Service is disabled, but surprise, I found out it was running

[Andy]

I disabled a service but then I found it was running.

Hmmm...

Is there a way to stop a service from restarting ?

How did it restart by itself ?

Thanks.

That service is the Automatic Updates service.

 

[Twayne]

In

I disabled a service but then I found it was running.

Hmmm...

Is there a way to stop a service from restarting ?

How did it restart by itself ?

Thanks.

That service is the Automatic Updates service.

Umm, that's a little fool-hardy, don't you think?

Anyway, go back to the Service. If it's running, first Stop it
and then Disable or remove it.

If it shows as not running, then look for another instance of it;
it's not that unusual to have more than one entry for such things
in Windows, not that you provided much information to work with..

HTH,

Twayne`

 

[glee]

I disabled a service but then I found it was running.

Hmmm...

Is there a way to stop a service from restarting ?

How did it restart by itself ?

Thanks.

That service is the Automatic Updates service.

You must disable, it not just stop it. If you disable it, do it from
the Services control panel, not from msconfig.

Click Start> Run, type:
services.msc
Click OK

Or, Start> Control panel> Administrative Tools> Services

 

[Andy]

I disabled a service but then I found it was running.



Hmmm...



Is there a way to stop a service from restarting ?



How did it restart by itself ?



Thanks.



That service is the Automatic Updates service.

I already did that.

Andy

 

[Andy]

In




Umm, that's a little fool-hardy, don't you think?



Anyway, go back to the Service. If it's running, first Stop it

and then Disable or remove it.



If it shows as not running, then look for another instance of it;

it's not that unusual to have more than one entry for such things

in Windows, not that you provided much information to work with..



HTH,



Twayne`

Have you seen more than one instance of wuauclt.exe in your system ?

If you have, I would recommend doing a virus and malware scan of your system.

Andy

 

[JJ]

I disabled a service but then I found it was running.

Hmmm...

Is there a way to stop a service from restarting ?

How did it restart by itself ?

Thanks.

That service is the Automatic Updates service.

Any program with admin rights can re-enable any service. If you want to
fully control your system, I suggest using HIPS to monitor all crucial
activities. Some good HIPS can even block registry access. Note that HIPS
*will* bombard you with many confirmation prompts and most are usually
technical.

 

[Ben Myers]

I disabled a service but then I found it was running.
Hmmm...
Is there a way to stop a service from restarting ?
How did it restart by itself ?
Thanks.
That service is the Automatic Updates service.

If you really want to disable Automatic Updates, do it from
Control Panel.

Ben

 

[glee]

I disabled a service but then I found it was running.

Hmmm...

Is there a way to stop a service from restarting ?

How did it restart by itself ?

Thanks.

That service is the Automatic Updates service.

As JJ mentioned, a program can also enable the service. For example, I
have installed Microsoft Security Essentials on XP systems that have
Automatic Updates set to Notify Only, and the MSE installer has changed
it to Automatic without asking. While I have not tested it, I suspect
the installer might enable the service as well, if it was disabled.

 

[Twayne]

In

Have you seen more than one instance of wuauclt.exe in
your system ?

If you have, I would recommend doing a virus and malware
scan of your system.

Andy

No ... but I have a time or two come across a necessary service
that, when disabled or removed, forget which, is a required
service and so is just replaced again - it just sort of "comes
back", leadng to multiple entries. I've also seen dupes, I think,
for no known reason but closer inspection showed they weren't
exactly the same - just the same name & info in the Services
window.

Thanks for asking though.

Twayne`

 

[Twayne]

In

As JJ mentioned, a program can also enable the service. For
example, I have installed Microsoft Security
Essentials on XP systems that have Automatic Updates set
to Notify Only, and the MSE installer has changed it to
Automatic without asking. While I have not tested it, I
suspect the installer might enable the service as well,
if it was disabled.

Hmm, haven't seen that one happen; interesting. I have updates
set to download but not install; just notify me. Never looked at
the registry, but never had anything change on me either. I like
to use Custom Install or whatever it's called so I can prevent
having Silberlght and things I don't want pushed onto me in an
update. I got E7 that way and it royally pissed me off next time
I opened IE. Then I can also go tell it to stop offering it to
me, too and I'll never see it offered again. I dislike covert
pushing of apps on me, which IE used to do regularly.

