Windows Services Exposed adn Expunge

kayFX · 7th Jun 2005, 02:45 PM

winXP enables many resource-sucking background apps by default.. so we have to identify which is essential services, useful services, and nonessential services to boost up your system perfomance and regain the resource.. i will list them down in group..

BACK UP YOUR CONFIG!
to back up the service settings held in the registry; run REGEDIT, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es, and use File > Export to save that data.. double clicking the file it produces will restore your settings.. this is good bit of insurance, but don be complacent, turn off a critical service like Remote Procedure Call and your PC may not even boot, making it impossible to use the backup file..

Gaining Control
to find out what happening to your computer launch the services control (Control Panel> Administrative Tools> Services) or just select start> run and enter services.msc .. the console will list all the services registered on your PC.. most services accompanied by a lot of detail about it so make sure you click the "Extended" tab to view it all.. pay attention to particular services that have "Started" in the Status column.. htese are currently running and comsumes at least some of your PC's resources.. look at the "Startup Type", "Automatic" starts on its own or when windows boots, "Manual" as you know must be stated manually and "Disable" that will not start under any circumstances.. the final column, "Log on as" illustrates a new security feature in windows XP.. "Local System" have full user privileges which means they can do whatever they like.. "Network Service" have only the minimum privileges they need to carry out their task.. so if a hacker manage to compromise one of these, the hacker will be limited in what he/she can do.. but dont start changing the way they log on.. many need the "Local Service" or "Network Service" and changing their status could result in strange behavior..

Essential Services
perhaps the best place to start is by detailing the services you really need, regardless of how your system is configured..

Antivirus Software
you'll probably find that your antivirus is running as a sevice.. if you want to turn it off, best use via the "official" route by right clicking an icon in the system tray..

Cryptographic Services
even if you dont need this service, its other functions are useful..

Event Log
excellent feature to records problems by other programs and services..

Plug and Play
to recognize new devices as they are installed, or if you plug something to your USB or FireWire port..

Remote Procedure Call
windows need RPC to run and disabling this is likely to cause serious problem..

Task Scheduler
leave it set to "Automatic"..

Windows Audio
this service should only be disable if you dont have a soundcard or integrated sound on your mobo..

Windows Management Instrumentation
windows itself uses WMI, as do many other application, so it's best leave it set to "Automatic"

Workstation
allows access to remote files and other resources accross a network, as well as provides support for some internet services like "Background Intelligent Transfer".. to be safe, whether you're you're networked or not, you really should leave this running..

Useful Services
exemple, services may be vital for a networked system and useless for anything else, but windows still launch them on a stand-alone PC.. these are some of the services you may be able to do without, denpending on your circumstances..

Application Layer Gateaway
essential whether youre using Windows Internet Connection Sharing or the Internet Connection Firewall.. useless if youre not..

Automatic Updates
if youre prefer not to have windows XP check for updates on its own, it can be safely be disable..

Background Intelligent Transfer
if youre disable "Automatic Updates", this can be turn off too..

COM+
both the Event System and System Application Services help to administer Microsoft's Component Object Model system (see www.microsoft.com/com/tech/COMPlus.asp if youre interested). you may be running application that needs it (even you have a stand-alone system), so leave it set to "Manual"..

DHCP Client
obtains an IP address from a DHCP server, either on a local network or (possibly) for your internet connection.. if you dont use DHCP, can try disabling it but restore it itf you start having problem..

Help and Support
why is Windows Help a service? i have no idea.. disable it if you like but selecting start>help or support will restart it again..

HID Input Service
provide "hot buttons" support.. if you dont use it try disable it..

Logical Disk Manager
if you want to manage your hard drives (right-click My Computer, select Manage, and then Disk Management), this need to be running.. leaving it "Manual" would be nice..

MS Software Shadow Copy Provider/ Volume Shadow Copy
unless you use Microsoft Backup, or another imaging program that requires these services, they can both be turned off.. you can switch back on if your backuo program doesnt work correctly afterward..

System Restore
ideally, leave this service running.. if you do decide to turn it off (control panel> system> system restore), note that all your previous Restore Points will be lost..

Telephony
you defenitely need this service if you use a conventional dial up modem.. if you have cable or ADSL connection, set to "Manual" (it may still be required)..

