlogon lsass.exe Workstation Manual Automatic Disabled
Disabled Disabled Disabled
NetMeeting
Remote Desktop
Sharing
mnmsrvc mnmsrvc.exe None Manual Manual Disabled Disabled Disabled
Disabled
Network
Connections Netman svchost.exe Remote Procedure
Call (RPC) Manual Manual Manual Automatic Manual Disabled
Network DDE NetDDE netdde.exe Network DDE
DSDM Manual Manual Disabled Disabled Disabled Disabled

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 7 Revision 5: Sunday, August 31, 2003


Display Name Service Name Process
Name Dependencies Default
Home
Default
Pro “SAFE” Internet
Gateway Gaming Super
Tweak
Network DDE
DSDM NetDDE netdde.exe
AFD Networking
Support Enviroment,
TCP/IP Protocol
Driver
Manual Manual Disabled Disabled Disabled Disabled
Network Location
Awareness
(NLA)
Nla svchost.exe None Manual Manual Manual Automatic Disabled Disabled
NT LM Security
Support Provider NtLmSsp lsass.exe None Manual Manual Manual Manual
Manual Disabled
Performance
Logs and Alerts SysmonLog smlogsvc.exe None Manual Manual Disabled
Disabled Disabled Disabled
Plug and Play PlugPlay services.exe None Automatic Automatic Automatic
Automatic Automatic Automatic
Portable Media
Serial Number WmdmPmSp svchost.exe None Automatic Automatic Disabled
Disabled Disabled Disabled
Print Spooler Spooler spoolsv.exe Remote Procedure
Call (RPC) Automatic Automatic Automatic Automatic Automatic Disabled
Protected Storage ProtectedStorage lsass.exe Remote Procedure
Call (RPC) Automatic Automatic Automatic Automatic Disabled Disabled
QoS RSVP RSVP rsvp.exe
AFD Networking
Support Environment,
Remote Procedure
Call (RPC), TCP/IP
Protocol Driver
Manual Manual Disabled Disabled Disabled Disabled
Remote Access
Auto Connection
Manager
RasAuto svchost.exe
Remote Access
Connection Manager,
Telephony
Manual Manual Manual Automatic Disabled Disabled

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 8 Revision 5: Sunday, August 31, 2003


Display Name Service Name Process
Name Dependencies Default
Home
Default
Pro “SAFE” Internet
Gateway Gaming Super
Tweak
Remote Access
Connection RasMan svchost.exe Telephony Manual Manual Manual Automatic
Disabled Disabled
Manager
Remote Desktop
Help Session
Manager
RDSessMgr sessmgr.exe Remote Procedure
Call (RPC) Manual Manual Disabled Disabled Disabled Disabled
Remote
Procedure Call
(RPC)
RpcSs svchost.exe None (but everything
depends on it) Automatic Automatic Automatic Automatic Automatic
Automatic
Remote
Procedure Call RpcLocator locator.exe Workstation Manual Manual Manual
Manual Manual Disabled
(RPC) Locator
Remote Registry
Service RemoteRegistry svchost.exe None Not
Available Automatic Disabled Disabled Disabled Disabled
Removable
Storage NtmsSvc svchost.exe Remote Procedure
Call (RPC) Manual Manual Manual Manual Disabled Disabled
RIP Listener NA svchost.exe Remote Procedure
Call (RPC)
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Routing and
Remote Access RemoteAccess svchost.exe
NetBIOSGroup,
Remote Procedure
Call (RPC)
Disabled Manual Disabled Disabled Disabled Disabled
Secondary Logon seclogon svchost.exe None Automatic Automatic Disabled
Disabled Disabled Disabled
Security
Accounts
Manager
SamSs lsass.exe Remote Procedure
Call (RPC) Automatic Automatic Automatic Automatic Disabled Disabled
Server lanmanserver svchost.exe None Automatic Automatic Disabled
Automatic Disabled Disabled

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 9 Revision 5: Sunday, August 31, 2003


Display Name Service Name Process
Name Dependencies Default
Home
Default
Pro “SAFE” Internet
Gateway Gaming Super
Tweak
Shell Hardware
Detection ShellHWDetection svchost.exe Remote Procedure
Call (RPC) Automatic Automatic Automatic Automatic Disabled Disabled
Simple Mail
Transport
Protocol (SMTP)
SMTPSVC inetinfo.exe Event Log, IIS
Admin
Not
Available
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Simple TCP/IP
Services NA tcpsvcs.exe AFD Networking
Support Environment
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Smart Card SCardSvr SCardSvr.exe Plug and Play Manual Manual Disabled
Disabled Disabled Disabled
Smart Card
Helper SCardDrv SCardSvr.exe None Manual Manual Disabled Disabled
Disabled Disabled
SNMP Service NA snmp.exe Event Log Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
SNMP Trap
Service NA snmptrap.exe Event Log Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
SSDP Discovery
Service SSDPSRV svchost.exe None Manual Manual Disabled Disabled
Disabled Disabled
System Event
Notification SENS svchost.exe COM+ Event System Automatic Automatic
Automatic Automatic Disabled Disabled
System Restore
Service srservice svchost.exe Remote Procedure
Call (RPC) Automatic Automatic Disabled Disabled Disabled Disabled
Task Scheduler Schedule svchost.exe Remote Procedure
Call (RPC) Automatic Automatic Automatic Automatic Disabled Disabled
TCP/IP NetBIOS
Helper Service LmHosts svchost.exe
AFD Networking
Support Environment,
NetBios over TCP/IP
Automatic Automatic Disabled Disabled Disabled Disabled
TCP/IP Printer
Server LPDSVC tcpsvcs.exe Print Spooler, TCP/IP
Protocol Driver
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 10 Revision 5: Sunday, August 31, 2003


Display Name Service Name Process
Name Dependencies Default
Home
Default
Pro “SAFE” Internet
Gateway Gaming Super
Tweak
Telephony TapiSrv svchost.exe
Plug and Play,
Remote Procedure
Call (RPC)
Manual Manual Manual Automatic Disabled Disabled
Telnet TlntSvr tlntsvr.exe
NT LM Security
Support Provider,
Remote Procedure
Call (RPC), TCP/IP
Protocol Driver
Not
Available Manual Disabled Disabled Disabled Disabled
Terminal Services TermService svchost.exe Remote Procedure
Call (RPC) Manual Manual Manual Manual Disabled Disabled
Themes Themes svchost.exe None Automatic Automatic Automatic Automatic
Disabled Disabled
Uninterruptible
Power Supply UPS ups.exe None Manual Manual Disabled Disabled Disabled
Disabled
Universal Plug
and Play Device
Host
UPNPhost svchost.exe SSDP Discovery
Service Manual Manual Disabled Disabled Disabled Disabled
Upload Manager uploadmgr svchost.exe Remote Procedure
Call (RPC) Automatic Automatic Disabled Disabled Disabled Disabled
Volume Shadow
Copy VSS vssvc.exe Remote Procedure
Call (RPC) Manual Manual Manual Manual Disabled Disabled
WebClient WebClient svchost.exe WebDav Client
Redirector Automatic Automatic Disabled Disabled Disabled Disabled
Windows Audio AudioSrv svchost.exe
Plug and Play,
Remote Procedure
Call (RPC)
Automatic Automatic Automatic Automatic Automatic Automatic
Windows Image
Acquisition
(WIA)
Stisvc svchost.exe Remote Procedure
Call (RPC) Manual Manual Manual Manual Disabled Disabled

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 11 Revision 5: Sunday, August 31, 2003


Display Name Service Name Process
Name Dependencies Default
Home
Default
Pro “SAFE” Internet
Gateway Gaming Super
Tweak
Windows
Installer MSIServer msiexec.exe Remote Procedure
Call (RPC) Manual Manual Manual Manual Manual Manual
Windows
Management
Instrumentation
Winmgmt svchost.exe Event Log, Remote
Procedure Call (RPC) Automatic Automatic Automatic Automatic Automatic
Automatic
Windows
Management
Instrumentation
Driver Extension
Wmi svchost.exe None Not
Available Manual Manual Manual Manual Disabled
Windows Time W32Time svchost.exe None Automatic Automatic Disabled
Disabled Disabled Disabled
Wireless Zero
Configuration WZCSVC svchost.exe
NDIS Usermode I/O
Protocol, Remote
Procedure Call (RPC)
Automatic Automatic Disabled Disabled Disabled Disabled
WMI
Performance
Adapter
WmiApSrv wmiapsrv.exe Remote Procedure
Call (RPC) Manual Manual Disabled Disabled Disabled Disabled
Workstation lanmanworkstation svchost.exe None (but plenty
depend on it) Automatic Automatic Automatic Automatic Automatic
Automatic
World Wide Web
Publishing
Service
W3SVC inetinfo.exe IIS Admin Not
Available
Not
Installed
Not
Installed
Not
Installed
Not
Installed
Not
Installed

Up to date content and contact information is located at
http://www.blkviper.com or http://www.blackviper.com

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 12 Revision 5: Sunday, August 31, 2003


Black Viper’s Windows XP Home and Professional
Services 411


Original content created July 28, 2001
Last update was Sunday, August 31, 2003


Copyright © 2001-2003 by Black Viper
All Rights Reserved.


Up to date content and contact information is located at
www.blkviper.com or www.blackviper.com.


Alerter

The Alerter service notifies users of administrative alerts on a
network. This service usually is
not required under normal circumstances. Note: This is NOT “WinPopUp.”