HTH,

Twayne`

 

[Andy]

I disabled a service but then I found it was running.



Hmmm...



Is there a way to stop a service from restarting ?



How did it restart by itself ?



Thanks.



That service is the Automatic Updates service.

01:04You can find some interesting info in WindowsUpdate.log.

I am trying to find out which service is needed by Windows Security Essentials
for downloading updates.

"It's O.K. if they go into my fridge as long as they close and lock the door afterwards."

Andy

2013-01-15 17:18:39:703 764 324 Misc = Process: C:\WINDOWS\Explorer.EXE
2013-01-15 17:18:39:703 764 324 Misc = Module: C:\WINDOWS\system32\wuaueng.dll
2013-01-15 17:18:39:703 764 324 Shutdwn Install at shutdown: no updates to install
2013-01-15 17:18:39:703 764 324 Shutdwn FATAL: WUCheckForUpdatesAtShutdown failed, hr=80240FFF
2013-01-15 17:18:44:937 884 904 Misc =========== Logging initialized (build: 7.6.7600.256, tz: -0600) ===========
2013-01-15 17:18:44:937 884 904 Misc = Process: \??\C:\WINDOWS\system32\winlogon.exe
2013-01-15 17:18:44:937 884 904 Misc = Module: C:\WINDOWS\system32\wuaueng.dll
2013-01-15 17:18:44:937 884 904 Shutdwn FATAL: WUAutoUpdateAtShutdown failed, hr=80240FFF
2013-01-15 18:48:11:421 1480 838 Misc =========== Logging initialized (build: 7.6.7600.256, tz: -0600) ===========
2013-01-15 18:48:11:421 1480 838 Misc = Process: c:\Program Files\Microsoft Security Client\MpCmdRun.exe
2013-01-15 18:48:11:437 1480 838 Misc = Module: C:\WINDOWS\system32\wuapi.dll
2013-01-15 18:48:11:421 1480 838 COMAPI FATAL: Unable to connect to the service (hr=80070422)
2013-01-15 18:48:11:437 1480 838 COMAPI WARNING: Unable to establish connection to the service. (hr=80070422)
2013-01-15 18:48:11:453 1480 838 COMAPI -------------
2013-01-15 18:48:11:453 1480 838 COMAPI -- START -- COMAPI: Search [ClientId = Microsoft Security Essentials (EDB4FA23-53B8-4AFA-8C5D-99752CCA7094)]
2013-01-15 18:48:11:453 1480 838 COMAPI ---------
2013-01-15 18:48:11:453 1480 838 COMAPI FATAL: Unable to connect to the service (hr=80070422)
2013-01-15 18:48:11:453 1480 838 COMAPI WARNING: Unable to establish connection to the service. (hr=80070422)
2013-01-15 18:48:11:453 1480 838 COMAPI - WARNING: Exit code = 0x80070422
2013-01-15 18:48:11:453 1480 838 COMAPI ---------
2013-01-15 18:48:11:453 1480 838 COMAPI -- END -- COMAPI: Search [ClientId = <NULL>]
2013-01-15 18:48:11:453 1480 838 COMAPI -------------
2013-01-15 18:48:11:453 1480 838 COMAPI FATAL: Unable to initiate asynchronous search, hr=80070422
2013-01-15 19:31:01:593 3384 e74 Misc =========== Logging initialized (build: 7.6.7600.256, tz: -0600) ===========
2013-01-15 19:31:01:593 3384 e74 Misc = Process: C:\Program Files\Mozilla Firefox\firefox.exe
2013-01-15 19:31:01:593 3384 e74 Misc = Module: C:\WINDOWS\system32\wuapi.dll
2013-01-15 19:31:01:593 3384 e74 Misc wuauserv is disabled
2013-01-15 19:34:6 3384 a80 Misc wuauserv is disabled

 

[Ben Myers]

01:04You can find some interesting info in WindowsUpdate.log.
I am trying to find out which service is needed by Windows Security
Essentials
for downloading updates.