Webclient
this allow you to browse to "Netwok Places" that are actually on the internet, and lets windows programs "create access, and modify internet-based files".. as it reportedly can also slow down browsing on your local network, so try disabling it, then monitoring what happens next..

Windows Image Aquisition
if you dont have a scanner or webcam, turn it off.. and if you do it may not require the WIA service, so turn it of anyway..

Windows Installer
handles any programs that install using .MSI files.. youre like to need it occassionally, though not often, so it seems a good candidate for the "Manual" setting where the service will consume RAM only when its required)..

Wireless Zero Configuration Properties
handy if youve got any 802.11x wireless adapters installed (it helps set them up), but entirely useless if youre havent..

Nonessential Services
i' been really cautious so far, some services really are important to keep you system running smoothly.. but there are chance of your needing one of these services is very slim in this category indeed..

Application Management
this provides "Assign, Publish, and Remove software services".. however, as this service doesnt even exist on window XP home edition try turning it off and restoring it to "Manual" if you have problem..

Clipbook
this feature lets you view the contents of the clipboard, store them permanently, and share them with other users on your local network.. disable it if you dont feel you'll use it..

Computer Browser
keeps track other systems currently connected to your network.. even if youre in a networked system, you only need 2 PCs running this service, and perhaps none at all if all the systems have windows 2000 or XP based systems..

Distributed Link Tracking Client
if youre on a stand-alone PC, or if your networked systems dont use NTFS, or you just dont need this feature, then turn it off..

Error Reporting
ever wonder what's responsible for those dialog boxes that pop up whenever an application crashes, asking if you want to send a report back to microsoft? this service is the culprit.. whether you want to be a part of the windows XP and application bug hunt is up to you..

Indexing
a good idea in theory, this services creates a document index to speed up searches in windows and offices XP (among other apps).. however in reality it consumes more resources than it's worth..

IPSEC
if youre telecommuter and need to connect to a remote network via a VPN, then Internet Protocol Security (IPSEC) may be useful.. otherwise it almost certainly not..

Messenger
this is a service that sends messages between clients and servers across your network.. its obviously a superfluous feature for a stand-alone systems, home network probably wont need it either.. no, its not Windows or MSN Messenger..

Remote Registry Service
do you want remote users to be able to modify registry setting on your PC

.. its not as in secure as it sound but disable it would be wise..

SSDP Discovery
a component of "Universal Plug and Play".. whether you disable it or leave it running, you need to do the same with SSD Discovery..

TCP/IP NetBIOS Helper
generally required only if your local network uses NetBIOS over TCP/IP..

Telnet
allows remote user to log on to your PC and run programs.. disable it of you dont want them to do so..

Uninteruptible Power Supply
its safe to disable this, unless of course you UPS..

Universal Plug and Play
discovers devices attached to remote PCs on your network, but unless you need this service, its still wise to turn it off..

Windows Time
syncronizing your clock via an internet server.. but doing so via a windows service that's running all the time is not the most efficient route..

WMI Perfomance Adapter
unless youre developer, this is of little utility, and can be disable..

Proceed With Care
compare the list wist the services running on your system, and you'll quickly pick out the ones that seem to bee unnecessary.. to avoid potential problems, its best to proceed with caution.. open the service console.. change the service one at a time to avoid cunfusion.. dont let the potential risks put you off.. managing services isnt difficult, and is a great way to give your system a perfomance boost..

it take take me a whole night to study this and so far im not having problem and boot time have been improved significantly..
can someone pin this thread so everyone can utilize the info?

Adrian Wong · 7th Jun 2005, 06:58 PM

Nice! Looks like a start of a nice guide to add to ARP!

Giraffe }{unter · 7th Jun 2005, 10:45 PM

"Antivirus Software
you'll probably find that your antivirus is running as a sevice.. if you want to turn it off, best use via the "official" route by right clicking an icon in the system tray.."

Are you insane?

that's got to be the dumbest suggestion on the planet. Worms rely on the "dumb know it all wanna be" who tweaks his computer and turns off auto protect.

ESP · 7th Jun 2005, 11:00 PM

Quite a nice guide from you, kay. But some of my services are set to Manual. So disable it or just leave it?

How long does it take for you to boot up now after disabling some of the useless stuff you have mentioned?

I don't think I would risk trying it out since my system is working fine with 1GB of memory. Hehe.

kayFX · 8th Jun 2005, 10:34 AM

Quote:

Originally Posted by Giraffe }{unter

"Antivirus Software
you'll probably find that your antivirus is running as a sevice.. if you want to turn it off, best use via the "official" route by right clicking an icon in the system tray.."

Are you insane?

that's got to be the dumbest suggestion on the planet. Worms rely on the "dumb know it all wanna be" who tweaks his computer and turns off auto protect.

that is under essential services.. but if you wuold like to turn it off by some reason that is the suggestion to turn it off rather do it via the services console.. some installation may require you to turn off auto protect you know..

kayFX · 8th Jun 2005, 10:38 AM

Quote:

Originally Posted by ESP

Quite a nice guide from you, kay. But some of my services are set to Manual. So disable it or just leave it?

How long does it take for you to boot up now after disabling some of the useless stuff you have mentioned?

I don't think I would risk trying it out since my system is working fine with 1GB of memory. Hehe.

you'll be surprise the time of your system boot up since im also have 1Gb of memory.. under nonessential services you can disable them all.. as i said under that category, the chance youll need these services are very slim indeed..

doraemon · 9th Jun 2005, 11:24 AM

Quote:

Originally Posted by kayFX

that is under essential services.. but if you wuold like to turn it off by some reason that is the suggestion to turn it off rather do it via the services console.. some installation may require you to turn off auto protect you know..

if want to turn off the auto protoect, beter uninstall the AV s/w to free some diskspace

Giraffe }{unter · 9th Jun 2005, 12:10 PM

Sorry I just get cranky when people turn it off. I am the AV admin at my company I have it locked down so tight the all option boxes are greayed out, it requires a password to uninstall it and if by some chance the user disables the process or gets a virus it emails me to let me know.

Symantec has got the greatest Corporate suite I have ever used. It takes the work out of managing a large company.

kayFX · 9th Jun 2005, 11:18 PM

Quote:

Originally Posted by Adrian Wong

Nice! Looks like a start of a nice guide to add to ARP!

so boss, where should i put this guide?

Adrian Wong · 10th Jun 2005, 09:32 PM

Quote:

Originally Posted by kayFX

so boss, where should i put this guide?

If you want, you can beef it up further and send it to me or Dashken. Then we will get it posted as a guide.

