www.BlackViper.com: Windows 7 Services 411 - Server

Server

Default Description:

Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Additional Information:

October 24, 2008: A vulnerability in the Server Service has been discovered for Windows 2000 -> Windows 7 (basically, all versions in the last 9 years). Please see this security bulletin and update your PC accordingly: http://www.microsoft.com/technet/security/bulletin/MS08-067.mspx

February 26, 2009: The Server Service issue is still causing quite a stir on the internet. Ensure that you have fully updated your system as to not be infected by "Conficker" or it's several variants.

• CA: http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=75911
• F-Secure: http://www.f-secure.com/v-descs/worm_w32_downadup_al.shtml
• Symantec: http://www.symantec.com/security_response/writeup.jsp?docid=2008-112203-2408-99&tabid=1
• Sophos: http://www.sophos.com/security/analyses/viruses-and-spyware/w32conficka.html

In order to fix this issue, you need to patch your system using the latest update fix version: http://www.microsoft.com/technet/security/bulletin/MS08-067.mspx

In order to remove the problem, you can use Microsoft's own removal tool or anything else offered from the company links above: http://www.microsoft.com/security/malwareremove/default.mspx

Regardless of what you do or how you choose to go about it, fix/patch/prevent.

Additional Reading:

• None at this time

Discussion Topic Link:

Windows 7 Services Forum

Defaults Startup Type:

Windows 7 Starter: Automatic (Started)
Windows 7 Home Basic: Automatic (Started)
Windows 7 Home Premium: Automatic (Started)
Windows 7 Professional: Automatic (Started)
Windows 7 Ultimate: Automatic (Started)
Windows 7 Enterprise: Automatic (Started)

Other Settings:

Safe Setting: Automatic

Service Names:

Service Name (registry): LanmanServer

Display Name: Server

Default Path and Command Line Options:

C:\Windows\system32\svchost.exe -k netsvcs

Log On As:

Account: Local System account

Dependencies:

What service Server needs to function properly:

• Security Accounts Manager (S, HB, HP, P, U, E)
  • Remote Procedure Call (RPC) (S, HB, HP, P, U, E)
    • DCOM Server Process Launcher (S, HB, HP, P, U, E)
    • RPC Endpoint mapper (S, HB, HP, P, U, E)
• Server SMB 1.xxx Driver (S, HB, HP, P, U, E)
  • Server SMB 2.xxx Driver (S, HB, HP, P, U, E)
    • srvnet

What other service require Server to function properly:

• Computer Browser (S, HB, HP, P, U, E)
• HomeGroup Listener (S, HB, HP, P, U, E)

