In most cases a user doe not need to have Windows running all sorts of programs. In order to reduce the memory footprint, as well as processor usage it is smart to clean out anything that is running.
Things like Windows firewall. this does not need to be running if you have a gateway(router) to the internet. as most of these already have it built in. the exception would be if you have people that use your network then you would want to keep it enabled.
There are loads of services like this that you don't need to have running all of the time.
It is also important to remove things like the google update service. this is not something that is needed. A user has the ability to click a button to see if there is a new version available and install it whenever they want. I always live by the saying "if it ain't broke then don't fix it." one of the reasons why I am still running Windows 7 and also why I have windows Update turned off.
You can also disable Windows defender if and only if you have something like U-Block Origin installed into your browser. and you have MalwareBytes also installed (without the bit that is always running). you simply run MalwareBytes once every other week or so to clean out any garbage that happens to get installed. You also have to put in there a little common sense also. before you click on any link for the first time. if you hover over it with you mouse on the bottom of the browser it is going to show you where that link is going. if you see hjggfdsf876bmm.ru/fgsduytfsd7sbmnb you want to avoide clicking on that link. the host/domain bits of a link (the bits before the first /) should always be human readable. meaning. they are a word. like Microsoft.com. or EventGhost.net. this was done so that we as humans could remember the web address easily. also steer clear of downloading any applications from any place other then the application developers website. places like softpedia, and sourceforge you want to steer clear of. These sites tend to wrap the authors original installer with their own installer that will want to install all kinds of crap. If you ever have an installer for an app ask you about installing any tool bars into your browser. do not exit the installer. go and kill the process instead. most times the simple thing like clicking the close button will install shit onto your machine.Same deal goes with websites. if you find yourself at a website that looks suspicious. or causes your browser to lockup kill the process for the browser. do not worry because if you kill the process when you load the browser again it will tell you that it crashed and ask which pages you want to load out of the ones that were loaded when the crash took place.
Services are also another mechanism that malware/viruses/spyware will use to infect your system. always have a look see at the path to the executable inside of the service properties. This is a really good indicator. If the manufacturer of a service states Microsoft. then the service had better be in a Microsoft created directory. like Windows, Office, Visual Studio.. you can have an infection that will change an existing service to a new file.
on my windows 7 x64 SP1 installation I have 40 processes running after boot and login. This should be a pretty good number to use for all windows version. since the "core" of windows has not change much between Vista to 10 The number of running processes should be close. There is really dumb services like DLNA for Windows Media Player. if you do not use it turn it off.
Oh.. i did want to make note of a really crafty mechanism that gets used by some of these software manufacturers.. Google is a good example. even if you stop, disable or delete a service it will mysteriously reappear. if this happen Microsoft Task scheduler is the place to look. there will usually be an entry in there that will check the service and start/enable/install the service if it has been tampered with.
But I figured I would also share some service tweaking.
There will be 3 posts that follow. they are going to be extremely long posts. they are going to show 3 different Windows versions.
Windows 7
Windows 8.1
Windows 10
they will show the default system installed services. it will show the actual service name and it is going to show the default service startup if applicable for a specific windows edition of that version.
It is then going to show safe settings tweak settings. and for a windows & installation a bare-bones setup.
Before you make any changes please read the following
READ THIS
IT WILL SAVE YOU FROM A SYSTEM CRASH
STEP 1. (DO NOT SKIP THIS STEP)
go into your system properties dialog. Start --> Right click Computer --> Properties
in the window that opens click on Advanced system settings on the left. and under the Startup and Recovery section click on the Settings button.
Here there are 2 check boxes we are interested in they are in the System failure section.
Check - Write an event to the system log.
Uncheck - Automatically restart.
What the above does is. if you system gets a BSOD. it WILL NOT restart the computer. it will leave the BSOD on the screen.
IMPORTANT: Once you make a change you will want to reboot the computer.
**** DO NOT LOGIN.*****
let the computer sit for a bit. make sure the HDD activity is extremely low or none at all. look at the HDD activity light on the computer. Or wait 3 minutes if you do not have a light. This is going to insure that all services have started.
If you encounter a BSOD at this point it is going to be because of a change that was made. This is where disabling the restart on system failure comes into play.
If that BSOD occurs you are going to manually restart the computer. once it starts to boot.. tap the F8 key (windows boot modes, also called the "safe mode menu"). keep tapping it until the menu opens up. scroll down the menu to the "Last Known Good Configuration" option. this is the one we are going to use. It is going to return any changes made back to what they were before your last login. any system changes made to a PC do not actually get save until you restart and login again. That is the reason why i told you to not login until the HDD activity slows. usually 3 minutes at most we want to make sure that everything has loaded properly without error. and if an error comes up because we have not logged in we are able to reset everything back to what it was.
Nifty trick eh?