7th Jun 2005, 02:45 PM	#1 (permalink)
kayFX Active Join Date: 4 Sep 2004 Location: in my room Posts: 600 Reputation: 253 Rep Power: 6	Windows Services Exposed adn Expunge winXP enables many resource-sucking background apps by default.. so we have to identify which is essential services, useful services, and nonessential services to boost up your system perfomance and regain the resource.. i will list them down in group.. BACK UP YOUR CONFIG! to back up the service settings held in the registry; run REGEDIT, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es, and use File > Export to save that data.. double clicking the file it produces will restore your settings.. this is good bit of insurance, but don be complacent, turn off a critical service like Remote Procedure Call and your PC may not even boot, making it impossible to use the backup file.. Gaining Control to find out what happening to your computer launch the services control (Control Panel> Administrative Tools> Services) or just select start> run and enter services.msc .. the console will list all the services registered on your PC.. most services accompanied by a lot of detail about it so make sure you click the "Extended" tab to view it all.. pay attention to particular services that have "Started" in the Status column.. htese are currently running and comsumes at least some of your PC's resources.. look at the "Startup Type", "Automatic" starts on its own or when windows boots, "Manual" as you know must be stated manually and "Disable" that will not start under any circumstances.. the final column, "Log on as" illustrates a new security feature in windows XP.. "Local System" have full user privileges which means they can do whatever they like.. "Network Service" have only the minimum privileges they need to carry out their task.. so if a hacker manage to compromise one of these, the hacker will be limited in what he/she can do.. but dont start changing the way they log on.. many need the "Local Service" or "Network Service" and changing their status could result in strange behavior.. Essential Services perhaps the best place to start is by detailing the services you really need, regardless of how your system is configured.. Antivirus Software you'll probably find that your antivirus is running as a sevice.. if you want to turn it off, best use via the "official" route by right clicking an icon in the system tray.. Cryptographic Services even if you dont need this service, its other functions are useful.. Event Log excellent feature to records problems by other programs and services.. Plug and Play to recognize new devices as they are installed, or if you plug something to your USB or FireWire port.. Remote Procedure Call windows need RPC to run and disabling this is likely to cause serious problem.. Task Scheduler leave it set to "Automatic".. Windows Audio this service should only be disable if you dont have a soundcard or integrated sound on your mobo.. Windows Management Instrumentation windows itself uses WMI, as do many other application, so it's best leave it set to "Automatic" Workstation allows access to remote files and other resources accross a network, as well as provides support for some internet services like "Background Intelligent Transfer".. to be safe, whether you're you're networked or not, you really should leave this running.. Useful Services exemple, services may be vital for a networked system and useless for anything else, but windows still launch them on a stand-alone PC.. these are some of the services you may be able to do without, denpending on your circumstances.. Application Layer Gateaway essential whether youre using Windows Internet Connection Sharing or the Internet Connection Firewall.. useless if youre not.. Automatic Updates if youre prefer not to have windows XP check for updates on its own, it can be safely be disable.. Background Intelligent Transfer if youre disable "Automatic Updates", this can be turn off too.. COM+ both the Event System and System Application Services help to administer Microsoft's Component Object Model system (see www.microsoft.com/com/tech/COMPlus.asp if youre interested). you may be running application that needs it (even you have a stand-alone system), so leave it set to "Manual".. DHCP Client obtains an IP address from a DHCP server, either on a local network or (possibly) for your internet connection.. if you dont use DHCP, can try disabling it but restore it itf you start having problem.. Help and Support why is Windows Help a service? i have no idea.. disable it if you like but selecting start>help or support will restart it again.. HID Input Service provide "hot buttons" support.. if you dont use it try disable it.. Logical Disk Manager if you want to manage your hard drives (right-click My Computer, select Manage, and then Disk Management), this need to be running.. leaving it "Manual" would be nice.. MS Software Shadow Copy Provider/ Volume Shadow Copy unless you use Microsoft Backup, or another imaging program that requires these services, they can both be turned off.. you can switch back on if your backuo program doesnt work correctly afterward.. System Restore ideally, leave this service running.. if you do decide to turn it off (control panel> system> system restore), note that all your previous Restore Points will be lost.. Telephony you defenitely need this service if you use a conventional dial up modem.. if you have cable or ADSL connection, set to "Manual" (it may still be required).. Webclient this allow you to browse to "Netwok Places" that are actually on the internet, and lets windows programs "create access, and modify internet-based files".. as it reportedly can also slow down browsing on your local network, so try disabling it, then monitoring what happens next.. Windows Image Aquisition if you dont have a scanner or webcam, turn it off.. and if you do it may not require the WIA service, so turn it of anyway.. Windows Installer handles any programs that install using .MSI files.. youre like to need it occassionally, though not often, so it seems a good candidate for the "Manual" setting where the service will consume RAM only when its required).. Wireless Zero Configuration Properties handy if youve got any 802.11x wireless adapters installed (it helps set them up), but entirely useless if youre havent.. Nonessential Services i' been really cautious so far, some services really are important to keep you system running smoothly.. but there are chance of your needing one of these services is very slim in this category indeed.. Application Management this provides "Assign, Publish, and Remove software services".. however, as this service doesnt even exist on window XP home edition try turning it off and restoring it to "Manual" if you have problem.. Clipbook this feature lets you view the contents of the clipboard, store them permanently, and share them with other users on your local network.. disable it if you dont feel you'll use it.. Computer Browser keeps track other systems currently connected to your network.. even if youre in a networked system, you only need 2 PCs running this service, and perhaps none at all if all the systems have windows 2000 or XP based systems.. Distributed Link Tracking Client if youre on a stand-alone PC, or if your networked systems dont use NTFS, or you just dont need this feature, then turn it off.. Error Reporting ever wonder what's responsible for those dialog boxes that pop up whenever an application crashes, asking if you want to send a report back to microsoft? this service is the culprit.. whether you want to be a part of the windows XP and application bug hunt is up to you.. Indexing a good idea in theory, this services creates a document index to speed up searches in windows and offices XP (among other apps).. however in reality it consumes more resources than it's worth.. IPSEC if youre telecommuter and need to connect to a remote network via a VPN, then Internet Protocol Security (IPSEC) may be useful.. otherwise it almost certainly not.. Messenger this is a service that sends messages between clients and servers across your network.. its obviously a superfluous feature for a stand-alone systems, home network probably wont need it either.. no, its not Windows or MSN Messenger.. Remote Registry Service do you want remote users to be able to modify registry setting on your PC .. its not as in secure as it sound but disable it would be wise.. SSDP Discovery a component of "Universal Plug and Play".. whether you disable it or leave it running, you need to do the same with SSD Discovery.. TCP/IP NetBIOS Helper generally required only if your local network uses NetBIOS over TCP/IP.. Telnet allows remote user to log on to your PC and run programs.. disable it of you dont want them to do so.. Uninteruptible Power Supply its safe to disable this, unless of course you UPS.. Universal Plug and Play discovers devices attached to remote PCs on your network, but unless you need this service, its still wise to turn it off.. Windows Time syncronizing your clock via an internet server.. but doing so via a windows service that's running all the time is not the most efficient route.. WMI Perfomance Adapter unless youre developer, this is of little utility, and can be disable.. Proceed With Care compare the list wist the services running on your system, and you'll quickly pick out the ones that seem to bee unnecessary.. to avoid potential problems, its best to proceed with caution.. open the service console.. change the service one at a time to avoid cunfusion.. dont let the potential risks put you off.. managing services isnt difficult, and is a great way to give your system a perfomance boost.. it take take me a whole night to study this and so far im not having problem and boot time have been improved significantly.. can someone pin this thread so everyone can utilize the info? __________________ everyday learning a new thing.. hey, where is my trophy? http://valid.x86-secret.com/show_oc?id=92271

