What is a Windows service How to remove a windows service

First, what is a Windows service

Windows service is also called Windows Service, which is the basis of the Windows operating system and Windows network, is part of the core of the system, it supports the entire operation of Windows. Services such as DNS clients, print programs, Windows update services, scheduled tasks, Windows time services, alarms, etc., are related to whether the machine can operate correctly. If these services are not properly managed, they will affect the normal operation of the machine.

A service is first a Win32 executable, or a process that is rundll32.exe to run a .dll.

Not the same as a normal application. If you open Word, there is an interface, but the service does not have a user interface. It is also not possible to run by directly double-clicking the corresponding .exe program. How does Windows control a service?

Windows service is managed by a higher level service.exe service, which is responsible for the start, stop, run, pause, etc. of the service. . Our most common operation is to complete the related operations through the Windows service MMC interface.

Second, how to delete Windows services

The current rogue software, more and more to register themselves as a service. In the scan log of Hijackthis, the services of non-Windows systems are generally listed as 023, as in the following paragraph:

O23 - Unknown - Service: BKMARKS [Provides the data security protection mechanism of the transport protocol, Effectively maintain security and integrity in data transmission. ] - C:\\Windows\\SYSTEM32\\RUNDLL.EXE

O23 - Unknown - Service: ewido anti-spyware 4.0 guard [ewido anti-spyware 4.0 guard] - D:\\Program Files\\ewido anti-spyware 4.0 \\guard.exe

O23 - Unknown - Service: KSD2Service [KSD2Service] - C:\\Windows\\system32\\SVCH0ST.exe

For these rogue software, you need to delete the relevant .exe file. Make it no longer run, or directly clear the service itself, so that when the computer restarts, it will not start again.

There are two ways to delete:

Method 1: Use the sc.exe Windows command

to start - run - cmd.exe, then type sc I saw it. The method of use is very simple:

sc delete "service name" (if there is a space in the middle of the service name, you need to be quoted before and after)

For the above: sc delete KSD2Service

Method 2: Direct registry editing (not recommended)

Open the registry editor and find the following key values:

HKEY_LOCAL_MacHINE\\SYSTEM\\CurrentControlSet\\Services General services will be the same The name here shows a main key, directly delete the relevant key values.

Three, special case

1, if the service shows rundll32.exe, and this file is located in the system32 directory, then you can not delete the rundll32.exe file, it is the Windows system document. At this time, as long as the related services are cleared,

2, if a service is deleted, it is automatically established again, indicating that the process is monitoring and protecting. You need to kill the corresponding process in the process manager first, or press F8 after startup to delete it in safe mode.