Registry Settings (.reg):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer]
"DisplayName"="@%systemroot%\\system32\\srvsvc.dll,-100"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"Description"="@%systemroot%\\system32\\srvsvc.dll,-101"
"ObjectName"="LocalSystem"
"ErrorControl"=dword:00000001
"Start"=dword:00000002
"Type"=dword:00000020
"DependOnService"=hex(7):53,00,61,00,6d,00,53,00,53,00,00,00,53,00,72,00,76,00,\
00,00,00,00
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,43,00,68,00,61,00,6e,00,67,00,65,00,4e,\
00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,\
67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,\
00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
00,00,53,00,65,00,41,00,75,00,64,00,69,00,74,00,50,00,72,00,69,00,76,00,69,\
00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4c,00,6f,00,61,00,64,00,44,00,\
72,00,69,00,76,00,65,00,72,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,\
00,65,00,00,00,00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,60,ea,00,00,01,00,00,00,c0,d4,01,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Aliases]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\AutotunedParameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\DefaultSecurity]
"SrvsvcConfigInfo"=hex:01,00,04,80,a0,00,00,00,ac,00,00,00,00,00,00,00,14,00,\
00,00,02,00,8c,00,06,00,00,00,00,00,18,00,17,00,0f,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00,00,00,18,00,17,00,0f,00,01,02,00,00,00,00,00,05,\
20,00,00,00,25,02,00,00,00,00,14,00,17,00,0f,00,01,01,00,00,00,00,00,05,12,\
00,00,00,00,00,18,00,03,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,\
00,00,00,00,14,00,01,00,00,00,01,01,00,00,00,00,00,01,00,00,00,00,00,00,14,\
00,01,00,00,00,01,01,00,00,00,00,00,05,07,00,00,00,01,01,00,00,00,00,00,05,\
12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
"SrvsvcTransportEnum"=hex:01,00,04,80,8c,00,00,00,98,00,00,00,00,00,00,00,14,\
00,00,00,02,00,78,00,05,00,00,00,00,00,18,00,17,00,0f,00,01,02,00,00,00,00,\
00,05,20,00,00,00,20,02,00,00,00,00,18,00,17,00,0f,00,01,02,00,00,00,00,00,\
05,20,00,00,00,25,02,00,00,00,00,14,00,17,00,0f,00,01,01,00,00,00,00,00,05,\
12,00,00,00,00,00,18,00,03,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,23,\
02,00,00,00,00,14,00,01,00,00,00,01,01,00,00,00,00,00,05,0b,00,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
"SrvsvcConnection"=hex:01,00,04,80,7c,00,00,00,88,00,00,00,00,00,00,00,14,00,\
00,00,02,00,68,00,04,00,00,00,00,00,18,00,01,00,0f,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00,00,00,18,00,01,00,0f,00,01,02,00,00,00,00,00,05,\
20,00,00,00,25,02,00,00,00,00,18,00,01,00,00,00,01,02,00,00,00,00,00,05,20,\
00,00,00,26,02,00,00,00,00,18,00,01,00,00,00,01,02,00,00,00,00,00,05,20,00,\
00,00,23,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,\
05,12,00,00,00
"SrvsvcServerDiskEnum"=hex:01,00,04,80,4c,00,00,00,58,00,00,00,00,00,00,00,14,\
00,00,00,02,00,38,00,02,00,00,00,00,00,18,00,01,00,0f,00,01,02,00,00,00,00,\
00,05,20,00,00,00,20,02,00,00,00,00,18,00,01,00,0f,00,01,02,00,00,00,00,00,\
05,20,00,00,00,25,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,\
00,00,00,05,12,00,00,00
"SrvsvcFile"=hex:01,00,04,80,64,00,00,00,70,00,00,00,00,00,00,00,14,00,00,00,\
02,00,50,00,03,00,00,00,00,00,18,00,11,00,0f,00,01,02,00,00,00,00,00,05,20,\
00,00,00,20,02,00,00,00,00,18,00,11,00,0f,00,01,02,00,00,00,00,00,05,20,00,\
00,00,25,02,00,00,00,00,18,00,11,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,\
00,23,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,\
12,00,00,00
"SrvsvcSessionInfo"=hex:01,00,04,80,78,00,00,00,84,00,00,00,00,00,00,00,14,00,\
00,00,02,00,64,00,04,00,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,00,05,\
