We had a few over here in Business that had the Hacker Defender Trojan installed, that did that very thing. If it stopped at winmgmt.exe then this might be Hacker Defender. You can use SC.EXE from the Windows 2000 resource kit to delete the services and get the machine working. Or you can get sc.exe from a windows XP machine sc delete hackerdefender073 sc delete servu Reboot and delete the hxd.exe and servu files. What they did was rename servu to be winmgmt.exe, and the official winmgmt.exe is hidden from view and protected. So while the service pack tries to update this file, it can't because hackerdefender has protected it. Anyhow it still would be best to format and reload it. Tim -----Original Message----- From: Todd Wilson [mailto:[log in to unmask]] Sent: Monday, September 22, 2003 2:43 PM To: [log in to unmask] Subject: Service Pack Problems We have experienced a few cases of service pack application problems, where the update runs to about 75% completion and then unloads with an extremely uninformative "Access Denied" message box. In one case, I re-applied SP2 and the application of SP4 was successful. In three other cases, SP3 and SP4 fail with the same symptom at all attempts. I have attempted to apply these SPs in a variety of situations, as local and domain admin, with some to nearly all non-essential tasks loaded... all to no avail. If anyone else has experienced this scenario and was able to achieve success, I would be delighted to know what you found... Regards Todd Wilson Planner/Inspector/Analyst HVAC Central Control Physical Plant Division Michigan State University (517)353-1760 ext#370