How to delete a Windows Service

Author: Network Security Log (www.nslog.cn)
Date: 2006/10/10 (reprinted please keep this statement)

1. What is Windows service?

Windows Service, also known as Windows Service, is the foundation of Windows operating system and Windows network. It is part of the core of the system and supports various windows operations. Such as DNS Client and PrintingProgramWindows Update Service, scheduled task, Windows Time Service, warning device, and other services are related to whether the machine runs correctly. If these services cannot be properly managed, the normal operation of the machine will be affected.
First, a service is a win32executable program, and then rundll32.exe runs a. dll process.
Unlike common applications, if you open Word, there is an interface, but the service has no user interface. It is also unable to run the corresponding. exe program through double-attacks. How does one control a service in windows?
Windows Services are managed by a more advanced services.exe Service, which is responsible for starting, stopping, running, and pausing services. The most common operation is to complete related operations through the Windows Service MMC interface.

Ii. How to delete Windows Services

Nowadays, rogue software is increasingly registering itself as a service. In the hijackthis scan log, services in non-Windows systems are generally listed as 023, as shown in the following section:
O23-unknown-service: bkmarks [provides a data security protection mechanism for the transmission protocol to effectively maintain the security andComplete.] -C: \ windows \ system32 \ rundll. exe
O23-unknown-service: ewido Anti-Spyware 4.0 Guard [ewido Anti-Spyware 4.0 Guard]-D: \ Program Files \ ewido Anti-Spyware 4.0 \ guard.exe
O23-unknown-service: ksd2service [ksd2service]-c: \ windows \ system32 \ svch0st. Exe

In these cases, the software deletes the relevant .exe file so that it cannot run any more, or directly clears the service itself so that it will not start again when the computer restarts.

There are two ways to delete:

Method 1: Use the Windows Command SC .exe.
Start -- .exe and enter SC. The method is simple:
SC Delete "service name" (if there is a space in the middle of the service name, quotation marks are required)
For example, for the above: SC Delete ksd2service

Method 2: directly edit the Registry (not recommended)
Open the Registry Editor and find the following key values:
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services the General Service will display a master key with the same name here, You can directly Delete the relevant key value.

Iii. Special Cases

Hosts file, which is a Windows system file. In this case, you only need to clear the relevant services.

2. If a service is automatically created after it is deleted, it indicates that there are processes in the background to monitor and protect it. You must first kill the corresponding process in the Process Manager, or press F8 after it is started to delete it in safe mode.

IV. Other References

You can also refer to the following three articles on this site to delete rogue software and files:
[Shocking big discoveries] Stubborn file deletion and weapons
Hijackthis browser hijacking log explanation
Icesword