7th Jun 2005, 06:58 PM	#2 (permalink)
Adrian Wong Da Boss Join Date: 10 Oct 2002 Location: In front of my BenQ Joybook 7000 notebook! Posts: 29,128 Reputation: 2830 Rep Power: 63	Nice! Looks like a start of a nice guide to add to ARP! __________________ Dr. Adrian Wong Tech ARP \| Blog @ Tech ARP \| The Free Trade Zone DYKT : The only offshore account I have is at the sand bank? Keep Tech ARP free! Visit our sponsors! We need PROGRAMMERS and TECHNICAL WRITERS! Contact us if you are a hot shot programmer or technical writer! My items for sale : 50x SD Card \| Memory Stick PRO \| Cyclone Energy Saver \| Seiko SS watch \| Tiger/Carlsberg beer jugs \| Travel Speakers \| Motorola V600 \| Nokia N90 SOLD! \| New Lowepro Mini Trekker AW Other items for sale @ the FTZ : Zalman CNPS9500 LED @ $20 \| Zalman CNPS7700 Cu @ $20 \| Zalman CNPS7000 Cu @ $20 \| Swarovski bracelet watches \| Dell 17" LCD \| Hi-Fi speakers \| English DIVX movies \| HP LaserJet toners! \| Office chairs

7th Jun 2005, 11:00 PM	#4 (permalink)
ESP Super Active Join Date: 8 Jan 2005 Posts: 2,121 Reputation: 715 Rep Power: 13	Quite a nice guide from you, kay. But some of my services are set to Manual. So disable it or just leave it? How long does it take for you to boot up now after disabling some of the useless stuff you have mentioned? I don't think I would risk trying it out since my system is working fine with 1GB of memory. Hehe. __________________ -eSp-

7th Jun 2005, 10:45 PM	#3 (permalink)
Giraffe }{unter Super Active Join Date: 9 Feb 2005 Location: NJ USA Posts: 1,002 Reputation: 736 Rep Power: 12	"Antivirus Software you'll probably find that your antivirus is running as a sevice.. if you want to turn it off, best use via the "official" route by right clicking an icon in the system tray.." Are you insane? that's got to be the dumbest suggestion on the planet. Worms rely on the "dumb know it all wanna be" who tweaks his computer and turns off auto protect.

9th Jun 2005, 12:10 PM	#8 (permalink)
Giraffe }{unter Super Active Join Date: 9 Feb 2005 Location: NJ USA Posts: 1,002 Reputation: 736 Rep Power: 12	Sorry I just get cranky when people turn it off. I am the AV admin at my company I have it locked down so tight the all option boxes are greayed out, it requires a password to uninstall it and if by some chance the user disables the process or gets a virus it emails me to let me know. Symantec has got the greatest Corporate suite I have ever used. It takes the work out of managing a large company.