20,00,00,00,25,02,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,00,05,20,\
00,00,00,23,02,00,00,00,00,14,00,01,00,00,00,01,01,00,00,00,00,00,05,0b,00,\
00,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,\
00
"SrvsvcShareFileInfo"=hex:01,00,04,80,b4,00,00,00,c0,00,00,00,00,00,00,00,14,\
00,00,00,02,00,a0,00,07,00,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,\
00,05,20,00,00,00,20,02,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,00,\
05,20,00,00,00,25,02,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,00,05,\
20,00,00,00,23,02,00,00,00,00,14,00,01,00,00,00,01,01,00,00,00,00,00,01,00,\
00,00,00,00,00,14,00,01,00,00,00,01,01,00,00,00,00,00,05,07,00,00,00,00,00,\
14,00,02,00,00,00,01,01,00,00,00,00,00,05,14,00,00,00,00,00,14,00,02,00,00,\
00,01,01,00,00,00,00,00,05,04,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00,\
01,01,00,00,00,00,00,05,12,00,00,00
"SrvsvcSharePrintInfo"=hex:01,00,04,80,cc,00,00,00,d8,00,00,00,00,00,00,00,14,\
00,00,00,02,00,b8,00,08,00,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,\
00,05,20,00,00,00,20,02,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,00,\
05,20,00,00,00,25,02,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,00,05,\
20,00,00,00,26,02,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,00,05,20,\
00,00,00,23,02,00,00,00,00,14,00,01,00,00,00,01,01,00,00,00,00,00,01,00,00,\
00,00,00,00,14,00,01,00,00,00,01,01,00,00,00,00,00,05,07,00,00,00,00,00,14,\
00,02,00,00,00,01,01,00,00,00,00,00,05,14,00,00,00,00,00,14,00,02,00,00,00,\
01,01,00,00,00,00,00,05,04,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00,01,\
01,00,00,00,00,00,05,12,00,00,00
"SrvsvcShareAdminInfo"=hex:01,00,04,80,8c,00,00,00,98,00,00,00,00,00,00,00,14,\
00,00,00,02,00,78,00,05,00,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,\
00,05,20,00,00,00,20,02,00,00,00,00,18,00,02,00,00,00,01,02,00,00,00,00,00,\
05,20,00,00,00,25,02,00,00,00,00,18,00,02,00,00,00,01,02,00,00,00,00,00,05,\
20,00,00,00,23,02,00,00,00,00,14,00,01,00,00,00,01,01,00,00,00,00,00,01,00,\
00,00,00,00,00,14,00,01,00,00,00,01,01,00,00,00,00,00,05,07,00,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
"SrvsvcShareChange"=hex:01,00,04,80,a4,00,00,00,b0,00,00,00,00,00,00,00,14,00,\
00,00,02,00,90,00,06,00,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,00,05,\
20,00,00,00,25,02,00,00,00,00,18,00,13,00,0f,00,01,02,00,00,00,00,00,05,20,\
00,00,00,23,02,00,00,01,00,18,00,13,00,0f,00,01,02,00,00,00,00,00,05,20,00,\
00,00,22,02,00,00,01,00,14,00,13,00,0f,00,01,01,00,00,00,00,00,05,07,00,00,\
00,00,00,14,00,13,00,0f,00,01,01,00,00,00,00,00,05,0b,00,00,00,01,01,00,00,\
00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
"SrvsvcShareConnect"=hex:01,00,04,80,8c,00,00,00,98,00,00,00,00,00,00,00,14,00,\
00,00,02,00,78,00,05,00,00,00,00,00,18,00,03,00,0f,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00,00,00,18,00,03,00,0f,00,01,02,00,00,00,00,00,05,\
20,00,00,00,25,02,00,00,00,00,18,00,03,00,0f,00,01,02,00,00,00,00,00,05,20,\
00,00,00,27,02,00,00,00,00,14,00,01,00,00,00,01,01,00,00,00,00,00,01,00,00,\
00,00,00,00,14,00,01,00,00,00,01,01,00,00,00,00,00,05,07,00,00,00,01,01,00,\
00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
"SrvsvcShareAdminConnect"=hex:01,00,04,80,78,00,00,00,84,00,00,00,00,00,00,00,\
14,00,00,00,02,00,64,00,04,00,00,00,00,00,18,00,03,00,0f,00,01,02,00,00,00,\
00,00,05,20,00,00,00,20,02,00,00,00,00,18,00,03,00,0f,00,01,02,00,00,00,00,\
00,05,20,00,00,00,25,02,00,00,00,00,18,00,03,00,0f,00,01,02,00,00,00,00,00,\
05,20,00,00,00,27,02,00,00,00,00,14,00,03,00,0f,00,01,01,00,00,00,00,00,05,\
04,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,\
00,00,00
"SrvsvcStatisticsInfo"=hex:01,00,04,80,60,00,00,00,6c,00,00,00,00,00,00,00,14,\