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: NT AUTHORITY\LocalService

Dependencies:

What service Alerter needs to function properly:


Workstation
What other service require Alerter to function properly:


None
Application Layer Gateway Service

Provides support for 3rd party plug-ins for Internet Connection
Sharing/Internet Connection
Firewall. This service is required if using Internet Connection Sharing
/ Internet Connection
Firewall to connect to the internet. This service uses about 1.5 MB of
memory in an idle state.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: NT AUTHORITY\LocalService

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 13 Revision 5: Sunday, August 31, 2003


Dependencies:

What service Application Layer Gateway Service needs to function
properly:


None
What other service require Application Layer Gateway Service to function
properly:


Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
Application Management

Used for Assign, Publish and Remove software services. If you cannot
modify your software
installation of certain applications, put this service in to Automatic
or Manual. If you have
Windows XP Home Version, this service may be causing problems described
in this knowledge
base article:

http://support.microsoft.com/default...;Q328213?SD=EE

I have not tested this, but for now, Disable this service in Windows XP
Home until installation of
Service Pack 1.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account

Dependencies:

What service Application Management needs to function properly:


None
What other service require Application Management to function properly:


None
Automatic Updates

This service is used to check up to see if there is any critical or
otherwise updates available for
download. You may choose to update manually due to the very long lag
time from when an
update is available and when Windows XP reports it. After the
installation of Service Pack 1,
you may configure how “often” updates are checked. Using default values,
Windows XP
“automatically” downloads the updates and asks to “install” them. A few
reasons why you may
think this is unacceptable in your situation:


You could have a dial-up connection. If XP feels like downloading
whenever it wants, it
just may not allow you to do what “you” want.

You may also: Wish to know what, when and how an update installs BEFORE
using any
bandwidth.

Want to read about the update BEFORE downloading.
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 14 Revision 5: Sunday, August 31, 2003



Want to know WHY you need it and WHAT it fixes.
It is very important that if you decide to disable this service, you
check the Windows
Update site often to ensure the latest patches install properly.

Take note: Manual (and Automatic) updates via Windows Update web site
requires
Cryptographic Services to be running. Place both Automatic Updates and
Cryptographic
Services in to automatic if you do not wish to update manually.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account

Dependencies:

What service Automatic Updates needs to function properly:


None
What other service require Automatic Updates to function properly:


None
Background Intelligent Transfer Service

This service is used to transfer asynchronous data via http1.1 servers.
According to Microsoft's
site, Windows Update uses this “feature.” It “continues” a download if
you log off or shutdown
the system (that is, when you log back in). The problem with that is, I
do not like having this
“feature” running all of the time. Even though I have found no side
effects as to this being
disabled, you may require this service for some MSN Explorer, Windows
Messenger, Windows
Media Player or future .NET functions. Take note: Manual update via
Windows Update web site
requires Cryptographic Services to be running.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What services Background Intelligent Transfer Service needs to function
properly:


Remote Procedure Call (RPC)

Workstation
What other service require Background Intelligent Transfer Service to
function properly:


None
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 15 Revision 5: Sunday, August 31, 2003


ClipBook

Used to store information (cut / paste) and share it with other
computers. I have never found
enough need for this to allow this service to always be running. This
service alone uses about 1.3
MB of memory.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What services ClipBook needs to function properly:


Network DDE
o
Network DDE DSDM
What other service require ClipBook to function properly:


None
COM+ Event System

You will receive, in the Event Log, an entry from “DCOM” complaining
about not having this
service running if disabled. I am unaware of any application that uses
COM+, but if set to
manual, many services report to it, so it will start anyway. This
service is required for System
Event Notification. For the fun of it:

“C:\Program Files\ComPlus Applications\”

On your system, see if you have any installed “COM+” Applications. If
not, you can probably
disable this service with no side effects (besides the Event Log
complaining upon reboots). Take
note: BootVis requires Task Scheduler and COM+ Event System to be
running if you wish to
take advantage of the “optimize system” function. Why is it required? It
is due to the pre-
fetching function built into Windows XP. Another Note: Pre-fetching only
occurs on boot up and
application start, so if you do not care about a few extra seconds of
boot time, you may decide to
not even bother with it and disable Task Scheduler. Depending on the
system, pre-fetching may
increase performance. Windows Media Player may also require this service
for some “features”
to function. MS' .NET may require this service in the future. I
recommend disabled for Super
Tweaking, automatic for “safe,” and manual for most other
configurations.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 16 Revision 5: Sunday, August 31, 2003


Dependencies:

What service COM+ Event System needs to function properly:


Remote Procedure Call (RPC)
What other service require COM+ Event System to function properly:


System Event Notification
COM+ System Application

You will receive, in the Event Log, an entry from “DCOM” complaining
about not having this
service running if disabled. I am unaware of any application that uses
COM+, but if set to
manual, many services report to it, so it will start anyway. For the fun
of it:

“C:\Program Files\ComPlus Applications”

On your system, see if you have any installed “COM+” Applications. If
not, you can probably
disable this service with no side effects (besides the Event Log
complaining upon reboots). This
service is required for System Event Notification.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account

Dependencies:

What service COM+ System Application needs to function properly:


Remote Procedure Call (RPC)
What other service require COM+ System Application to function properly:

None
Computer Browser

Computer Browser service maintains a listing of computers and resources
located on the
network. This service is not required on a standalone system. In fact,
even if you want to browse
the network (workgroup or domain) or have mapped network shares as local
hard drives, you can
still do so. On a large network, one computer is designated the “master”
browser and another one
is the “backup” browser. All others just announce they are available
every 12 minutes to “take
over” duties if one of the other computers fail. No lag time is
discernable if this service remains
disabled on all but one computer. Honestly, I do not even believe one
needs to be running. You
could, “just in case,” but it sure does not need to be running on all
computers, all of the time.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 17 Revision 5: Sunday, August 31, 2003


Log on as: Local System account

Dependencies:

What services Computer Browser needs to function properly:


Server

Workstation
What other service require Computer Browser to function properly:


None
Cryptographic Services

Mainly, it confirms signatures of Windows files. You may always get a
dialog box complaining
about uncertified drivers if this is disabled. This service is required
for Windows Update to
function in manual and automatic mode and this service is required to
install Service Pack 1
unified updates and DirectX 9.0. Windows Media Player and future .NET
applications may also
require this service for some “features” to function. This service uses
about 1.9 MB of memory.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Dependencies:

What service Cryptographic Services needs to function properly:


Remote Procedure Call (RPC)
What other service require Cryptographic Services to function properly:


None
DHCP Client

This service automatically receives a Dynamic IP address from your DHCP
server and DNS
updates. Required for ICS / internet client and if you run IPSEC,
disable on a standalone system
or one that has a static IP address. Take note: Most DSL/cable ISP's use
DHCP to provide
internet access. If you disable this service and your Internet
connection no longer works, place
this back into automatic. Most DSL and cable hardware routers have the
option of enabling a
DHCP server for the internal network. Ensure that the router is
configured the same as your local
PC's.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 18 Revision 5: Sunday, August 31, 2003


Dependencies:

What services DHCP Client needs to function properly:


AFD Networking Support Environment

NetBIOS over TCP/IP
o
TCP/IP Protocol Driver
°
IPSEC driver

TCP/IP Protocol Driver
o
IPSEC driver
What other service require DHCP Client to function properly:


None
Distributed Link Tracking Client

Maintains links with NTFS files within your computer or across a domain.
For example, you
could make a file on “Computer A.” You then create a “short cut” or
“link” to that file on
“Computer B.” If you would move the file on Computer A to a different
location, this service
would tell Computer B to update its information to allow uninterrupted
connectivity. Even
though this is rather valuable on a large network, I have not found a
use for this service on a
home network. It uses about 3.5 MB to 4 MB in an idle state.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Manual

Log on as: Local System account

Dependencies:

What service Distributed Link Tracking Client needs to function
properly:


Remote Procedure Call (RPC)
What other service require Distributed Link Tracking Client to function
properly:


None
Distributed Transaction Coordinator

Automatically takes care of transactions that span multiple resources.
This service is required if
using Message Queuing. You may also see complaints in the Event Log if
this service is
disabled, but I have experienced no side effects. Microsoft's .NET may
require this service in the
future.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 19 Revision 5: Sunday, August 31, 2003


Log on as: NT AUTHORITY\NetworkService

Dependencies:

What services Distributed Transaction Coordinator needs to function
properly:


Remote Procedure Call (RPC)

Security Accounts Manager
o
Remote Procedure Call (RPC)
What other services require Distributed Transaction Coordinator to
function properly:


Message Queuing
o
Message Queuing Triggers
DNS Client

Resolves and caches DNS names and Active Directory domain controller
functions. This service
is not required for DNS lookups, but if it makes you happy to have it
running, you may.
However, DNS Client is required if using IPSEC. If you attempt to
“repair” your network
connection and a dialog box complains that the “DNS resolver failed to
flush the cache,” this
service is the reason.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: NT AUTHORITY\NetworkService

Dependencies:

What service DNS Client needs to function properly:


TCP/IP Protocol Driver
o
IPSEC driver
What other service require DNS Client to function properly:


None
Error Reporting Service

Calls home to Microsoft when application errors occur. I personally do
not like this. I feel it is a
waste of memory and resources. On the other hand, if you are
experiencing system crashes often,
the best way to deal with them is to report them using this tool.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: Local System account

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 20 Revision 5: Sunday, August 31, 2003


Dependencies:

What service Error Reporting Service needs to function properly:


Remote Procedure Call (RPC)
What other service require Error Reporting Service to function properly:

None
Event Log

View Event Log messages from applications in Event Viewer. Always
helpful to check out the
Event Log to see what problems with applications are popping up that is
“hidden” from the
normal user. To see quickly what, if anything has resulted in your
adjustments, you may consider
clearing the Event Log. Windows Management Instrumentation also requires
Event Log Service
to be running. If you disable the Event Log Service, but do not disable
Windows Management
Instrumentation, your computer may have an extended boot time while
Windows Management
Instrumentation is waiting for the Event Log to start. It is just best
to keep Event Log active for
troubleshooting purposes and normal operations.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account

Dependencies:

What service Event Log needs to function properly:


None
What other services require Event Log to function properly:


Simple Mail Transfer Protocol (SMTP)

SNMP Service

SNMP Trap Service

Windows Management Instrumentation
Fast User Switching Compatibility

Unless you have many users on a system, you probably do not even need
this service to be
running. You could benefit, however, greatly if you use this service in
conjunction with many
users on your local computer to allow switching users without closing
all existing applications
running under a different account.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 21 Revision 5: Sunday, August 31, 2003


Dependencies:

What services Fast User Switching Compatibility needs to function
properly:


Terminal Services
o
Remote Procedure Call (RPC)
What other service require Fast User Switching Compatibility to function
properly:


None
Fax Service

Not installed by default, but if needed, you may install it later off
the Windows XP CD.
Maintains the ability to send and receive FAX documents on your
computer.

