Registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\driverName

ImagePath stores the fully qualified path to the drivers image file.

Usually, the value is something like %SystemRoot%\System32\drivers\driverName.sys.

At times, however, a reference to svchost.exe is also seen, for example:

%SystemRoot%\System32\svchost.exe -k netsvcs -p

This value is created by the mandatory ServiceBinary entry of the drivers's .inf file.

Start specifies how or when a service is started:

• 0: Loaded (but not started) by the boot loader. Then started during kernel initialization.
• 1: Started during kernel initialization after services whose start parameter is 0.
• 2: Automatically. Started by smss.exe (session manager) or services.exe (services controller).
• 3: Manually. Started by the Service Control Manager (SCM).
• 4: Disabled
• 5: Delayed start.

The start value of 1 indicates that that this is a kernel device or other low-level hardware device driver.

For adapters, the start value is ignored.

A convenient way to dislable and remember the original startup type (for later enabling again) for services is provided by msconfig.exe under the by Services tab.

The type value specifies the type of the service:

• 0x01: Kernel device driver
• 0x02: File system driver (which is also a kernel device driver)
• 0x04: Set of arguments for an adapter
• 0x10: A Win32 program that can be started by the service controller and that obeys the service control protocol.
• 0x20: A Win32 service that can share a process with other Win32 services.
• 0x60: USER_SHARE_PROCESS TEMPLATE
• 0xE0: USER_SHARE_PROCESS INSTANCE

Other seen values are:

• BootFlags
• ConfigurationFlags
• DelayedAutostart
• DependOnGroup
• DependOnService
• Description
• DisplayName
• DriverPackageId
• ErrorControl
• FailureActions
• FailureActionsOnNonCrashFailures
• FailureCommand
• Group
• HasBootConfig
• NdisMajorVersion
• NdisMinorVersion
• ObjectName (which seems to refer to an account such as NT AUTHORITY\NetworkService?)
• Options
• PreshutdownTimeout
• RebootMessage
• RequiredPrivileges

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services