00,00,00,02,00,4c,00,03,00,00,00,00,00,18,00,01,00,0f,00,01,02,00,00,00,00,\
00,05,20,00,00,00,20,02,00,00,00,00,18,00,01,00,0f,00,01,02,00,00,00,00,00,\
05,20,00,00,00,25,02,00,00,00,00,14,00,01,00,00,00,01,01,00,00,00,00,00,02,\
00,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,\
00,00,00
"AnonymousDescriptorsUpgraded"=dword:00000001
"PreviousAnonymousRestriction"=dword:00000000
"SessionSecurityDescriptorRegenerated"=dword:00000001
"InteractiveDescriptorsRegenerated"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage]
"Bind"=hex(7):5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,53,00,6d,00,62,\
00,5f,00,54,00,63,00,70,00,69,00,70,00,5f,00,7b,00,31,00,43,00,33,00,32,00,\
46,00,33,00,44,00,37,00,2d,00,30,00,39,00,32,00,39,00,2d,00,34,00,32,00,39,\
00,32,00,2d,00,42,00,45,00,45,00,44,00,2d,00,38,00,32,00,44,00,46,00,39,00,\
39,00,43,00,37,00,42,00,35,00,35,00,30,00,7d,00,00,00,5c,00,44,00,65,00,76,\
00,69,00,63,00,65,00,5c,00,53,00,6d,00,62,00,5f,00,54,00,63,00,70,00,69,00,\
70,00,36,00,5f,00,7b,00,38,00,33,00,44,00,31,00,43,00,41,00,32,00,33,00,2d,\
00,44,00,43,00,45,00,39,00,2d,00,34,00,35,00,33,00,46,00,2d,00,41,00,45,00,\
31,00,44,00,2d,00,34,00,31,00,34,00,45,00,32,00,43,00,41,00,42,00,32,00,38,\
00,43,00,31,00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,\
53,00,6d,00,62,00,5f,00,54,00,63,00,70,00,69,00,70,00,36,00,5f,00,7b,00,41,\
00,32,00,35,00,36,00,43,00,30,00,43,00,43,00,2d,00,43,00,41,00,37,00,38,00,\
2d,00,34,00,39,00,33,00,42,00,2d,00,41,00,41,00,41,00,39,00,2d,00,35,00,38,\
00,33,00,35,00,37,00,45,00,41,00,33,00,34,00,37,00,41,00,30,00,7d,00,00,00,\
5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,53,00,6d,00,62,00,5f,00,54,\
00,63,00,70,00,69,00,70,00,36,00,5f,00,7b,00,32,00,37,00,31,00,33,00,36,00,\
37,00,38,00,43,00,2d,00,39,00,44,00,36,00,37,00,2d,00,34,00,39,00,39,00,30,\
00,2d,00,39,00,30,00,36,00,45,00,2d,00,33,00,37,00,31,00,32,00,38,00,45,00,\
34,00,42,00,39,00,30,00,46,00,43,00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,\
00,63,00,65,00,5c,00,53,00,6d,00,62,00,5f,00,54,00,63,00,70,00,69,00,70,00,\
36,00,5f,00,7b,00,31,00,43,00,33,00,32,00,46,00,33,00,44,00,37,00,2d,00,30,\
00,39,00,32,00,39,00,2d,00,34,00,32,00,39,00,32,00,2d,00,42,00,45,00,45,00,\
44,00,2d,00,38,00,32,00,44,00,46,00,39,00,39,00,43,00,37,00,42,00,35,00,35,\
00,30,00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,54,00,\
63,00,70,00,69,00,70,00,5f,00,7b,00,31,00,43,00,33,00,32,00,46,00,33,00,44,\
00,37,00,2d,00,30,00,39,00,32,00,39,00,2d,00,34,00,32,00,39,00,32,00,2d,00,\
42,00,45,00,45,00,44,00,2d,00,38,00,32,00,44,00,46,00,39,00,39,00,43,00,37,\
00,42,00,35,00,35,00,30,00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,\
65,00,5c,00,54,00,63,00,70,00,69,00,70,00,36,00,5f,00,7b,00,38,00,33,00,44,\
00,31,00,43,00,41,00,32,00,33,00,2d,00,44,00,43,00,45,00,39,00,2d,00,34,00,\
35,00,33,00,46,00,2d,00,41,00,45,00,31,00,44,00,2d,00,34,00,31,00,34,00,45,\
00,32,00,43,00,41,00,42,00,32,00,38,00,43,00,31,00,7d,00,00,00,5c,00,44,00,\
65,00,76,00,69,00,63,00,65,00,5c,00,54,00,63,00,70,00,69,00,70,00,36,00,5f,\
00,7b,00,41,00,32,00,35,00,36,00,43,00,30,00,43,00,43,00,2d,00,43,00,41,00,\
37,00,38,00,2d,00,34,00,39,00,33,00,42,00,2d,00,41,00,41,00,41,00,39,00,2d,\
00,35,00,38,00,33,00,35,00,37,00,45,00,41,00,33,00,34,00,37,00,41,00,30,00,\
7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,54,00,63,00,70,\
00,69,00,70,00,36,00,5f,00,7b,00,32,00,37,00,31,00,33,00,36,00,37,00,38,00,\
43,00,2d,00,39,00,44,00,36,00,37,00,2d,00,34,00,39,00,39,00,30,00,2d,00,39,\
00,30,00,36,00,45,00,2d,00,33,00,37,00,31,00,32,00,38,00,45,00,34,00,42,00,\
39,00,30,00,46,00,43,00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,\
00,5c,00,54,00,63,00,70,00,69,00,70,00,36,00,5f,00,7b,00,31,00,43,00,33,00,\
32,00,46,00,33,00,44,00,37,00,2d,00,30,00,39,00,32,00,39,00,2d,00,34,00,32,\
00,39,00,32,00,2d,00,42,00,45,00,45,00,44,00,2d,00,38,00,32,00,44,00,46,00,\
39,00,39,00,43,00,37,00,42,00,35,00,35,00,30,00,7d,00,00,00,5c,00,44,00,65,\
00,76,00,69,00,63,00,65,00,5c,00,4e,00,65,00,74,00,62,00,69,00,6f,00,73,00,\
53,00,6d,00,62,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,4e,\
00,65,00,74,00,42,00,54,00,5f,00,54,00,63,00,70,00,69,00,70,00,5f,00,7b,00,\
31,00,43,00,33,00,32,00,46,00,33,00,44,00,37,00,2d,00,30,00,39,00,32,00,39,\
00,2d,00,34,00,32,00,39,00,32,00,2d,00,42,00,45,00,45,00,44,00,2d,00,38,00,\
32,00,44,00,46,00,39,00,39,00,43,00,37,00,42,00,35,00,35,00,30,00,7d,00,00,\
00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,4e,00,65,00,74,00,42,00,\
54,00,5f,00,54,00,63,00,70,00,69,00,70,00,36,00,5f,00,7b,00,38,00,33,00,44,\
00,31,00,43,00,41,00,32,00,33,00,2d,00,44,00,43,00,45,00,39,00,2d,00,34,00,\
35,00,33,00,46,00,2d,00,41,00,45,00,31,00,44,00,2d,00,34,00,31,00,34,00,45,\
00,32,00,43,00,41,00,42,00,32,00,38,00,43,00,31,00,7d,00,00,00,5c,00,44,00,\
65,00,76,00,69,00,63,00,65,00,5c,00,4e,00,65,00,74,00,42,00,54,00,5f,00,54,\
00,63,00,70,00,69,00,70,00,36,00,5f,00,7b,00,41,00,32,00,35,00,36,00,43,00,\
30,00,43,00,43,00,2d,00,43,00,41,00,37,00,38,00,2d,00,34,00,39,00,33,00,42,\
00,2d,00,41,00,41,00,41,00,39,00,2d,00,35,00,38,00,33,00,35,00,37,00,45,00,\
41,00,33,00,34,00,37,00,41,00,30,00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,\
00,63,00,65,00,5c,00,4e,00,65,00,74,00,42,00,54,00,5f,00,54,00,63,00,70,00,\
69,00,70,00,36,00,5f,00,7b,00,32,00,37,00,31,00,33,00,36,00,37,00,38,00,43,\
00,2d,00,39,00,44,00,36,00,37,00,2d,00,34,00,39,00,39,00,30,00,2d,00,39,00,\
30,00,36,00,45,00,2d,00,33,00,37,00,31,00,32,00,38,00,45,00,34,00,42,00,39,\
00,30,00,46,00,43,00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,\
5c,00,4e,00,65,00,74,00,42,00,54,00,5f,00,54,00,63,00,70,00,69,00,70,00,36,\
00,5f,00,7b,00,31,00,43,00,33,00,32,00,46,00,33,00,44,00,37,00,2d,00,30,00,\
39,00,32,00,39,00,2d,00,34,00,32,00,39,00,32,00,2d,00,42,00,45,00,45,00,44,\
00,2d,00,38,00,32,00,44,00,46,00,39,00,39,00,43,00,37,00,42,00,35,00,35,00,\
30,00,7d,00,00,00,00,00
"Route"=hex(7):22,00,53,00,6d,00,62,00,22,00,20,00,22,00,54,00,63,00,70,00,69,\
00,70,00,22,00,20,00,22,00,7b,00,31,00,43,00,33,00,32,00,46,00,33,00,44,00,\
37,00,2d,00,30,00,39,00,32,00,39,00,2d,00,34,00,32,00,39,00,32,00,2d,00,42,\
00,45,00,45,00,44,00,2d,00,38,00,32,00,44,00,46,00,39,00,39,00,43,00,37,00,\
42,00,35,00,35,00,30,00,7d,00,22,00,00,00,22,00,53,00,6d,00,62,00,22,00,20,\
00,22,00,54,00,63,00,70,00,69,00,70,00,36,00,22,00,20,00,22,00,7b,00,38,00,\
33,00,44,00,31,00,43,00,41,00,32,00,33,00,2d,00,44,00,43,00,45,00,39,00,2d,\
00,34,00,35,00,33,00,46,00,2d,00,41,00,45,00,31,00,44,00,2d,00,34,00,31,00,\
34,00,45,00,32,00,43,00,41,00,42,00,32,00,38,00,43,00,31,00,7d,00,22,00,00,\
00,22,00,53,00,6d,00,62,00,22,00,20,00,22,00,54,00,63,00,70,00,69,00,70,00,\
36,00,22,00,20,00,22,00,7b,00,41,00,32,00,35,00,36,00,43,00,30,00,43,00,43,\
00,2d,00,43,00,41,00,37,00,38,00,2d,00,34,00,39,00,33,00,42,00,2d,00,41,00,\
41,00,41,00,39,00,2d,00,35,00,38,00,33,00,35,00,37,00,45,00,41,00,33,00,34,\
00,37,00,41,00,30,00,7d,00,22,00,00,00,22,00,53,00,6d,00,62,00,22,00,20,00,\
22,00,54,00,63,00,70,00,69,00,70,00,36,00,22,00,20,00,22,00,7b,00,32,00,37,\
00,31,00,33,00,36,00,37,00,38,00,43,00,2d,00,39,00,44,00,36,00,37,00,2d,00,\
34,00,39,00,39,00,30,00,2d,00,39,00,30,00,36,00,45,00,2d,00,33,00,37,00,31,\
00,32,00,38,00,45,00,34,00,42,00,39,00,30,00,46,00,43,00,7d,00,22,00,00,00,\
22,00,53,00,6d,00,62,00,22,00,20,00,22,00,54,00,63,00,70,00,69,00,70,00,36,\
