www.BlackViper.com: Windows XP Service Pack 2 Services 411 - Server

Server

Default Description:

Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Additional Information:

Used for file and print sharing from your computer or Message Queuing. For security purposes, you may disable this service if you do not require local printers and files shared across your network. Connectivity, however, still exists even on incoming shared network drives. Workstation needs to be running to connect to another computer that has the files you are looking for.

Note: If you disable File and Print sharing, the Server Service may disappear from the Services listing. Just enable File and Print sharing again and the Server Service will return.

October 24, 2008: A vulnerability in the Server Service has been discovered for Windows 2000 -> Windows 7 (basically, all versions in the last 9 years). Please see this security bulletin and update your PC accordingly: http://www.microsoft.com/technet/security/bulletin/MS08-067.mspx

February 26, 2009: The Server Service issue is still causing quite a stir on the internet. Ensure that you have fully updated your system as to not be infected by "Conficker" or it's several variants.

• CA: http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=75911
• F-Secure: http://www.f-secure.com/v-descs/worm_w32_downadup_al.shtml
• Symantec: http://www.symantec.com/security_response/writeup.jsp?docid=2008-112203-2408-99&tabid=1
• Sophos: http://www.sophos.com/security/analyses/viruses-and-spyware/w32conficka.html

In order to fix this issue, you need to patch your system using the latest update fix version: http://www.microsoft.com/technet/security/bulletin/MS08-067.mspx

In order to remove the problem, you can use Microsoft's own removal tool or anything else offered from the company links above: http://www.microsoft.com/security/malwareremove/default.mspx

Regardless of what you do or how you choose to go about it, fix/patch/prevent.

Defaults Startup Type:

Default XP Home: Automatic
Default XP MCE 2005: Automatic
Default XP Pro: Automatic
Default XP Pro x64: Automatic
Default XP Tablet PC 2005: Automatic

Other Settings:

Safe Setting: Automatic

Service Names:

Service Name (registry): lanmanserver

Display Name: Server

Default Path and Command Line Options:

C:\WINDOWS\System32\svchost.exe -k netsvcs

Log On As:

Account: Local System Account

Dependencies:

What service Server needs to function properly:

• None

What other service require Server to function properly:

• Computer Browser
  • Message Queuing
    • Message Queuing Triggers

Default Registry Entries:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"DisplayName"="Server"
"ObjectName"="LocalSystem"
"Description"="Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start."