18

there are a couple of services from UnistackSvcGroup, BcastDVRUserService and others running on my Windows 10 machine with a weird name. I did some research on the web about services from these groups and they seemed fine (simply part of the services that come with Windows), but what I found odd was that they were duplicated with a strange rename with them: _a1bddec, like:

  • BcastDVRUserService and the duplicate, BcastDVRUserService_a1bddec
  • BluetoothUserService and the duplicate, BluetoothUserService_a1bddec
  • etc.

I googled for this "name" and I couldn't find anything, nor could I find anything about duplicated services from such groups. More then that, I discovered this services when I was trying to understand why suddenly my computer started to suffer performance issues while I was watching a movie with nothing working behind that would justify gradual performance changes. After closing some apps plus stoping these services, my computer went back to normal, what leads me to think if it's not a virus of some sort.

So what do you know of these "double services" with different end names? Here are some prints with all of them:

First print

Second print

Third print

Fourth print

EDIT

Following the comments below asking me to clarify my question, here is what I want to know: What are these duplicated services with different end names on my PC?. Knowing if they are viruses and why they are here would be part of the answer.

Since I'm already editing this post, it is worth to know that today, after restarting my PC, I found the previously shut down services had vanished from my PC and in their place I found a complete list of duplicated services with different end names, some of which were already stoped:

New shut down services

while some were running:

New running duplicated services

2
  • 1
    They are not malicious.
    – Ramhound
    May 26, 2018 at 3:02
  • 1
    I would use msconfig to see what non microsoft services are loading, use that to disable some.
    – Moab
    May 26, 2018 at 14:17

2 Answers 2

17

I've just found this page as I have the same duplicate services as you have above, but with different suffixes. I found this detailed guide which explains the reason for them, and how to stop them being created, since they can't be stopped using Services.msc.

https://docs.microsoft.com/en-us/windows/application-management/per-user-services-in-windows

Windows 10 1709 introduced 'per-user' services for better resource management. These per-user services are created when a user signs in, and then deleted when the user signs out.

In the HKLM\SYSTEM\CurrentControlSet\Services section of the registry you will see 3 entries for each of these services; the regular named service and the the per-user service entries you see in Services.msc. So for instance, you may have Capture Service, Capture Service_xxxxxx and Capture Service_yyyy, where x and y are alphanumeric characters.

For the above example, if you look under the entries for the Capture Service you'll find a Reg DWORD 'UserServiceFlags' with a value of 3. You can prevent per-user services from being created by setting this value to 0. There's more information in the above link explaining how to stop these services.

9

I guess I figured out the answer.

At the day the question was posted when I shut down the services, I also noticed the W10 functionality activated with Windows Key + Tab wasn't working anymore. The next day when I restarted my PC that tool was working again and after stopping the running services mentioned in my edit of the question, they stop working. Finally after running MSCONFIG as suggested by user '@Moab', I concluded that such services are indeed non-malicious and are a normal part of Windows 10 with at least some of them related to the new timeline functionality that came up with the last W10 update. It would seem, then, that the whole problem is nothing but some downgrade in service naming quality by Microsoft.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.