Windows 10 Windows 10 Services with Abnormal Names? CaptureService_45415, xxx_45415, etc

[cstocci]

Hi,

After updating with the May 2020 update (Windows 10 Professional version 2004), I noticed some services with strange names ending with 4 numbers as shown in the picture attached. It was previously named with another number, but I tried disabling it via Registry, and after restart the numbers changed. How can I check if this is a legit service? and from which software?

All of the "strange" Services work fine and you can start and stop any of them (I have 19 Services with this weird suffix ending). The only things you cannot do are change the Startup Type and cannot change the Type in the registry. If you change the entries of one of these Services, it will revert to the original entries upon a reboot. If you try to chahge the entries via the Services standard tool, you will get a dialog telling you "The parameter is incorrect."

My particular "weird" suffix services are:

Agent Activation Runtime_982ff
Bluetooth User Support Service_982ff
CaptureService_982ff
Clipboard User Service_982ff
Connected Devices Platform User Service_982ff
ConsentUX_982ff
Contact Data_982ff
CredentialEnrollmentManagerUserSvc_982ff
DeviceAssociationBroker_982ff
DevicePicker_982ff
DevicesFlow_982f
GameDVR and Broadcast User Service_982ff
MessagingService_982ff
PrintWorkflow_982ff
Sync Host_982ff
Udk User Service_982ff
User Data Access_982ff
User Data Storage_982ff
Windows Push Notifications User Service_982ff

Has anybody seen anything like this? If so, do you have/see anything like this in your Services since you updated with the Microsoft May 2020 update?

Chris

 

[WindowsPro]

Windows 10 1709 introduced 'per-user' services for better resource management. These per-user services are created when a user signs in, and then deleted when the user signs out.


In the HKLM\SYSTEM\CurrentControlSet\Services section of the registry you will see 3 entries for each of these services; the regular named service and the the per-user service entries you see in Services.msc. So for instance, you may have Capture Service, Capture Service_xxxxxx and Capture Service_yyyy, where x and y are alphanumeric characters.

So YES! They are regular Windows services and not any malware.. Nothing to worry about!