Windows 10 Services - abnormal names? CaptureService_45415, xxx_45415, etc

Hi yik_tan,

Here's a final answer to what this means.  Got it from Windows Forum:

"Windows 10 1709 introduced 'per-user' services for better resource management. These per-user services are created when a user signs in, and then deleted when the user signs out.

In the HKLM\SYSTEM\CurrentControlSet\Services section of the registry you will see 3 entries for each of these services; the regular named service and the the per-user service entries you see in Services.msc. So for instance, you may have Capture Service, Capture Service_xxxxxx and Capture Service_yyyy, where x and y are alphanumeric characters.

So YES! They are regular Windows services and not any malware.. Nothing to worry about!"

I think this answers all of our concerns.  Saw this answer on other forums as well as I kept searching.

We are done!!  Hope this makes you feel better!  It makes me feel better!

Chris

Hi yk_tan,

Let's compare Services.  Here are my Services that have that weird suffix:

Agent Activation Runtime_982ff

Bluetooth User Support Service_982ff

CaptureService_982ff

Clipboard User Service_982ff

Connected Devices Platform User Service_982ff

ConsentUX_982ff

Contact Data_982ff

CredentialEnrollmentManagerUserSvc_982ff

DeviceAssociationBroker_982ff

DevicePicker_982ff

DevicesFlow_982f

GameDVR and Broadcast User Service_982ff

MessagingService_982ff

PrintWorkflow_982ff

Sync Host_982ff

Udk User Service_982ff

User Data Access_982ff

User Data Storage_982ff

Windows Push Notifications User Service_982ff

Let me know if you match any or all of these Services.

Chris

These are Microsoft user services supporting built-in UWP (Universal Windows Platform) apps like Contacts and Calendar. These services and the peculiar chameleon-like naming have been in Windows 10 for several years prior to the May 2020 update (ie. not new).

The alphanumeric code (45415 in the OP's case) changes every boot cycle and the length varies from between 4 and 7 characters. For example this morning, my code is "2c33cfe".

The code is controlled by a hidden service with the same name (minus the code). To see this, open Windows Administrative Tools > Services. Scroll down the list and find "GameDVR and Broadcast User Service_XXX" (where XXX is your code). This is the display name of the service. Double-click this service to show its' properties and note down the actual service name which never contains spaces, in this example "BcastDVRUserService_XXX". This can be copied to the clipboard if you prefer. Now open the registry editor (%windir%\regedit.exe) and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Scroll down and find "BcastDVRUserService_2c33cfe". Look above this entry in the left pane of registry editor and find "BcastDVRUserService"...the actual master service for the one you see.

If you use the in-built Microsoft Calendar, Contacts, Xbox and other UWP apps just leave them alone. In my opinion and experience, particularly on work computers, these user services are bloatware and not required. To disable, I'd first recommend backing up the list of services to undo any changes in case of error. Do this back in Services by right-clicking "Services (Local)" and select Export List... Now return to the registry editor and from the top of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services key, find all "XXX" services (eg. find "2c33cfe" in my case). When you find a service, set "Start" to "0x00000004" (which means Disabled) in the right-hand pane. Now select the service immediately above with the same name, and set its "Start" also to "0x00000004". After all services have been disabled, close the registry editor and reboot Windows.

I recommend you do this:

1. Run msconfig.exe
2. Click the Services tab
3. Tick the box to hide all Microsoft services
4. Untick all services that look suspect

Windows will still start as it should. If some function no longer works, selectively restore tick marks.

Please remember to mark my reply by clicking "Did this solve your problem?".

Hi yk_tan,

I have the same thing going on in my services.  My "abnormal" suffixes are "xxx_ee1e1" on about 10 different services.  When I go into the registry, I find what appears to be the original entry for the services and the "abnormal" entry directly below or next.  They are very similar and I noticed in ALL cases the original entry without the "abnormal" suffix has a "Parameter" section, whereas the "abnormal" one has the "Security" section.  Other than that, they are pretty much the same.

I am wondering if this is due to the recent and large Windows 10 May 2020 update?  Everything works fine, and I would not have noticed anything except I was watching a YouTube video on stopping/disabling certain Services if they are not used/needed.  BTW, you cannot change the "abnormal" service item's Startup Type with the usual dialog in Services.  To disable one of these "abnormal" services, I went into the registry and manually changed the Startup Type to a "4" which is disabled.  That worked, but something is going on here and I am not sure what it is.

I do believe it is something Microsoft did and is not some kind of malware, Trojan and/or virus, but Microsoft has not mentioned anything about this either.

Chris