Default XP Home: Not Installed
Default XP Pro: Not Installed
Safe Setting: Not Installed

Log on as: Local System account

Dependencies:

What services Fax Service needs to function properly:


Plug and Play

Print Spooler
o
Remote Procedure Call (RPC)

Remote Procedure Call (RPC)

Telephony
o
Plug and Play
o
Remote Procedure Call (RPC)
What other service require Fax Service to function properly:


None
FTP Publishing Service

This feature is not available on Windows XP Home or installed by default
on Windows XP Pro,
but if you need it, you may install it later off the Windows XP CD. This
service provides a FTP
server on your network.

Default XP Home: Not Installed
Default XP Pro: Not Installed
Safe Setting: Not Installed

Log on as: Local System account

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 22 Revision 5: Sunday, August 31, 2003


Dependencies:
What services FTP Publishing Service needs to function properly:



IIS Admin
o
Remote Procedure Call (RPC)
o
Security Accounts Manager
°
Remote Procedure Call (RPC)
What other service require FTP Publishing Service to function properly:


None
Help and Support

This service is required for Microsoft’s online (or offline) help
documents. If you ever “attempt”
to use Help and Support, the service places itself back into “Automatic”
and starts even if you
already had this service on disabled. I try to avoid as much Microsoft
help as I can…

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What service Help and Support needs to function properly:


Remote Procedure Call (RPC)
What other service require Help and Support to function properly:

None
Human Interface Device Access

You may not have any peripherals that require this service. If one of
yours magically does not
function anymore, set it to automatic. Namely, scanners with function
buttons (fax, copy) or even
an “Internet” keyboard with volume or play controls.

Default XP Home: Disabled
Default XP Pro: Disabled
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What service Human Interface Device Access needs to function properly:


Remote Procedure Call (RPC)
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 23 Revision 5: Sunday, August 31, 2003


What other service require Human Interface Device Access to function
properly:


None
IIS Admin

This feature is not available on Windows XP Home or installed by default
on Windows XP Pro,
but if needed, you may install it later off the Windows XP CD. This
service usually operates in
conjunction with a local web site or FTP server. Leave it uninstalled
mainly because IIS has been
“popular” for crackers to break.

Default XP Home: Not Installed
Default XP Pro: Not Installed
Safe Setting: Not Installed

Log on as: Local System account

Dependencies:

What services IIS Admin needs to function properly:


Remote Procedure Call (RPC)

Security Accounts Manager
o
Remote Procedure Call (RPC)
What other services require IIS Admin to function properly:


FTP Publishing Service

Simple Mail Transport Protocol (SMTP)

World Wide Web Publishing Service
IMAPI CD-Burning COM Service

This service operates that cool “drag and drop” CD burn capability. You
will need this service to
burn CD's. What is the good news? If you set this service to manual, the
service starts and stops
itself when used with some software packages. This is practically the
only service that does do
this! If you still cannot burn a CD with it on manual, switch to
automatic and feel safe that it
starts only when “needed.” This service may take up about 1.6 MB of
memory in an idle state.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Automatic

Log on as: Local System account

Dependencies:

What service IMAPI CD-Burning COM Service needs to function properly:


None
What other service require IMAPI CD-Burning COM Service to function
properly:


None
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 24 Revision 5: Sunday, August 31, 2003


Indexing Service

This service always has been a major resource hog. I NEVER recommend
having this service
enabled. Remove the function via the “Add / Remove Programs” icon in the
control panel
(Windows Setup Programs). It uses about 500 K to 2 MB in an idle state,
not to mention the
amount of memory and CPU resources it takes to INDEX the drives. I have
had people (and
witnessed it on other people's computers) report to me that the Indexing
Service sometimes starts
up EVEN while the system is NOT idle… as in the middle of a game. You
may feel, as I do, that
this is unacceptable. If your computer suddenly seems “sluggish,”
Indexing Service is usually the
cause of it.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What service Indexing Service needs to function properly:


Remote Procedure Call (RPC)
What other service require Indexing Service to function properly:


None
Internet Connection Firewall and Internet Connection Sharing

This service is used to allow multiple computers on your network to
access the internet via only
one account. This service installs on the “modem” computer. If you are
using a third party
firewall or Internet Connection Sharing software package, this service
is not required.

Default XP Home: Manual
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account

Dependencies:

What services Internet Connection Firewall (ICF) and Internet Connection
Sharing (ICS) needs
to function properly:


Application Layer Gateway Service

Network Connections
o
Remote Procedure Call (RPC)

Network Location Awareness (NLA)
o
AFD Networking Support Environment
o
NetBIOS over TCP/IP
°
TCP/IP Protocol Driver

IPSEC driver
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 25 Revision 5: Sunday, August 31, 2003



Remote Access Connection Manager
o
Telephony
°
Plug and Play
°
Remote Procedure Call (RPC)
What other service require Internet Connection Firewall (ICF) and
Internet Connection Sharing
(ICS) to function properly:


None
IPSEC Services

May be required on some domains or VPN connections, but the “average”
user will not need
this.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What services IPSEC Services needs to function properly:


IPSEC driver

Remote Procedure Call (RPC)

TCP/IP Protocol Driver
o
IPSEC driver
What other service require IPSEC Services to function properly:


None
Logical Disk Manager

This service is vital to run the Disk Management MMC console for dynamic
volumes. If you
attempt to “Manage” your hard drives and a dialog box pops up
complaining about not being
able to do this, start this service.

Default XP Home: Manual
Default XP Pro: Automatic
Safe Setting: Manual

Log on as: Local System account

Dependencies:

What services Logical Disk Manager needs to function properly:


Plug and Play

Remote Procedure Call (RPC)
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 26 Revision 5: Sunday, August 31, 2003


What other service require Logical Disk Manager to function properly:


Logical Disk Manager Administrative Service
Logical Disk Manager Administrative Service

This service is vital to run the Disk Management MMC console for dynamic
volumes.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account

Dependencies:

What services Logical Disk Manager Administrative Service needs to
function properly:


Logical Disk Manager
o
Plug and Play
o
Remote Procedure Call (RPC)

Plug and Play

Remote Procedure Call (RPC)
What other service require Logical Disk Manager Administrative Service
to function properly:


None
Message Queuing

This feature is not available on Windows XP Home or installed by default
on Windows XP Pro,
but if needed, you may install it later off of the Windows XP CD. May be
used on some
domains, but the “average” home user will never need this service.

Default XP Home: Not Installed
Default XP Pro: Not Installed
Safe Setting: Not Installed

Log on as: Local System account

Dependencies:

What services Message Queuing needs to function properly:


Distributed Transaction Coordinator
o
Remote Procedure Call (RPC)
o
Security Accounts Manager
°
Remote Procedure Call (RPC)

Message Queuing access control

NT LM Security Support Provider

Reliable Multicast Protocol driver

Protected Storage
o
Remote Procedure Call (RPC)
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 27 Revision 5: Sunday, August 31, 2003



Remote Procedure Call (RPC)

Server
What other service require Message Queuing to function properly:


Message Queuing Triggers
Message Queuing Triggers

This feature is not available on Windows XP Home or installed by default
on Windows XP Pro,
but if needed, you may install it later off the Windows XP CD. This
service is required if you use
Message Queuing service.

Default XP Home: Not Installed
Default XP Pro: Not Installed
Safe Setting: Not Installed

Log on as: Local System account

What services Message Queuing Triggers needs to function properly:


Message Queuing
o
Distributed Transaction Coordinator
°
Remote Procedure Call (RPC)
°
Security Accounts Manager

Remote Procedure Call (RPC)
o
Message Queuing access control
o
NT LM Security Support Provider
o
Reliable Multicast Protocol driver
o
Protected Storage
°
Remote Procedure Call (RPC)
o
Remote Procedure Call (RPC)
o
Server
What other service require Message Queuing Triggers to function
properly:


None
Messenger

This service provides the ability to send messages between clients and
servers. This service
needs not to be running under normal “home” conditions. It is also
advisable to make this service
go away to avoid the possibility of “net send” messages hitting your
computer from the internet.
This has nothing to do with MSN Messenger, nor is it “WinPopUp.”

To test for this security vulnerability, at the command prompt, (run:
cmd.exe) type:

net send 127.0.0.1 hi

If you get a popup “hi” message, you should disable the Messenger
service.
If you get an error stating, “The message alias could not be found on
the network,” you are safe.


© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 28 Revision 5: Sunday, August 31, 2003


If, for whatever reason, you need the Messenger service running but wish
not to have spam
popups active, you can disable the particular ports at your firewall.
The Messenger service uses
UDP ports 135, 137, and 138; TCP ports 135, 139, and 445.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What services Messenger needs to function properly:


NetBIOS Interface

Plug and Play

Remote Procedure Call (RPC)

Workstation
What other service require Messenger to function properly:

None
MS Software Shadow Copy Provider

Used in conjunction with the Volume Shadow Copy service, Microsoft
Backup uses these
services. You will receive, in the Event Log, an entry complaining about
not having this service
running if disabled. I have yet to find a side effect, though, but to
avoid the messages; you can
place the service in manual. Some third party hard disk “ghost” or
“imaging” software may
require this service to be running.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account

Dependencies:

What service MS Software Shadow Copy Provider needs to function
properly:


Remote Procedure Call (RPC)
What other service require MS Software Shadow Copy Provider to function
properly:

None
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 29 Revision 5: Sunday, August 31, 2003


Net Login

Used for logging onto a Domain Controller. This service is not required
on a standalone system,
or for a “home” network.

Default XP Home: Manual
Default XP Pro: Automatic
Safe Setting: Disabled

Dependencies:

What service Net Logon needs to function properly:


Workstation
What other service require Net Logon to function properly:


None
NetMeeting Remote Desktop Sharing

Enables a user to access your computer using NetMeeting. This may create
a BIG open door for
the unwanted. If you are paranoid about security, disable this function.
Even if you were not
worried, I would still get rid of it.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: Local System account (with permission to interact with
desktop)

Dependencies:

What service NetMeeting Remote Desktop Sharing needs to function
properly:


None
What other service require NetMeeting Remote Desktop Sharing to function
properly:


None
Network Connections

Required for managing network connectivity. Set to disabled if you have
no network or you do
not toy with the configurations a lot. If your internet connectivity no
longer operates after
disabling this function, set it back to Automatic! Note: While disabling
this service, you will no
longer see the system tray icon (lower right) displayed, even for modem
connections.
Connectivity, however, still exists even on incoming shared network
drives.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 30 Revision 5: Sunday, August 31, 2003


Log on as: Local System account (with permission to interact with
desktop)
Dependencies:
What service Network Connections needs to function properly:



Remote Procedure Call (RPC)
What other service require Network Connections to function properly:

Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
Network DDE

I have not found a good use for this service. Unless you use remote
ClipBook, disable it. This

uses about 1.5 MB idle.
Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: Local System account
Dependencies:
What service Network DDE needs to function properly:



Network DDE DSDM
What other service require Network DDE to function properly:

ClipBook
Network DDE DSDM

I have not found a good use for this service. Unless you use remote
ClipBook, disable it.
Default XP Home: Manual

Default XP Pro: Manual
Safe Setting: Disabled
Log on as: Local System account
Dependencies:
What service Network DDE DSDM needs to function properly:


None
What other services require Network DDE DSDM to function properly:

Network DDE
o
ClipBook
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 31 Revision 5: Sunday, August 31, 2003


Network Location Awareness (NLA)

This service is required for use with the Internet Connection Sharing
service (server only).
Default XP Home: Manual

Default XP Pro: Manual
Safe Setting: Manual
Log on as: Local System account
Dependencies:
What services Network Location Awareness (NLA) needs to function
properly:


AFD Networking Support Environment

NetBIOS over TCP/IP
o
TCP/IP Protocol Driver
°
IPSEC driver
What other service require Network Location Awareness (NLA) to function
properly:


Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
NT LM Security Support Provider

Manages local system security information on the computer. You need this
service if you are

running Message Queuing or Telnet server.
Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account

Dependencies:

What service NT LM Security Support Provider needs to function properly:

None
What other services require NT LM Security Support Provider to function
properly:

Message Queuing
o
Message Queuing Triggers

Telnet
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 32 Revision 5: Sunday, August 31, 2003


Performance Logs and Alerts

Collect performance data on a schedule and send the information to a log
or trigger an alert. This
may be a super geek tool, but I feel that the overhead associated with
it is not worth the benefit.
You decide.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: NT AUTHORITY\NetworkService

Dependencies:

What service Performance Logs and Alerts needs to function properly:


None
What other service require Performance Logs and Alerts to function
properly:


None
Plug and Play

This service is the heart and soul of the Plug and Play environment. I
do not recommend
disabling this service, but if you want to, you are on your own. Take
note: UPnP is NOT PnP.
UPnP is for connectivity on networks via TCP/IP to devices, such as
scanners or printers. Your
sound card is PnP. Do NOT disable Plug and Play service.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account

Dependencies:

What service Plug and Play needs to function properly:


None
What other services require Plug and Play to function properly:


Fax Service

Logical Disk Manager
o
Logical Disk Manager Administrative Service

Logical Disk Manager Administrative Service

Messenger

Smart Card

Telephony
o
Fax Service
o
Remote Access Auto Connection Manager
o
Remote Access Connection Manager
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 33 Revision 5: Sunday, August 31, 2003


°
Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
°
Remote Access Auto Connection Manager


Windows Audio
Portable Media Serial Number

Retrieves serial numbers from portable music players connected to your
computer. I have not
really found a good reason to keep this service always running. I am not
aware of anything that
actually requires it. Disable it unless something of yours ceases to
function properly, such as
Windows Media Player, Microsoft's integration with “Digital Rights
Management” and copy
protection.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What service Portable Media Serial Number needs to function properly:


None
What other service require Portable Media Serial Number to function
properly:


None
Print Spooler

Queues up print jobs for later printing. This service is required if you
have printers, even if they
are network printers. If this does not fit your needs, disable it. You
will save about 3.8 MB by
making this service go away. Your printers will still be “installed” if
you disable this service, but
not visible in the printers folder. After restarting Print Spooler, they
will reappear and be
available for use. I place this service into manual mode and only start
it up when printing is
required. In manual mode, the service will not automatically start at
boot time.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account (with permission to interact with
desktop)

Dependencies:

What service Print Spooler needs to function properly:


Remote Procedure Call (RPC)
What other services require Print Spooler to function properly:


Fax Service

TCP/IP Printer Server
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 34 Revision 5: Sunday, August 31, 2003


Protected Storage

Allows for the saving of local passwords or even web sites information
(AutoComplete). This
service is set to Automatic by default. Due to security reasons, I
recommend leaving this
“feature” disabled to make things all that much more difficult to steal
vital information if you do
not “save” it. On the other hand, you may need this service to manage
private keys for
encryption purposes. If so, leave this service on automatic to ensure
the “higher” security settings
you choose work. If you disable this service, you will no longer have
any of your passwords
saved, no matter how many times you click the box. If you enjoy having
your passwords saved
in applications like Outlook or Dial up networking or you are connecting
to the internet via a
domain controller/server that requires authentication, set this service
to Automatic.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account (with permission to interact with
desktop)

Dependencies:

What service Protected Storage needs to function properly:


Remote Procedure Call (RPC)
What other service require Protected Storage to function properly:


None
QoS RSVP

Provides traffic control on a network using IPSEC and applications that
support QoS, and have
an adapter that supports it. The QoS Packet Driver installs by default
on any TCP/IP
connections. I recommend uninstalling it if it is not needed on your
network. As far as I can tell,
you also need an ACS Server (Provided with Windows 2000 Server and
Advanced Server) for
the QoS Packet Scheduler and Applications to request the needed
bandwidth. Since my network
is not straining under any load, this is rather pointless. You may
require this service to be placed
on Automatic if you use Windows Media Player or NetMeeting. Take note:
Some people (as I
did before I completed extensive research on this) reported that QoS
uses 20% of your
bandwidth and does not allow any activity, regardless. This is false.
For more information, please
view this KB article from Microsoft (I normally do not post links to
them, but this warrants it):

http://support.microsoft.com/default...;EN-US;q316666

Regardless, if you uninstall the packet scheduler, no “bandwidth” is
still reserved.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: Local System account

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 35 Revision 5: Sunday, August 31, 2003


Dependencies:

What services QoS RSVP needs to function properly:


AFD Networking Support Environment

Remote Procedure Call (RPC)

NetBIOS over TCP/IP
o
TCP/IP Protocol Driver
°
IPSEC driver
What other service require QoS RSVP to function properly:


None
Remote Access Auto Connection Manager

Creates a connection to a network when a program requests a remote
address. This service may
be required for your internet connection. If things cease to function
after disabling this service,
put it to automatic. Note: you may require this service for some direct
cable or DSL providers
and connections, depending on how they implement their logon process. If
your Dial-up, cable or
DSL internet access no longer functions properly with this service
disabled, place this service
into automatic. If you use a hardware gateway or router, this service is
not required.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account

Dependencies:

What services Remote Access Auto Connection Manager needs to function
properly:


Remote Access Connection Manager
o
Telephony
°
Plug and Play
°
Remote Procedure Call (RPC)

Telephony
o
Plug and Play
o
Remote Procedure Call (RPC)
What other service require Remote Access Auto Connection Manager to
function properly:


None
Remote Access Connection Manager

Creates a network connection. This service is required if you use
Internet Connection Sharing. If
things cease to function after disabling this service, put it to
automatic. Note: you may require
this service for some direct cable or DSL providers and connections,
depending on how they
implement their logon process. If your Dial-up, cable or DSL internet
access no longer functions

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 36 Revision 5: Sunday, August 31, 2003


properly with this service disabled, place this service into automatic.
If you use a hardware

gateway or router, this service is not required.
Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account
Dependencies:
What services Remote Access Connection Manager needs to function
properly:



Telephony
o
Plug and Play
o
Remote Procedure Call (RPC)
What other services require Remote Access Connection Manager to function
properly:

Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)

Remote Access Auto Connection Manager
Remote Desktop Help Session Manager

Manages and controls Remote Assistance. If you do not want or need to
use this feature, disable

it. In an idle state, this service sucks up 3.4 MB to 4 MB of RAM.
Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: Local System account
Dependencies:
What service Remote Desktop Help Session Manager needs to function
properly:



Remote Procedure Call (RPC)
What other service require Remote Desktop Help Session Manager to
function properly:

None
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 37 Revision 5: Sunday, August 31, 2003


Remote Procedure Call (RPC)

This service is rather vital. Practically everything depends on this
service to be running. This is
also the only service that you cannot disable via the Services MMC.
Previously, if you disabled
this service in Windows 2000, your computer would become unbootable.
What I am trying to tell
you is leave this service on automatic and absolutely DO NOT disable it
in msconfig. If, for
whatever reason, the service became disabled and you can no longer boot
your system, please
read the information here for a way to fix it:
http://www.blkviper.com/AskBV/2k4.htm

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account (and cannot be changed)

Dependencies:

What service Remote Procedure Call (RPC) needs to function properly:


None
What other services require Remote Procedure Call (RPC) to function
properly:


Background Intelligent Transfer Service

COM+ Event System
o
System Event Notification

COM+ System Application

Cryptographic Services

Distributed Link Tracking Client

Distributed Transaction Coordinator
o
Message Queuing
°
Message Queuing Triggers

Error Reporting Service

Fax Service

Help and Support

Human Interface Device Access

IIS Admin
o
FTP Publishing Service
o
Simple Mail Transport Protocol (SMTP)
o
World Wide Web Publishing Service

Indexing Service

IPSEC Services

Logical Disk Manager
o
Logical Disk Manager Administrative Service

Logical Disk Manager Administrative Service

Message Queuing
o
Message Queuing Triggers

Messenger
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 38 Revision 5: Sunday, August 31, 2003



MS Software Shadow Copy Provider

Network Connections
o
Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)

Print Spooler
o
Fax Service
o
TCP/IP Printer Server

Protected Storage

QoS RSVP

Remote Desktop Help Session Manager

Remote Registy

Removable Storage

RIP Listener

Routing and Remote Access

Security Accounts Manager
o
Distributed Transaction Coordinator
°
Message Queuing

Message Queuing Triggers
o
IIS Admin
°
FTP Publishing Service
°
Simple Mail Transport Protocol (SMTP)
°
World Wide Web Publishing Service

Shell Hardware Detection

System Restore Service

Task Scheduler

Telephony
o
Fax Service
o
Remote Access Auto Connection Manager
o
Remote Access Connection Manager
°
Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
°
Remote Access Auto Connection Manager

Telnet

Terminal Services
o
Fast User Switching Compatibility

Upload Manager

Volume Shadow Copy

Windows Audio

Windows Image Acquisition (WIA)

Windows Installer

Windows Management Instrumentation

Wireless Zero Configuration

WMI Performance Adapter
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 39 Revision 5: Sunday, August 31, 2003


Remote Procedure Call (RPC) Locator

Manages the RPC name service database. I have not found a reason to keep
this service running.
However, if something on your network breaks after you disable this
service, put it back to
manual. About 1.2 MB of RAM is in use with this service.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: NT AUTHORITY\NetworkService

Dependencies:

What service Remote Procedure Call (RPC) Locator needs to function
properly:


Workstation
What other service require Remote Procedure Call (RPC) Locator to
function properly:


None
Remote Registry Service

This feature is not available on Windows XP Home. This is one of those
not needed services.
One of the first I disable. If you are paranoid about security, disable
this service. Even if you are
not or do not care, disable it anyway.

Default XP Home: Not Available
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: NT AUTHORITY\LocalService

Dependencies:

What service Remote Registry Service needs to function properly:


Remote Procedure Call (RPC)
What other service require Remote Registry Service to function properly:

None
Removable Storage

Used for managing removable media. Disable this service if you do not
have items like tape
backup devices, etc. If your CD ROM / DVD drive starts acting funny, (no
auto play, etc) place
this service into automatic. Normally, this service does not need to be
running and you will not
miss any of its functionality.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 40 Revision 5: Sunday, August 31, 2003


Log on as: Local System account

Dependencies:

What service Removable Storage needs to function properly:


Remote Procedure Call (RPC)
What other service require Removable Storage to function properly:


None
RIP Listener

This feature is not available on Windows XP Home or installed by default
on Windows XP Pro,
but if needed, you may install it later off the Windows XP CD. If you do
not know what RIP
protocol is, you do not need this service installed.

Default XP Home: Not Available
Default XP Pro: Not Installed
Safe Setting: Not Installed

Dependencies:


Remote Procedure Call (RPC)
Routing and Remote Access

Allows computers to dial in to the local computer through a modem (or
other devices) to access
the local network using a standard or VPN connection. Unless you require
this functionality,
disable it for security reasons. Upon enabling this service, “Incoming
Connections” icon will be
available in the “Network Connections” control panel.

Default XP Home: Disabled
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What service RIP Listener needs to function properly:


Remote Procedure Call (RPC)
What other service require RIP Listener to function properly:


None
Secondary Logon

Enables starting processes under alternate credentials. I have never
found a reason to keep this
service running. I have always considered “Alternate Credentials”
someone other than me! Not
my idea of fun… Really, though, it allows a “limited user” account to
start an application or
process with higher privileges, such as the Administrator account or
another user. You can also

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 41 Revision 5: Sunday, August 31, 2003


have a privileged user start an application or process with limited
privileged account. If you
right-click a file, the menu will display “Run As” option. If you
disable this service, that function
will no longer be available.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: Local System account (with permission to interact with
desktop)

Dependencies:

What service Secondary Logon needs to function properly:


None
What other service require Secondary Logon to function properly:


None
Security Accounts Manager

Like Protected Storage, it saves profile and security information for
local users. This service is
required for IIS Admin. If you have ever used the Group Policy Editor
(gpedit.msc) to modify
your settings, you need to keep this service running; otherwise, your
modifications will not
apply. For “Safe” configurations, place this into automatic.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account

Dependencies:

What service Security Accounts Manager needs to function properly:


Remote Procedure Call (RPC)
What other services require Security Accounts Manager to function
properly:


Distributed Transaction Coordinator
o
Message Queuing
°
Message Queuing Triggers

IIS Admin
o
FTP Publishing Service
o
Simple Mail Transport Protocol (SMTP)
o
World Wide Web Publishing Service
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 42 Revision 5: Sunday, August 31, 2003


Server

Used for file and print sharing from your computer or Message Queuing.
For security purposes,
you may disable this service if you do not require local printers and
files shared across your
network. Connectivity, however, still exists even on incoming shared
network drives.
Workstation needs to be running to connect to another computer that has
the files you are
looking for. Note: If you disable File and Print sharing, the Server
Service may disappear from
the Services listing. Just enable File and Print sharing again and the
Server Service will return.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What service Server needs to function properly:


None
What other services require Server to function properly:


Computer Browser

Message Queuing
o
Message Queuing Triggers
Shell Hardware Detection

Used for the auto play of devices like memory cards, CD drives, etc.
Also, set to automatic if you
are experiencing problems with laptop docking stations. In “My
Computer,” you may not see
your hardware (example: DVD drive) displayed as a “DVD Drive” if this
service is disabled.
However, all functionality still exists. In addition, when checking the
properties of an “auto
play” device, such as a DVD drive, you will not have an auto play tab
displayed or available.
This service also allows the option of selecting what action you wish to
take with a particular
“type” of file. If you enjoy the auto play function of CD's and DVD's
after inserting them into
your drive, leave this service on automatic.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 43 Revision 5: Sunday, August 31, 2003


Dependencies:

What service Shell Hardware Detection needs to function properly:


Remote Procedure Call (RPC)
What other service require Shell Hardware Detection to function
properly:


None
Simple Mail Transport Protocol (SMTP)

This feature is not available on Windows XP Home or installed by default
on Windows XP Pro,
but if needed, you may install it later off the Windows XP CD. This
service supports the use of a
local (outbound) E-Mail server.

Default XP Home: Not Available
Default XP Pro: Not Installed
Safe Setting: Not Installed

Log on as: Local System account

Dependencies:

What services Simple Mail Transport Protocol (SMTP) needs to function
properly:


Event Log

IIS Admin
o
Remote Procedure Call (RPC)
o
Security Accounts Manager
°
Remote Procedure Call (RPC)
What other service require Simple Mail Transport Protocol (SMTP) to
function properly:


None
Simple TCP/IP Services

This service does not install by default, but if needed, you may install
it later off the Windows
XP CD. This service supports some old school UNIX networking services.

Default XP Home: Not Installed
Default XP Pro: Not Installed
Safe Setting: Not Installed

Log on as: Local System account

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 44 Revision 5: Sunday, August 31, 2003


Dependencies:
What service Simple TCP/IP Services needs to function properly:



AFD Networking Support Environment
What other service require Simple TCP/IP Services to function properly:

None
Smart Card

Supports the use of a Smart Card for local or network computer
authentication. If you do not
have a “Smart Card,” or you do not know what a Smart Card is, you do not
need this service
running. Save the 1.1 MB to 1.4 MB of RAM this service uses.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: NT AUTHORITY\LocalService

Dependencies:

What service Smart Card needs to function properly:


Plug and Play
What other service require Smart Card to function properly:

None
Smart Card Helper

Supports the use of a Smart Card for local or network computer
authentication. If you do not
have a “Smart Card,” you do not need this service running.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Dependencies:

What service Smart Card Helper needs to function properly:


None
What other service require Smart Card Helper to function properly:

None
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 45 Revision 5: Sunday, August 31, 2003


SNMP Service

This service does not install by default, but if needed, you may install
it later off the Windows
XP CD. This service supports the use of networking equipment that uses
SNMP as a mode of
remote management.

