Ways to remove Windows services

The first thing to know is what is a Windows service?

Windows services, also known as Windows Service, are the foundation of the Windows operating system and Windows network, part of the core of the system, and support a variety of operations across Windows. Services such as DNS clients, print programs, Windows Update Services, scheduled tasks, Windows Time services, alarms, and so on, are related to whether the machine works correctly. If these services are not properly managed, they will affect the normal operation of the machine.

A service is first a Win32 executable, or it is a rundll32.exe to run one. DLL by the way the process is formed.

Unlike ordinary applications, where word is turned on, there is an interface, but the service does not have a user interface. Nor can you run the corresponding by double-clicking directly. EXE program to run. So how does Windows control a service?

Windows services are managed by a higher level of services.exe, which is managed by the service to start, stop, run, pause, and so on. Our most common operation is through the Windows Service MMC interface to complete the relevant operations.

Ways to remove Windows services

Now the rogue software, more and more to register themselves as a service. In the HijackThis scan log, non-Windows system services are typically listed as 023, as follows:

O23-unknown-Service:bkmarks [provides the data security mechanism of the transport Protocol to effectively maintain the safety and integrity of the data transmission.] ]-C:windowssystem32rundll.exe

O23-unknown-Service:ewido Anti-spyware 4.0 guard [Ewido Anti-spyware 4.0 guard]-D:program filesewido anti-spyware 4.0gua Rd.exe

O23-unknown-Service:ksd2service [Ksd2service]-C:windowssystem32svch0st.exe

For these rogue software, you need to delete the relevant. EXE file, so that it can no longer run, or directly clear the service itself, so that when the computer restarts, it will not start again.

There are two options for deletion:

Method One: Use sc.exe this Windows command

Start-run--cmd.exe, then enter SC to see it. The use of the method is simple:

SC Delete "service name" (if there is a space between the service name, you need to enclose the quotation marks)

As for the above: SC Delete Ksd2service (this method I have tried to)

Method Two: Directly to the registry edit (not recommended)

Open Registry Editor and locate the following key values:

The Hkey_local_machinesystemcurrentcontrolsetservices General Service will display a master key here with the same name, and delete the relevant keys directly.

There are special cases where the service is not erased

1, if the service is displaying rundll32.exe, and this file is located in the System32 directory, then you cannot delete the Rundll32.exe file, which is a Windows system file. At this point, just clear the relevant services can be.

2, if a service deleted immediately and automatically established, the background has the process of monitoring, protection. You need to kill the process in the Process Manager first, or press F8 after startup to remove it in safe mode.