<snip>

Try using the stand-alone Update Agent.

http://support.microsoft.com/kb/926464

Ben

 

[Andy]

Any program with admin rights can re-enable any service. If you want to

fully control your system, I suggest using HIPS to monitor all crucial

activities. Some good HIPS can even block registry access. Note that HIPS

*will* bombard you with many confirmation prompts and most are usually

technical.

Thanks J.J.

Andy

 

[glee]

01:04You can find some interesting info in WindowsUpdate.log.

I am trying to find out which service is needed by Windows Security
Essentials
for downloading updates.
snip

MSE uses the Windows Update service (wuauserv) to get updates. If you
have Automatic Updates disabled, MSE cannot update and you must manually
download the updates every day.

How to manually download the latest definition updates for Microsoft
Security Essentials
http://support.microsoft.com/kb/971606

 

[glee]

In

Hmm, haven't seen that one happen; interesting. I have updates set to
download but not install; just notify me. Never looked at the
registry, but never had anything change on me either. I like to use
Custom Install or whatever it's called so I can prevent having
Silberlght and things I don't want pushed onto me in an update. I got
E7 that way and it royally pissed me off next time I opened IE. Then I
can also go tell it to stop offering it to me, too and I'll never see
it offered again. I dislike covert pushing of apps on me, which IE
used to do regularly.

Microsoft Security Essentials 2.0 flips Windows Automatic Update
settings
http://www.infoworld.com/t/anti-vir...0-flips-windows-automatic-update-settings-004

The article is about an earlier version of MSE but I have intermittently
seen the behavior with the recent /current versions as well.

 

[Andy]

Microsoft Security Essentials 2.0 flips Windows Automatic Update

settings

http://www.infoworld.com/t/anti-vir...0-flips-windows-automatic-update-settings-004



The article is about an earlier version of MSE but I have intermittently

seen the behavior with the recent /current versions as well.

--

Glen Ventura

MS MVP Oct.

Thanks. Good article.

Would you know how I can find out who is over the MSFN forum ?

The person above the moderator.

Thanks.

 

[glee]

Thanks. Good article.

Would you know how I can find out who is over the MSFN forum ?

The person above the moderator.

Thanks.

The MSFN forum? It would make more sense to ask that in the MSFN
Forums.

 

[Andy]

The MSFN forum? It would make more sense to ask that in the MSFN

Forums.

--

Glen Ventura

MS MVP Oct. 2002 - Sept. 2009

CompTIA A+

I already did.

 

[J. P. Gilliver (John)]

In message <[email protected]>, glee <[email protected]>
writes:
[]

MSE uses the Windows Update service (wuauserv) to get updates. If you
have Automatic Updates disabled, MSE cannot update and you must
manually download the updates every day.

How to manually download the latest definition updates for Microsoft
Security Essentials
http://support.microsoft.com/kb/971606

Seems a bit poor, given that most other AV products can operate with
updates disabled.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

Astaire was, of course, peerless, but it's worth remembering that Rogers does
everything he does, only backwards and in high heels. - Barry Norman in Radio
Times 5-11 January 2013

 

[glee]

In message <[email protected]>, glee

Seems a bit poor, given that most other AV products can operate with
updates disabled.

MSE gets its automatic updates via Automatic Update in Windows, other
AV's get their automatic updates via their own updater. If you disable
Automatic Update, then you must manually update the defs in MSE. If you
disable the automatic updater in any other AV, you must manually update
the defs in those products. It's the same scenario. The only
difference is that MSE is tied to Windows Automatic Updates, which
updates Microsoft products as well as MSE. Yes, a better solution would
be to have a separate updater built into MSE that didn't rely on Windows
Update.

On a side not, MSE did not fare well in the latest 0-day infection
tests, and should be watched for future results. If it doesn't improve,
I may have to stop recommending it as a free AV.

I get a chuckle when people go on about how they refuse to allow
Microsoft to update Windows and IE, then run Firefox or Chrome as a
browser.... both of which automatically update to new versions very
often. Chrome does not even give you an option to turn off updating....
Chrome also includes its own integrated version of Flash Player which is
often behind in security updates compared to the Flash plugin from
Adobe. Unless you manually disable the integrated Flash and install the
plugin, you run the risk of infection through the integrated Flash not
being updated quickly. I'd be much more concerned about high-risk
infection vectors such as that, than knee-jerk anti-MS sentiments.