Default XP Home: Not Installed
Default XP Pro: Not Installed
Safe Setting: Not Installed

Log on as: Local System account

Dependencies:

What service SNMP Service needs to function properly:


Event Log
What other service require SNMP Service to function properly:


None
SNMP Trap Service

This service does not install by default, but if needed, you may install
it later off the Windows
XP CD. As above, this supports the use of networking equipment that uses
SNMP as a mode of
management.

Default XP Home: Not Installed
Default XP Pro: Not Installed
Safe Setting: Not Installed

Log on as: NT AUTHORITY\LocalService

Dependencies:

What service SNMP Trap Service needs to function properly:


Event Log
What other service require SNMP Trap Service to function properly:


None
SSDP Discovery Service

Used to locate UPnP devices on your home network. Used in conjunction
with Universal Plug
and Play Device Host, it detects and configures UPnP devices on your
home network. For
security reasons and for the fact that I doubt that you have any of
these devices, disable this
service. If any EXTERNAL device does not function because of this
service being disabled,
place it back in to automatic. MSN Messenger uses this service in
conjunction with supported
UPnP devices, to provide support for networks behind a NAT firewall or
router. Also, if you are
experiencing difficulty connecting to multiplayer games that use
DirectX(7,8,9), place this
service to automatic and ensure you download all security updates. The
problem that I have

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 46 Revision 5: Sunday, August 31, 2003


found with this service is that it broadcasts UDP port 1900 “a lot.”
Take note: UPnP is NOT PnP.
UPnP is for connectivity on networks via TCP/IP to devices, such as
scanners or printers. Your
sound card is PnP. Do NOT disable Plug and Play service.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: NT AUTHORITY\LocalService

Dependencies:

What service SSDP Discovery Service needs to function properly:


None
What other service require SSDP Discovery Service to function properly:


Universal Plug and Play Device Host
System Event Notification

Used in conjunction with COM+ Event System, this service notifies
particular services when
system events, such as logon and power events occur. I doubt the average
user really cares about
this. I have also not seen any applications that use this. You will
receive, in the Event Log, an
entry complaining about not having this service running if disabled. I
have yet to find a side
effect, though. For a “safe” configuration, leave this service on
automatic.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account

Dependencies:

What services System Event Notification needs to function properly:


COM+ Event System
o
Remote Procedure Call (RPC)
What other service require System Event Notification to function
properly:


None
System Restore Service

Read all of this before disabling! This service creates system snap
shots or restores a point for
returning to later. This is the OTHER service that is a massive resource
hog. Indexing Service is
number one. Every time you install a program or new driver, and on a
schedule, this service
creates a “restore point” to roll back to if a problem occurs. This
service would have been nice in
the Windows 95 days due to plenty of problems occurring (new DirectX
version every 15
minutes) but not required for the “much” more stable Windows XP. This is
the FIRST thing that

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 47 Revision 5: Sunday, August 31, 2003


I get rid of on a clean installation. I feel it is faster and less
hassle to just install clean. A rather
GOOD (and possibly the only) reason to use this “feature” is to roll
back your OS after installing
an unknown program or testing software. For example, if you use BETA
software of any kind.
NOTE: If you disable this service, your previous “restore points” will
delete. If, for whatever
reason, you do not want this to happen, do not disable this service. By
default, System Restore
Service uses a LARGE amount of disk space to store rollback points. On
large hard drives, this
could be well over 10 to 20 GB.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What service System Restore Service needs to function properly:


Remote Procedure Call (RPC)
What other service require System Restore Service to function properly:


None
Task Scheduler

You use this service to schedule maintenance, Microsoft Backup sessions,
or maybe even Auto
Update. I do everything manually, to avoid having this service running
all the time. Some third
party software may require this service to be active for automated
functions, such as virus
scanners, system maintenance tools, and automatic patch/driver lookups.
Take note: BootVis
requires Task Scheduler and COM+ Event System to be running if you wish
to take advantage of
the “optimize system” function. Why may you need this service? It is due
to the pre-fetching
function built into Windows XP. Another Note: Pre-fetching only occurs
on boot up and
application start, so if you do not care about a few extra seconds of
boot time, do not even bother
with it and disable Task Scheduler. On some applications, the
pre-fetching feature really does
help. Only you can decide whether to use its functionality and if it
helps in the performance of
your system.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account (with permission to interact with
desktop)

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 48 Revision 5: Sunday, August 31, 2003


Dependencies:
What service Task Scheduler needs to function properly:



Remote Procedure Call (RPC)
What other service require Task Scheduler to function properly:

None
TCP/IP NetBIOS Helper Service

This feature provides legacy support for NetBIOS over TCP/IP. If your
network does not use

NetBIOS and / or WINS, disable this function.
Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: NT AUTHORITY\LocalService
Dependencies:
What service TCP/IP NetBIOS Helper Service needs to function properly:



AFD Networking Support Environment

NetBIOS over TCP/IP
o
TCP/IP Protocol Driver
°
IPSEC driver
What other service require TCP/IP NetBIOS Helper Service to function
properly:


None
TCP/IP Printer Server

This service does not install by default, but if needed, you may install
it later off the Windows
XP CD. Used for setting up a local UNIX print server. If you do not need
this function, leave it
uninstalled.

Default XP Home: Not Installed
Default XP Pro: Not Installed
Safe Setting: Not Installed

Log on as: Local System account

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 49 Revision 5: Sunday, August 31, 2003


Dependencies:

What services TCP/IP Print Server needs to function properly:


Print Spooler
o
Remote Procedure Call (RPC)

TCP/IP Protocol Driver
o
IPSEC driver
What other service require TCP/IP Print Server to function properly:


None
Telephony

Controls telephony devices on the local computer. This service is
required for dial-up modem
connectivity. Note: you may require this service for some direct cable
or DSL providers,
depending on how they implement their logon process or some AOL
functionality, depending on
software used. If Dial-up, cable or DSL internet access no longer
functions properly with this
service disabled, place it into automatic. If you are connecting via a
hardware router or gateway,
this service is not needed.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account

Dependencies:

What services Telephony needs to function properly:


Plug and Play

Remote Procedure Call (RPC)
What other services require Telephony to function properly:


Fax Service

Remote Access Auto Connection Manager

Remote Access Connection Manager
o
Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
o
Remote Access Auto Connection Manager
Telnet

This service is not available on Windows XP Home. It allows remote login
to the local computer
via the telnet function. For security reasons, disable this unless you
specifically require its
functionality. You will save about 2 MB of RAM by plugging this security
hole.

Default XP Home: Not Available
Default XP Pro: Manual
Safe Setting: Disabled

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 50 Revision 5: Sunday, August 31, 2003


Log on as: Local System account

Dependencies:

What services Telnet needs to function properly:


NT LM Security Support Provider

Remote Procedure Call (RPC)

TCP/IP Protocol Driver
o
IPSEC driver
What other service require Telnet to function properly:


None
Terminal Services

Allows remote login to the local computer. This service is required for
Fast User Switching,
Remote Desktop Server and Remote Assistance. You will not be able to
view who is logged on
to a particular computer by viewing the “user” tab located in the Task
Manager if this service is
disabled. For security reasons, disable this unless you specifically
require its functionality. For
some reason, start this service to install Norton 2003.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account

Dependencies:

What service Terminal Services needs to function properly:


Remote Procedure Call (RPC)
What other service require Terminal Services to function properly:


Fast User Switching Compatibility
Themes

Used to display all those new XP themes and colors on your desktop. If
memory conscious and
does not care about the “new” XP look, disable this service to save RAM.
I have observed
between 4 MB to 12 MB of RAM used for the new themes.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 51 Revision 5: Sunday, August 31, 2003


Dependencies:

What service Themes needs to function properly:


None
What other service require Themes to function properly:


None
Uninterruptible Power Supply

I have not found a need for this. My UPS that connects via USB does NOT
need this service to
run. However, some APC UPS install a totally different service for
communication. Windows
Update also has a “patch” for the UPS service. Some UPS connected via
serial port may require
this service to be running.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: NT AUTHORITY\LocalService

Dependencies:

What service Uninterruptible Power Supply needs to function properly:


None
What other service require Uninterruptible Power Supply to function
properly:


None
Universal Plug and Play Device Host

Used in conjunction with SSDP Discovery Service, it detects and
configures UPnP devices on
your home network. For security reasons and for the fact that I doubt
that you have any of these
devices, disable this service. If any EXTERNAL device does not function
because of this service
being disabled, place it back in to automatic. MSN Messenger uses this
service in conjunction
with supported UPnP devices, to provide support for networks behind a
NAT firewall or router.
Also, if you are experiencing difficulty connecting to multiplayer games
that use DirectX(7,8,9),
place this service to automatic and ensure you download all security
updates. Furthermore, if you
use Internet Connection Sharing and wish to make use of the “allow
others to modify this
connection” feature, enable UPnP. Take note: UPnP is NOT PnP. UPnP is
for connectivity on
networks via TCP/IP to devices, such as scanners or printers. Your sound
card is PnP. Do NOT
disable Plug and Play service.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: NT AUTHORITY\LocalService

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 52 Revision 5: Sunday, August 31, 2003


Dependencies:
What service Universal Plug and Play Device Host needs to function
properly:



SSDP Discovery Service
What other service require Universal Plug and Play Device Host to
function properly:

None
Upload Manager

This service sends driver information to Microsoft to track availability
of driver information.
This service is not required for basic File and Print sharing. I have
yet to find a need for this
service, nor do I wish to send my hardware information to Microsoft.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What service Upload Manager needs to function properly:


Remote Procedure Call (RPC)
What other service require Upload Manager to function properly:

None
Volume Shadow Copy

Used in conjunction with the MS Software Shadow Copy Provider service.
Microsoft Backup
also uses these services. You will receive, in the Event Log, an entry
complaining about not
having this service running if disabled. I have yet to find a side
effect, though. If you do not like
the errors, place it in manual. By taking it out of automatic, you will
save about 3.0 MB of
memory.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account

Dependencies:

What service Volume Shadow Copy needs to function properly:


Remote Procedure Call (RPC)
What other service require Volume Shadow Copy to function properly:

None
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 53 Revision 5: Sunday, August 31, 2003


WebClient

I have not found a reason to have this service running. I have a hunch
that this is going to be
required for Microsoft's .”Net Software as a service.” For security
reasons, I recommend for this
service to be disabled. If some MS products, such as MSN Explorer, Media
Player, NetMeeting
or Messenger fail to provide a particular function, try to enable this
service to see if it is
“required” for your configuration.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: NT AUTHORITY\LocalService

Dependencies:

What service WebClient needs to function properly:


WebDav Client Redirector
What other service require WebClient to function properly:

None
Windows Audio

This service is required if you wish to hear any audio at all. If your
computer does not have a

sound card, disable this service.
Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account
Dependencies:
What services Windows Audio needs to function properly:



Plug and Play

Remote Procedure Call (RPC)
What other service require Windows Audio to function properly:

None
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 54 Revision 5: Sunday, August 31, 2003


Windows Image Acquisition (WIA)

Used for some scanners, web cams, and cameras. If, after disabling this
service, your scanner or
camera fails to function properly, enable this service by placing it
into automatic.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account

Dependencies:

What service Windows Image Acquisition (WIA) needs to function properly:

Remote Procedure Call (RPC)
What other service require Windows Image Acquisition (WIA) to function
properly:


None
Windows Installer

This service is required for software applications that install using
MSI files. If no applications
that you have will install properly or you get an error that involves
“RPC Service,” place this
service in to Automatic or Manual. Only disable this service after you
have completed
installation of your applications, mainly Office and such. I am not
aware how many Games
actually use MSI Files. In an idle state, this service uses about 3.4 MB
of RAM. Put it to manual
to save that amount.

Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Manual

Dependencies:


Remote Procedure Call (RPC)
Windows Management Instrumentation

This service is required if you want to see the “Dependencies” tab in
service configuration and
you want everything to go smoothly. I do not recommend disabling this
service as strange things
may start to happen.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account (with permission to interact with
desktop)

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 55 Revision 5: Sunday, August 31, 2003


Dependencies:

What services Windows Management Instrumentation needs to function
properly:


Event Log

Remote Procedure Call (RPC)
What other service require Windows Management Instrumentation to
function properly:


None
Windows Management Instrumentation Driver Extension

This feature is not available on Windows XP Home. This service is not as
vital as Windows
Management Instrumentation, but I recommend leaving this service in
manual.

Default XP Home: Not Available
Default XP Pro: Manual
Safe Setting: Manual

Log on as: Local System account (with permission to interact with
desktop)

Dependencies:

What service Windows Management Instrumentation Driver Extension needs
to function
properly:


None
What other service require Windows Management Instrumentation Driver
Extension to function
properly:


None
Windows Time

Automatically sets your clock by contacting a server (Microsoft’s server
by default) on the
internet. Great idea if your network connects to the internet 24/7. The
Event Log fills up with
“cannot find server” messages on a non-dedicated setup, though. After
successful synchronizing,
this service will not attempt to do it again for 7 days, meanwhile,
taking up resources. You may
also need Task Scheduler running. You may choose to set your clock
manually on a dial up
connection, but with a 24/7 broadband setup, this could keep you on time
for work. Note: as
mentioned, “time.windows.com” is the default server for synchronization.
For those privacy
conscious people that prefer to connect to a government site rather then
MS, use “time.nist.gov.”

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: Local System account

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 56 Revision 5: Sunday, August 31, 2003


Dependencies:
What service Windows Time needs to function properly:



None
What other service require Windows Time to function properly:

None
Wireless Zero Configuration

Provides automatic configuration for wireless network devices and
connection quality feedback.
If you do not have any wireless network devices in use on the local
system, disable this service.
You may require this service for connectivity with some “hot sync”
software for a PDA, laptop
or other portable computer

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Disabled

Log on as: Local System account

Dependencies:

What services Wireless Zero Configuration needs to function properly:


NDIS Usermode I/O Protocol

Remote Procedure Call (RPC)
What other service require Wireless Zero Configuration to function
properly:

None
WMI Performance Adapter

I have not found a use for this service. Save the 2.5 MB to 6 MB of
memory, this service

consumes.
Default XP Home: Manual
Default XP Pro: Manual
Safe Setting: Disabled

Log on as: Local System account
Dependencies:
What service WMI Performance Adapter needs to function properly:



Remote Procedure Call (RPC)
What other service require WMI Performance Adapter to function properly:

None
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 57 Revision 5: Sunday, August 31, 2003


Workstation

Used to connect local computer to remote computers. Examples may include
local network
connectivity and File and Print sharing. Many services depend on
Workstation to be functioning.
Leave it on automatic for safe configurations.

Default XP Home: Automatic
Default XP Pro: Automatic
Safe Setting: Automatic

Log on as: Local System account

Dependencies:

What service Workstation needs to function properly:


None
What other services require Workstation to function properly:


Alerter

Background Intelligent Transfer Service

Computer Browser

Messenger

Net Logon

Remote Procedure Call (RPC) Locator
World Wide Web Publishing Service

This feature is not available on Windows XP Home or installed by default
on Windows XP Pro,
but if needed, you may install it later off the Windows XP CD. Used for
setting up a local web
server. If you do not need this function, leave it uninstalled, mainly
because this service requires
IIS Admin to be running and IIS has been “popular” for crackers to
break.

Default XP Home: Not Available
Default XP Pro: Not Installed
Safe Setting: Not Installed

Log on as: Local System account

Dependencies:

What services World Wide Web Publishing Service needs to function
properly:


IIS Admin

Remote Procedure Call (RPC)

Security Accounts Manager

Remote Procedure Call (RPC)
What other service require World Wide Web Publishing Service to function
properly:


None
© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 58 Revision 5: Sunday, August 31, 2003


Original content created July 28, 2001
Last update was Sunday, August 31, 2003


Copyright © 2001-2003 by Black Viper
All Rights Reserved.


Up to date content and contact information is located at
www.blkviper.com or www.blackviper.com.


Strange Processes

Most of these are not really “Services,” but are applications or
processes running at different
times:

Most may be disabled using “msconfig.”

Ati2evxx.exe

This service, Ati HotKey Poller, is installed if you update to the
latest ATI video card drivers. It
provides the ability to hot key your display settings for what ever
reason you would need this
feature. I do not change them often, so there is no point in having this
service “always running.”

Ati2sgag.exe

This service, ATI Smart, is installed if you update to the latest ATI
video card drivers. It
provides the ability to test your particular configuration for
compatibility issues and stability
issues. The location is also in the ATI display properties control
panel. After testing “once,” I
have found no reason to continue to have this service in memory.

crypserv.exe

This service, Crypkey License, is installed if you use “Swish”
(swishzone.com). It is required to
start up the program, otherwise an error about writing to a memory
location pops up. Set this to
Disabled until you need it. Note: If set to “Manual,” this service will
NOT start on its own (thus
the error message).

csrss.exe

This is “Client Server Runtime Process” is part of the core of Windows.
You cannot kill it and I
am not sure why you would even want to. It is a 4k process that sucks up
about 3 MB to 6 MB or
so, but I do not support making it go away. Usually, if it is
“difficult” to get rid of, it is needed.

ctfmon.exe

This is your “Language Bar.” Don't know what it is? I bet you do not
need it. Head to Control
Panel -> Regional and Language Options -> Languages TAB -> Details
BUTTON -> Language
Bar BUTTON (under “Preferences”) -> select the “Turn off advanced text
services” check box.
This little detail will save you between 1.5 MB and 4 MB of RAM. If you
are using a “non-US”
version, you may be required to install the English localization to
remove this “feature.”

CTHELPER.EXE

This is installed with the SoundBlaster Audigy2 drivers. It takes about
4 MB of RAM.

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 59 Revision 5: Sunday, August 31, 2003


CTDVDDET.exe

This is also installed with the SoundBlaster Audigy2 drivers. A “DVD
Detection” application. It
sucks up about 2.2 MB of memory. You can disable it by heading to the
MediaSource DVD
Audio Player, selecting Tools, then uncheck the “Auto Start” box. It
should not start up
automatically again.

CTSysVol.exe

Yet another that is installed with the SoundBlaster Audigy2 Card. A
“Volume Control”
application that, by default, sits in the system tray. It takes about
3.8 to 5 MB of RAM doing
nothing. Right click the tray icon and select “Close,” then disable it
via msconfig.

defwatch.exe

This service, DefWatch, is installed with Norton. “Virus Definitions
Daemon.” Unless you do
not want your Virus Scanner to work properly, keep this going.

devldr32.exe

This is installed if you have a Creative Sound Card (SBLive Series that
I am aware of). It sucks
up 2.3 MB to 2.6 MB, but I have not completed extensive testing with
this NOT being there…
After manually killing the process (this is not a service, it is listed
as a driver in the hardware
properties of the sound card) I loaded up a game of Dungeon Siege and
all EAX features and 5.1
positional sound worked (with EAX on or off). Also, all Direct Sound
tests completed without
errors. Do not get excited, though. After renaming the process, the
Windows File Protection
dialog pops up. Upon reboot, devldr32.exe is not displayed in the active
processes in Task
Manager, but the Creative Mixer and AudioHQ applications fail to load. I
also searched for a
reference in the registry and found little to nothing… Kill it if you
want to recover some
memory, but I do not support such “drastic” measures… so you are on your
own with it. Do not
E-Mail me asking for help if you killed this process.

explorer.exe

This is NOT related to Internet Explorer. There will ALWAYS be an
explorer.exe running in the
background. It is the user interface process/desktop/shell, etc. This is
one of the many ways how
Bill got away with “integrating” IE with Windows… If you load up
“Windows Explorer” to
rummage through files, you will see an additional explorer.exe in the
background. This will
fluctuate depending on what you have (fonts, background pics, active
desktop) going at any
given time. Usage of between 5.8 MB and 36 MB RAM is typical.

Fast.exe

This service is installed with Windows XP PowerToys, namely the
Interactive Login Service.
Uses 1.4 MB to 2 MB EACH! This service will fire off at least 2 (system
and user) instances of
this process.

IAANTmon.exe

This service, IAA Event Monitor, is installed with Intel's Application
Accelerator and uses about
876 KB of memory.

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 60 Revision 5: Sunday, August 31, 2003


Idle

This is a generic process that is used when no other program or process
is requiring CPU
resources. It is not a bad thing if it is using 99% of your CPU! This
process is a 16 k loop that the
CPU processes while it is not doing “anything” else. If you computer is
called upon to do any
other task than “nothing,” the idle process allows that to happen and
the % used will decrease
accordingly. You can not disable the idle process. If it is using 97%
CPU, which only means that
the other 3% is used by real programs. If your idle process is
constantly at a low rate (for
example, 3%) something else, an application or process is using the CPU.
IEXPLORE.EXE

This is the IE browser. Pops up only when you want to suck up 7.3 MB to
?? MB of memory to
surf the web. I say ?? MB because every time you open an additional
browser, you also start
another one of these processes. If you close “all” browser windows, a
IEXPLORE.EXE process
will still be running. This is a “feature” to allow faster startup the
next time you open IE. Unlike
Mozilla, you cannot disable this “feature” other than directly killing
the offending process.

iTouch.exe

This process is installed with Logitech software for the “internet” key
functions on keyboards
and iTouch features on compatible mice. Plenty of functions remain with
this software disabled,
but some of the more “cool” stuff will not. This process takes from 3.6
MB to 12 MB of
memory.

“Generic Host Process for Win32 Services”

This is what ZoneAlarm complains about while connected to the internet.
“SVCHOST.EXE” is
“Generic Service Host.” What that means is it is a “host” for other
processes or services. Check
this document starting on Page 4 to see “all” of the services that use
SVCHOST.EXE as a front
for something else.

If your internet connection seems to “no longer work,” it is due to you
disallowing various
“required” functions to no longer access the internet. A big one is “DNS
Lookups.” If you do not
allow this to get through, you will no longer be able to type in
“blkviper.com” but you will
always be able to type in the IP address of the systems. The internet
connection is still working,
but you are blocking a “vital” part of the process for surfing web
pages.

mdm.exe

This service, Machine Debug Manager, is installed with Office components
or possibly the
Visual series. Make it go away if you are not in need of “Debugging”
software.

mozilla.exe

This is the Mozilla browser executable. It uses between 14 MB and ?? MB
of memory.
Optionally, you can disable the system tray icon and not allow the
“Quick Launch” feature to tell
Mozilla to completely unload from memory when the final browser window
is closed. This will,
of course, increase the startup time when you fire up the browser
window, again.

msmsgs.exe

This is Microsoft Windows Messenger that comes with Windows XP Home and
Pro. With some
applications, namely, Outlook and MSN Explorer, this process will still
run in the background to
get all of those .NET alerts, etc, that Microsoft is saying will be so
cool.

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 61 Revision 5: Sunday, August 31, 2003


msn6.exe

This is the Microsoft “MSN Explorer” bundled with Windows XP Home and
Pro. While running
this application, you will also have the previous process running. See
msmsgs.exe for more
information.

mspmspsv.exe

This service, WMDM PMSP Service, is installed starting with Windows
Media Player 7. If you
do not use Media Player, disable this service. If you begin using Media
Player again and
functions do not work properly, such as Digital Rights Management or
Copy Protection, set this
to Manual or Automatic.

navapsvc.exe

This service, Norton AntiVirus Auto Protect Service, is installed with
Norton 2002. Unless you
want your Virus Scanner to not function, keep this in Manual.

Navapw32.exe

This is installed with Norton AntiVirus 2002 Software. Unless you want
your Virus Scanner to
no longer function, keep this process running. Do not “end” it. This
process is also responsible
for automatically updating the virus definitions and displaying that
cute little icon in the system
tray.

Nvsvc32.exe

This service, NVIDIA Driver Helper Service, is installed when you change
from the WDM
drivers to nVidia's latest and greatest version. The service uses about
945k and zero CPU, but
there is no need for it. I have even experienced EXTREME shutdown delays
with this service
active, but no adverse side effects with it disabled. Make it go away.
NOTE: If using drivers
other than nVidia's, such as Asus, this service may have been renamed to
reflect that.

point32.exe

This is installed with Microsoft Mouse Software, Intellimouse and the
like. Most functions (if
not all) are built into XP, so there is NO need to suck up 1.1 MB to 1.6
MB for a useless program
also running in the background/system tray unless you require “specially
mapped” key
configurations for your buttons.

promon.exe

This is installed with Intel Pro family graphics adapters. It controls
the application that displays
in your system tray. It uses about 656K to 1.1 MB just sitting there. I
hate icons in the system
tray… I have none.

rtvscan.exe

This service, Norton AntiVirus Client and Server, is installed with
Norton Corporate Edition.
Unless you want your Virus Scanner to not function, keep this going.

SBServ.exe

This service, ScriptBlocking Service, is installed with Norton 2002.
Unless you want your Virus
Scanner to stop preventing malicious scripts from doing damage, keep
this in Automatic.

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 62 Revision 5: Sunday, August 31, 2003


smss.exe
Dubbed “Windows NT Session Manager.” Another process (see csrss.exe
above) that is part of
the core of Windows. It is a 45 KB process that uses about 300 KB to 2
MB. You cannot kill this
process manually and I do not recommend trying other ways to get rid of
it. Usually, if it is
“difficult” to get rid of, it is needed.

svchost.exe

A generic process that is “Service Host” for other processes. Yes, this
is actually a service, but I
am placing it here because I have no where else to put it. You may have
3 or 4 copies running in
task manager (system, network, user, and ?) If you use my tweaking tips
in this document, you
can rid yourself of a couple of them.

SWTrayV4.EXE

This is installed with the Microsoft SideWinder Version 4 Software. It
takes between 4 MB and
5 MB of RAM.

System IDLE Process

This is a generic process that is used when no other program or process
is requiring CPU
resources. It is not a bad thing if it is using 99% of your CPU! This
process is a 16 k loop that the
CPU processes while it is not doing “anything” else. If you computer is
called upon to do any
other task than “nothing,” the idle process allows that to happen and
the % used will decrease
accordingly. You can not disable the idle process. If it is using 97%
CPU, which only means that
the other 3% is used by real programs. If your idle process is
constantly at a low rate (for
example, 3%) something else, an application or process is using the CPU.
taskmgr.exe

If you are looking at the processes running, this is the application
that you are using to do it.
“Windows Task Manager” is the full name. It uses about 3.2 MB of RAM, so
take that into
account when you are tweaking your system.

TaskSwitch.exe

This is installed with PowerToys for XP. It uses 1.4 MB to 2 MB to
display those cute icons
when you hit Alt+tab. I can do without.

vptray.exe

This is the cute Norton AV Tray application that displays in your system
tray. It uses about 2.9
MB just sitting there. You may recover SOME memory by making the icon go
away, but it is
STILL running in the background.

winlogon.exe

This takes care of login and logoff tasks. Really, you cannot get rid of
this process. It is required
as long as you are “logged in.” I have saw this process fluctuate
between 1.2 MB to 8.5 MB on a
system that has been up for only an hour and 1.7 MB and 17 MB on a
system that has been up
for 40+ days.

© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 63 Revision 5: Sunday, August 31, 2003


wowexec.exe

This is as process that is fired off to help “translate” interrupts, etc
for 16 bit applications. If you
see this process running, you are doing just that, running old
applications or a DOS/command
line/console window applications. Try and seek out “updated” software.


Original content created July 28, 2001
Last update was Sunday, August 31, 2003


Copyright © 2001-2003 by Black Viper
All Rights Reserved.


Up to date content and contact information is located at
www.blkviper.com or www.blackviper.com.


© 2001-2003 Black Viper of http://www.blackviper.com All Rights
Reserved.
Page 64 Revision 5: Sunday, August 31, 2003


 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
stop org.jdesktop.application.Task started using @Action public Task Mike Java 1 05-12-2008 12:09 PM
Closing port 135 and disabling DCOM affect Task Scheduler? updata@noemail.com Computer Support 3 01-05-2008 10:34 AM
Accessing ant task name when running a task teggy Java 0 05-29-2007 02:20 PM
Maven using ANT plugin for SCP task : Embedded error: Could not create task or type of type: scp. krabhi Java 1 08-09-2006 04:19 PM
Re: Problem in ant replace task and replaceregexp task to update xml Victor Java 0 09-01-2004 03:58 AM



Advertisments