Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have recently installed a program that deploys an agent which "protects" from peripherals. What it actually does at this point is to block any kind of media I plug to my PC.

I've done some checking and I found the name of this service blocking my peripherals. So, naturally, I've tried stopping it.

First I tried the sc stop, but I was denied the access. Trying to do it by services.msc will result in not even giving me the priviledge to use stop on that service. Same response from taskkill: Access denied... Then I figured I'd try net stop resulting with the 2191 message which if I try net helpmsg 2191 does not give any information. I then decided to surf Superuser and found out about these pstools. But as soon as I try to do the cmd switch with psexec -s cmd I get the message:

Couldn't install PsExec service: access is denied.

Strangely, if I try to use just psexec it does prompt me with the help info. So this was a dead end again.

After all these fails I have decided to just remove it from startup right? So I open msconfig and remove the service from startup, save and finally reboot. Unfortunately, when PC reboots so does the service. By the time I can access the task manager the service is already running, again. Can't really imagine how though.

All these access failures made me think I might not have the required privileges or something, but my user account is set as administrator so I think there's nothing more I can do.

share|improve this question
2  
I love the title of this question: "UNSTOPPABLE" windows service. Gotta love windows. –  Musaab Sep 22 '11 at 9:49
    
is it possible that this service is restarting based on the task scheduler? if i say something stupid , just tell me somthing smart instead, i am new to 7 and i need to lear some of these same things. –  Psycogeek Sep 23 '11 at 1:12

4 Answers 4

up vote 9 down vote accepted

Many security software installs a special driver that intercepts any changes to its services and processes.

However, the driver is normally not loaded in Safe Mode, so you can disable the service there. If the service is still started after reboot, you may want to find and disable the driver in Device Manager. This kind of driver is normally under the "Non-plug and play drivers" section which is viewable by selecting "Show hidden devices" from the View menu. The name of the driver is normally well-known for each provider.

share|improve this answer
    
Interesting stuff. Thank you, it worked this way. Have a nice day! –  Calin Paul Alexandru Sep 22 '11 at 10:53

Have you tried opening Services.msc as an administrator or running an elevated command prompt? This should give you the required permissions to stop the task.

share|improve this answer
    
Running services.msc under administrator does not seem to make any difference. Why would and elevated command promt work and which one do you recommend ? –  Calin Paul Alexandru Sep 22 '11 at 9:22
    
The other thing to do would be to find what the permissions are on the task you are trying to kill. It may only let certain users terminate the process. Built in to protect it. –  Joe Taylor Sep 22 '11 at 9:31
    
Ok, but I'm alreay an administrator, what kind of user can have some privs that an administrator does not? Also the task is flagged as unpausable, unspoppable but accepts shutdown. I don't really know how to "shutdown" a service and google does seem to help on this one. –  Calin Paul Alexandru Sep 22 '11 at 9:35
    
thinking it runs in the AV sandbox. –  hbdgaf Sep 22 '11 at 9:37
    
Some tasks require the command prompt to be run as an administrator even though the user is an administrator. They simply won't work without. Have you checked the security settings on the process that is running? You may need to be a member of a certain group to kill the process. Certain AV's use this for protection. –  Joe Taylor Sep 22 '11 at 9:38

What about opening regedit.exe and go to HKLM\SYSTEM\CurrentControlSet\services[service name].

Than change the service to disable (I think you can do that by changing the "Start" value to 4).

share|improve this answer

Use taskkill command followed by the service's process ID. This will kill the service.

share|improve this answer
    
ERROR: The process with PID 3516 could not be terminated. Reason: Access is denied. –  FracturedRetina Jul 15 at 1:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.