00,22,00,20,00,22,00,7b,00,31,00,43,00,33,00,32,00,46,00,33,00,44,00,37,00,\
2d,00,30,00,39,00,32,00,39,00,2d,00,34,00,32,00,39,00,32,00,2d,00,42,00,45,\
00,45,00,44,00,2d,00,38,00,32,00,44,00,46,00,39,00,39,00,43,00,37,00,42,00,\
35,00,35,00,30,00,7d,00,22,00,00,00,22,00,54,00,63,00,70,00,69,00,70,00,22,\
00,20,00,22,00,7b,00,31,00,43,00,33,00,32,00,46,00,33,00,44,00,37,00,2d,00,\
30,00,39,00,32,00,39,00,2d,00,34,00,32,00,39,00,32,00,2d,00,42,00,45,00,45,\
00,44,00,2d,00,38,00,32,00,44,00,46,00,39,00,39,00,43,00,37,00,42,00,35,00,\
35,00,30,00,7d,00,22,00,00,00,22,00,54,00,63,00,70,00,69,00,70,00,36,00,22,\
00,20,00,22,00,7b,00,38,00,33,00,44,00,31,00,43,00,41,00,32,00,33,00,2d,00,\
44,00,43,00,45,00,39,00,2d,00,34,00,35,00,33,00,46,00,2d,00,41,00,45,00,31,\
00,44,00,2d,00,34,00,31,00,34,00,45,00,32,00,43,00,41,00,42,00,32,00,38,00,\
43,00,31,00,7d,00,22,00,00,00,22,00,54,00,63,00,70,00,69,00,70,00,36,00,22,\
00,20,00,22,00,7b,00,41,00,32,00,35,00,36,00,43,00,30,00,43,00,43,00,2d,00,\
43,00,41,00,37,00,38,00,2d,00,34,00,39,00,33,00,42,00,2d,00,41,00,41,00,41,\
00,39,00,2d,00,35,00,38,00,33,00,35,00,37,00,45,00,41,00,33,00,34,00,37,00,\
41,00,30,00,7d,00,22,00,00,00,22,00,54,00,63,00,70,00,69,00,70,00,36,00,22,\
00,20,00,22,00,7b,00,32,00,37,00,31,00,33,00,36,00,37,00,38,00,43,00,2d,00,\
39,00,44,00,36,00,37,00,2d,00,34,00,39,00,39,00,30,00,2d,00,39,00,30,00,36,\
00,45,00,2d,00,33,00,37,00,31,00,32,00,38,00,45,00,34,00,42,00,39,00,30,00,\
46,00,43,00,7d,00,22,00,00,00,22,00,54,00,63,00,70,00,69,00,70,00,36,00,22,\
00,20,00,22,00,7b,00,31,00,43,00,33,00,32,00,46,00,33,00,44,00,37,00,2d,00,\
30,00,39,00,32,00,39,00,2d,00,34,00,32,00,39,00,32,00,2d,00,42,00,45,00,45,\
00,44,00,2d,00,38,00,32,00,44,00,46,00,39,00,39,00,43,00,37,00,42,00,35,00,\
35,00,30,00,7d,00,22,00,00,00,22,00,4e,00,65,00,74,00,62,00,69,00,6f,00,73,\
00,53,00,6d,00,62,00,22,00,00,00,22,00,4e,00,65,00,74,00,42,00,54,00,22,00,\
20,00,22,00,54,00,63,00,70,00,69,00,70,00,22,00,20,00,22,00,7b,00,31,00,43,\
00,33,00,32,00,46,00,33,00,44,00,37,00,2d,00,30,00,39,00,32,00,39,00,2d,00,\
34,00,32,00,39,00,32,00,2d,00,42,00,45,00,45,00,44,00,2d,00,38,00,32,00,44,\
00,46,00,39,00,39,00,43,00,37,00,42,00,35,00,35,00,30,00,7d,00,22,00,00,00,\
22,00,4e,00,65,00,74,00,42,00,54,00,22,00,20,00,22,00,54,00,63,00,70,00,69,\
00,70,00,36,00,22,00,20,00,22,00,7b,00,38,00,33,00,44,00,31,00,43,00,41,00,\
32,00,33,00,2d,00,44,00,43,00,45,00,39,00,2d,00,34,00,35,00,33,00,46,00,2d,\
00,41,00,45,00,31,00,44,00,2d,00,34,00,31,00,34,00,45,00,32,00,43,00,41,00,\
42,00,32,00,38,00,43,00,31,00,7d,00,22,00,00,00,22,00,4e,00,65,00,74,00,42,\
00,54,00,22,00,20,00,22,00,54,00,63,00,70,00,69,00,70,00,36,00,22,00,20,00,\
22,00,7b,00,41,00,32,00,35,00,36,00,43,00,30,00,43,00,43,00,2d,00,43,00,41,\
00,37,00,38,00,2d,00,34,00,39,00,33,00,42,00,2d,00,41,00,41,00,41,00,39,00,\
2d,00,35,00,38,00,33,00,35,00,37,00,45,00,41,00,33,00,34,00,37,00,41,00,30,\
00,7d,00,22,00,00,00,22,00,4e,00,65,00,74,00,42,00,54,00,22,00,20,00,22,00,\
54,00,63,00,70,00,69,00,70,00,36,00,22,00,20,00,22,00,7b,00,32,00,37,00,31,\
00,33,00,36,00,37,00,38,00,43,00,2d,00,39,00,44,00,36,00,37,00,2d,00,34,00,\
39,00,39,00,30,00,2d,00,39,00,30,00,36,00,45,00,2d,00,33,00,37,00,31,00,32,\
00,38,00,45,00,34,00,42,00,39,00,30,00,46,00,43,00,7d,00,22,00,00,00,22,00,\
4e,00,65,00,74,00,42,00,54,00,22,00,20,00,22,00,54,00,63,00,70,00,69,00,70,\
00,36,00,22,00,20,00,22,00,7b,00,31,00,43,00,33,00,32,00,46,00,33,00,44,00,\
37,00,2d,00,30,00,39,00,32,00,39,00,2d,00,34,00,32,00,39,00,32,00,2d,00,42,\
00,45,00,45,00,44,00,2d,00,38,00,32,00,44,00,46,00,39,00,39,00,43,00,37,00,\
42,00,35,00,35,00,30,00,7d,00,22,00,00,00,00,00
"Export"=hex(7):5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,4c,00,61,00,6e,\
