Windows 10 Services - abnormal names? CaptureService_45415, xxx_45415, etc

I recently noticed some services with strange names ending with 4 numbers as shown in the picture attached.

It was previously named with another number, but I tried disabling it via Registry, and after restart the numbers changed.

How can I check if this is a legit service? and from which software?

Image

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

I recommend you do this:

  1. Run msconfig.exe
  2. Click the Services tab
  3. Tick the box to hide all Microsoft services
  4. Untick all services that look suspect

Windows will still start as it should. If some function no longer works, selectively restore tick marks.

Please remember to mark my reply by clicking "Did this solve your problem?".

21 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi yk_tan,

Good day! I am Independent Advisor Louie S.. and a Microsoft/Windows user just like you. I am glad to be able to provide assistance for you today.

If you really are interested, you may find this article useful:
https://www.howtogeek.com/school/using-windows-...

Hope it helps. Let me know if you need anything else!

Sincerely,
Louie S.
Louie Simbajon
IT Specialist

5 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Thanks, from MSCONFIG, I found that all the "suspicious" services were under Microsoft. Apparently the numbers change every time I restart.

9 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Thanks, there's nothing new in there. My issue is to determine whether or not these services are suspicious because their names keep changing with each reboot. Since they belong to MS, it may be legit, or it may also be an impersonation. Either way, isnt the behavior of name changing itself suspicious?

14 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

You can try to disable the services if you want. This article can help you in doing so:
https://www.tenforums.com/tutorials/4499-start-...

But it is worth to note that some services cannot be stopped, these services are required for the operating system to function properly.

--------------------------------------------------------------------------------------------------------------------
Note: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

Regards,
Louie S.
Louie Simbajon
IT Specialist

2 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi yk_tan,

I have the same thing going on in my services.  My "abnormal" suffixes are "xxx_ee1e1" on about 10 different services.  When I go into the registry, I find what appears to be the original entry for the services and the "abnormal" entry directly below or next.  They are very similar and I noticed in ALL cases the original entry without the "abnormal" suffix has a "Parameter" section, whereas the "abnormal" one has the "Security" section.  Other than that, they are pretty much the same.

I am wondering if this is due to the recent and large Windows 10 May 2020 update?  Everything works fine, and I would not have noticed anything except I was watching a YouTube video on stopping/disabling certain Services if they are not used/needed.  BTW, you cannot change the "abnormal" service item's Startup Type with the usual dialog in Services.  To disable one of these "abnormal" services, I went into the registry and manually changed the Startup Type to a "4" which is disabled.  That worked, but something is going on here and I am not sure what it is.

I do believe it is something Microsoft did and is not some kind of malware, Trojan and/or virus, but Microsoft has not mentioned anything about this either.

Chris

18 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Folks,

BTW,  after rebooting my system, the service I thought I disabled went back to manual and enabled.  Also, the weird suffix as mentioned, changes to another group of alphanumerics on the same services as before.

The only way to really take this on if one is crazy and maybe dangerous, is to copy those parts of the new entry with the weird extension into the original and then physically delete the weird suffixed version.

BTW, ALL of the weird suffixed services are a Type=0x0000000e0 (224) whereas the original was Type=0x00000060 (96).  Both the weird and original Service entries have the same Startup Type whatever that was.  Is this useful in explaining what has happened here?

Another interesting fact is that all of the weird Service entries do not have a "DependOnService" entry as the original Service does.

It is possible that Microsoft is changing all of those Windows Services with the weird suffixes and need the old entries for now, but will eventually in one the future updates, eliminate one or both of the Service entries as they see fit.

Another thing I noticed about these Service entries:  I think they are pretty new, i.e., I do not remember seeing these categories in earlier versions of either Windows 7 or Windows 10 prior to the May 2020 update.

You can start and stop any of these services, but you cannot change their Startup or Type entries either in the Services dialog or Registry.  Once you reboot, everything goes back to where it was originally.

Finally, there are 19 weird Service entry categories that get this added suffix.  I originally had thought there were around 10, but I counted them in the MSCONFIG application under Services.

Chris

15 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Exactly what is happening. Can't disable in services, can disable in Registry but will come back after reboot under different suffix.

So far no obvious issue in my PC, but this behavior is annoying & suspicious. 

(similar to MS Edge unable to remove behavior)

11 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi,

Agreed!!  I have seen this issue in other posts in other forums as far back as 2017 with earlier versions of Windows 10, but never a Windows 7 forum...just Windows 10.

I was thinking of actually going in and re-editting those weird Services in the registry (after a backup, of course) to "merge" the original one with the weird or abnormal suffix, then delete one of them and see if I get the function and control of that Service like we used to have before the May 2020 update.  I would only do one of the 19 I have to see if it works.  However, as we both know, things seem to work without issue, so will do it at some point when I get bored or wait and see if the next Microsoft Windows 10 "update" corrects the issue.

In the meantime, the only thing you and I cannot do is change the Startup and Type entries in either the Services dialog or in the Registry, but we can start and stop any of those weird Services and they are functional properly.

Chris

3 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi yk_tan,

Let's compare Services.  Here are my Services that have that weird suffix:

Agent Activation Runtime_982ff
Bluetooth User Support Service_982ff
CaptureService_982ff
Clipboard User Service_982ff
Connected Devices Platform User Service_982ff
ConsentUX_982ff
Contact Data_982ff
CredentialEnrollmentManagerUserSvc_982ff
DeviceAssociationBroker_982ff
DevicePicker_982ff
DevicesFlow_982f
GameDVR and Broadcast User Service_982ff
MessagingService_982ff
PrintWorkflow_982ff
Sync Host_982ff
Udk User Service_982ff
User Data Access_982ff
User Data Storage_982ff
Windows Push Notifications User Service_982ff

Let me know if you match any or all of these Services.

Chris

48 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

 
 

Question Info


Last updated April 22, 2025 Views 38,119 Applies to: