0

I have a hidden process started by a 3rd party vendor software running on my machine that I am unable to stop or kill it using the following methods:

  • Use the Windows Service commend line: sc stop "Process_Name" or sc config "Process_Name" start= disabled (where Process_Name is the string name of the hidden process I am trying to stop. Notice that I started the command window with the administrator rights, yet still unable to stop it;
  • Use the Services.msc tool trying to change it's start type from automatic to manual or stoped;
  • Use the ProcExplorer tool (an advanced Task Manager tool) in the SystemInternals tool suite (http://technet.microsoft.com/en-us/sysinternals/default.aspx), even with running it in the administrator mode;

I get access denied error message when trying to kill the process using these methods. My login account has the administrator rights, although I am not logging in with the administrator account name. The other thing I am unable to do is to start the Windows in Safe Mode to prevent it from starting, because I don't have the bitlocker code of the machine, which is needed to start the Windows in Safe Mode.

So my question is, with my current user rights (admin account rights) but no Safe Mode or admin account log-in ability, is there any way for me to stop such running Windows process, or prevent it from starting at the Windows start up? Has anyone run into similar problem and found a way to do it?

Joshua Dwire
  • 5,415
  • 5
  • 29
  • 50
Bill-L
  • 21
  • 1
  • 1

1 Answers1

1

If it's a process or service starting with the machine, you can prevent it from starting at all with MSCONFIG. At Microsoft they call this a "Clean Boot".

Check out the following KB article that explains how to perform a clean boot to remove any third party startup processes or services from startup:

How to perform a clean boot to troubleshoot a problem in Windows 8, Windows 7, or Windows Vista

Cody Lee Clements
  • 11
  • 1
  • Thank you for your suggestion! Sorry about forgetting to mention, I have also tried this method, and it also got the same access denied error. – Bill-L Oct 07 '13 at 06:22
  • Thank you Cody! Yes, the process starts with the machine, but using MSConfig is unable to stop it - it reenable itself right back. It's like a nasty virus! Any other suggestion? – Bill-L Oct 07 '13 at 06:52