00,6d,00,61,00,6e,00,53,00,65,00,72,00,76,00,65,00,72,00,5f,00,53,00,6d,00,\
62,00,5f,00,54,00,63,00,70,00,69,00,70,00,5f,00,7b,00,31,00,43,00,33,00,32,\
00,46,00,33,00,44,00,37,00,2d,00,30,00,39,00,32,00,39,00,2d,00,34,00,32,00,\
39,00,32,00,2d,00,42,00,45,00,45,00,44,00,2d,00,38,00,32,00,44,00,46,00,39,\
00,39,00,43,00,37,00,42,00,35,00,35,00,30,00,7d,00,00,00,5c,00,44,00,65,00,\
76,00,69,00,63,00,65,00,5c,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,65,\
00,72,00,76,00,65,00,72,00,5f,00,53,00,6d,00,62,00,5f,00,54,00,63,00,70,00,\
69,00,70,00,36,00,5f,00,7b,00,38,00,33,00,44,00,31,00,43,00,41,00,32,00,33,\
00,2d,00,44,00,43,00,45,00,39,00,2d,00,34,00,35,00,33,00,46,00,2d,00,41,00,\
45,00,31,00,44,00,2d,00,34,00,31,00,34,00,45,00,32,00,43,00,41,00,42,00,32,\
00,38,00,43,00,31,00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,\
5c,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,65,00,72,00,76,00,65,00,72,\
00,5f,00,53,00,6d,00,62,00,5f,00,54,00,63,00,70,00,69,00,70,00,36,00,5f,00,\
7b,00,41,00,32,00,35,00,36,00,43,00,30,00,43,00,43,00,2d,00,43,00,41,00,37,\
00,38,00,2d,00,34,00,39,00,33,00,42,00,2d,00,41,00,41,00,41,00,39,00,2d,00,\
35,00,38,00,33,00,35,00,37,00,45,00,41,00,33,00,34,00,37,00,41,00,30,00,7d,\
00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,4c,00,61,00,6e,00,\
6d,00,61,00,6e,00,53,00,65,00,72,00,76,00,65,00,72,00,5f,00,53,00,6d,00,62,\
00,5f,00,54,00,63,00,70,00,69,00,70,00,36,00,5f,00,7b,00,32,00,37,00,31,00,\
33,00,36,00,37,00,38,00,43,00,2d,00,39,00,44,00,36,00,37,00,2d,00,34,00,39,\
00,39,00,30,00,2d,00,39,00,30,00,36,00,45,00,2d,00,33,00,37,00,31,00,32,00,\
38,00,45,00,34,00,42,00,39,00,30,00,46,00,43,00,7d,00,00,00,5c,00,44,00,65,\
00,76,00,69,00,63,00,65,00,5c,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,\
65,00,72,00,76,00,65,00,72,00,5f,00,53,00,6d,00,62,00,5f,00,54,00,63,00,70,\
00,69,00,70,00,36,00,5f,00,7b,00,31,00,43,00,33,00,32,00,46,00,33,00,44,00,\
37,00,2d,00,30,00,39,00,32,00,39,00,2d,00,34,00,32,00,39,00,32,00,2d,00,42,\
00,45,00,45,00,44,00,2d,00,38,00,32,00,44,00,46,00,39,00,39,00,43,00,37,00,\
42,00,35,00,35,00,30,00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,\
00,5c,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,65,00,72,00,76,00,65,00,\
72,00,5f,00,54,00,63,00,70,00,69,00,70,00,5f,00,7b,00,31,00,43,00,33,00,32,\
00,46,00,33,00,44,00,37,00,2d,00,30,00,39,00,32,00,39,00,2d,00,34,00,32,00,\
39,00,32,00,2d,00,42,00,45,00,45,00,44,00,2d,00,38,00,32,00,44,00,46,00,39,\
00,39,00,43,00,37,00,42,00,35,00,35,00,30,00,7d,00,00,00,5c,00,44,00,65,00,\
76,00,69,00,63,00,65,00,5c,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,65,\
00,72,00,76,00,65,00,72,00,5f,00,54,00,63,00,70,00,69,00,70,00,36,00,5f,00,\
7b,00,38,00,33,00,44,00,31,00,43,00,41,00,32,00,33,00,2d,00,44,00,43,00,45,\
00,39,00,2d,00,34,00,35,00,33,00,46,00,2d,00,41,00,45,00,31,00,44,00,2d,00,\
34,00,31,00,34,00,45,00,32,00,43,00,41,00,42,00,32,00,38,00,43,00,31,00,7d,\
00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,4c,00,61,00,6e,00,\
6d,00,61,00,6e,00,53,00,65,00,72,00,76,00,65,00,72,00,5f,00,54,00,63,00,70,\
00,69,00,70,00,36,00,5f,00,7b,00,41,00,32,00,35,00,36,00,43,00,30,00,43,00,\
43,00,2d,00,43,00,41,00,37,00,38,00,2d,00,34,00,39,00,33,00,42,00,2d,00,41,\
00,41,00,41,00,39,00,2d,00,35,00,38,00,33,00,35,00,37,00,45,00,41,00,33,00,\
34,00,37,00,41,00,30,00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,\
00,5c,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,65,00,72,00,76,00,65,00,\
72,00,5f,00,54,00,63,00,70,00,69,00,70,00,36,00,5f,00,7b,00,32,00,37,00,31,\
00,33,00,36,00,37,00,38,00,43,00,2d,00,39,00,44,00,36,00,37,00,2d,00,34,00,\
39,00,39,00,30,00,2d,00,39,00,30,00,36,00,45,00,2d,00,33,00,37,00,31,00,32,\
00,38,00,45,00,34,00,42,00,39,00,30,00,46,00,43,00,7d,00,00,00,5c,00,44,00,\
65,00,76,00,69,00,63,00,65,00,5c,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,\
00,65,00,72,00,76,00,65,00,72,00,5f,00,54,00,63,00,70,00,69,00,70,00,36,00,\
5f,00,7b,00,31,00,43,00,33,00,32,00,46,00,33,00,44,00,37,00,2d,00,30,00,39,\
00,32,00,39,00,2d,00,34,00,32,00,39,00,32,00,2d,00,42,00,45,00,45,00,44,00,\
2d,00,38,00,32,00,44,00,46,00,39,00,39,00,43,00,37,00,42,00,35,00,35,00,30,\
00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,4c,00,61,00,\
6e,00,6d,00,61,00,6e,00,53,00,65,00,72,00,76,00,65,00,72,00,5f,00,4e,00,65,\
00,74,00,62,00,69,00,6f,00,73,00,53,00,6d,00,62,00,00,00,5c,00,44,00,65,00,\
76,00,69,00,63,00,65,00,5c,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,65,\
00,72,00,76,00,65,00,72,00,5f,00,4e,00,65,00,74,00,42,00,54,00,5f,00,54,00,\
63,00,70,00,69,00,70,00,5f,00,7b,00,31,00,43,00,33,00,32,00,46,00,33,00,44,\
00,37,00,2d,00,30,00,39,00,32,00,39,00,2d,00,34,00,32,00,39,00,32,00,2d,00,\
42,00,45,00,45,00,44,00,2d,00,38,00,32,00,44,00,46,00,39,00,39,00,43,00,37,\
00,42,00,35,00,35,00,30,00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,\
65,00,5c,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,65,00,72,00,76,00,65,\
00,72,00,5f,00,4e,00,65,00,74,00,42,00,54,00,5f,00,54,00,63,00,70,00,69,00,\
70,00,36,00,5f,00,7b,00,38,00,33,00,44,00,31,00,43,00,41,00,32,00,33,00,2d,\
00,44,00,43,00,45,00,39,00,2d,00,34,00,35,00,33,00,46,00,2d,00,41,00,45,00,\
31,00,44,00,2d,00,34,00,31,00,34,00,45,00,32,00,43,00,41,00,42,00,32,00,38,\
00,43,00,31,00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,\
4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,65,00,72,00,76,00,65,00,72,00,5f,\
00,4e,00,65,00,74,00,42,00,54,00,5f,00,54,00,63,00,70,00,69,00,70,00,36,00,\
5f,00,7b,00,41,00,32,00,35,00,36,00,43,00,30,00,43,00,43,00,2d,00,43,00,41,\
00,37,00,38,00,2d,00,34,00,39,00,33,00,42,00,2d,00,41,00,41,00,41,00,39,00,\
2d,00,35,00,38,00,33,00,35,00,37,00,45,00,41,00,33,00,34,00,37,00,41,00,30,\
00,7d,00,00,00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,4c,00,61,00,\
6e,00,6d,00,61,00,6e,00,53,00,65,00,72,00,76,00,65,00,72,00,5f,00,4e,00,65,\
00,74,00,42,00,54,00,5f,00,54,00,63,00,70,00,69,00,70,00,36,00,5f,00,7b,00,\
32,00,37,00,31,00,33,00,36,00,37,00,38,00,43,00,2d,00,39,00,44,00,36,00,37,\
00,2d,00,34,00,39,00,39,00,30,00,2d,00,39,00,30,00,36,00,45,00,2d,00,33,00,\
37,00,31,00,32,00,38,00,45,00,34,00,42,00,39,00,30,00,46,00,43,00,7d,00,00,\
00,5c,00,44,00,65,00,76,00,69,00,63,00,65,00,5c,00,4c,00,61,00,6e,00,6d,00,\
61,00,6e,00,53,00,65,00,72,00,76,00,65,00,72,00,5f,00,4e,00,65,00,74,00,42,\
00,54,00,5f,00,54,00,63,00,70,00,69,00,70,00,36,00,5f,00,7b,00,31,00,43,00,\
33,00,32,00,46,00,33,00,44,00,37,00,2d,00,30,00,39,00,32,00,39,00,2d,00,34,\
00,32,00,39,00,32,00,2d,00,42,00,45,00,45,00,44,00,2d,00,38,00,32,00,44,00,\
46,00,39,00,39,00,43,00,37,00,42,00,35,00,35,00,30,00,7d,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
73,00,72,00,76,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001
"EnableAuthenticateUserSharing"=dword:00000000
"NullSessionPipes"=hex(7):00,00
"autodisconnect"=dword:0000000f
"enableforcedlogoff"=dword:00000001
"enablesecuritysignature"=dword:00000000
"requiresecuritysignature"=dword:00000000
"restrictnullsessaccess"=dword:00000001
"Lmannounce"=dword:00000000
"Size"=dword:00000001
"AdjustedNullSessionPipes"=dword:00000003
"Guid"=hex:a1,01,93,a5,94,de,98,42,ad,1b,44,38,b7,d5,47,56

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\ShareProviders]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Shares]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Shares\Security]