It is always good to leave that automatic restart on failure turned off. Even been at a login prompt and you could swear you were logged in?? this is most likely the culprit. unless you go digging through your event logs you have no other way of knowing that a system failure occurred. and in order to get to the eventlog you have to login. once you login the Last Known Good Configuration will not correct the issue. Kind of a goofy setup if you ask me. So it is best to have it stay at the BSOD so you now have a mechanism to fix the issue available to you.. One that actually works, not like the System Restore (I have never had it actually work).
if you delete service files form the system it is going to cause all kinds of other problems. if another service depends on the one you deleted you can have a pretty nasty cascading failure.
If you by chance have some kind of a service that is "suck" or you cannot make any changes to. be sure you always use Run as Administrator for a command prompt and use the sc module to manipulate the service. If a service is being a pecker. and didn't get deleted when you uninstalled the application it belongs to. Or you simply do not want it in there.. (the google update service). use the sc command to remove it. do not delete the executable
Code: Select all
sc stop gupdate
sc delete gupdate
when deleting a service you need to make sure the service is in a stopped state. otherwise it will mark it for deletion. which means the service will not actually get deleted until the system reboots. if you stop the service first. it will delete it.. deleting a service using sc only removes the registry keys for the service. it does not remove any files. Which is a good thing because if you delete a file Last Known Good Configuration will not restore files, only changes made to the system. removing registry keys is a system change and can be reversed so long as the service executable exists on the system
This is a really good lesson in how to customize your system reducing your risk to almost 0. I know we have all made some kind of an error that forced us to have to install windows all over again. This is a really good way to protect from having to do that if you make a change that boogers up the system.
you can use msconfig to display all of the services. there is an option to hide all Microsoft services. Then it will display only 3rd party apps. these are simple to deal with. You will open a command prompt with elevated privileges(Run as Administrator). then type in
Code: Select all
net STOP "THE_SERVICE_NAME"
and if by chance there is an issue stopping it. you can change the service restart parameters. and kill the task
to change the service restart params you are first going to need to find out what they are so you can return them back to what they were.
so you would run this command
leaving the quotes in place
Code: Select all
sc qfailure "SOME_SERVICE_NAME"
Code: Select all
SERVICE_NAME: WMPNetworkSvc
RESET_PERIOD (in seconds) : 86400
REBOOT_MESSAGE :
COMMAND_LINE :
FAILURE_ACTIONS : RESTART -- Delay = 20000 milliseconds.
RESTART -- Delay = 30000 milliseconds.
RESTART -- Delay = 40000 milliseconds.
the command you would key in to disable the restart of the service is.
Code: Select all
sc failure "SOME_SERVICE_NAME" reset= 0 reboot= "" command= "" actions= 0/0/0/0/0/0
now we want to set the failure back to what it was. the actions represent the FAILURE_ACTIONS section of the query. If you do not see the FAILURE_ACTIONS section then enter actions= 0/0/0/0/0/0
there are 3 actions to set. each representing what to do for the first, second and third time the service has failed within the RESET_PERIOD given
each action set is separated by a "/" before the "/" is the action type and after the "/" is the delay time in seconds before performing the action.
to break it down
RESTART -- Delay = 40000 milliseconds = restart/40000
Each action_type / delay is separated by a "/" as well
RESTART -- Delay = 20000 milliseconds.
RESTART -- Delay = 30000 milliseconds.
RESTART -- Delay = 40000 milliseconds.
so we can see there are 3 actions to perform
and this would be how you format it.
restart/20000/restart/30000/restart/40000
if you only see 2 items listed simply swap out the missing action/delay with 0/0
RESTART -- Delay = 20000 milliseconds.
RESTART -- Delay = 30000 milliseconds.
becomes
restart/20000/restart/30000/0/0
represents the action type and the delay time. the available action types are
the available action types are
0 = no action to perform
restart = restart the service
run = run a program from a command line
reboot = reboot the computer
you should know which one to use from the query.
Now I know this can be done using the properties of a service in the service manager. BUT.... you are not able to set seconds. only minutes.
so 30000 = 30 seconds. you cannot make this change in that properties dialog.
You basically want to duplicate everything you see in the qfailure (query failure settings)
RESET_PERIOD = reset
REBOOT_MESSAGE = reboot
COMMAND_LINE = command
FAILURE_ACTIONS = actions
be sure to wrap the value for reboot and command in double quotes. and if the item is blank then put in "" for it.
IMPORTANT: you MUST have a space between the = and the new value. actions= 0/0 or command= ""
Code: Select all
sc failure "SOME_SERVICE_NAME" reset= 86400 reboot= "" command= "" actions= restart/30000/restart/30000/restart/30000
once you have located the service causing the issue and you have set the failure actions back to what they were. you are going to need to disable the service.
DO NOT DELETE THE SERVICE EXECUTABLE FROM YOUR FILE SYSTEM.
if disabling the service causes some kind of an issue you will be able to restore the settings.
Code: Select all
sc config "SOME_SERVICE_NAME" start= disabled
I am always going to suggest you learn by installing your version of Windows into a virtual box. and mess around with it that way. we do not want you to have a crash of your production machine. The above instructions for avoiding the need to do a complete reinstall works extremely. I personally have never had it not work. so long as you follow the directions. You need to fully understand that it will only work if you DO NOT login again. Every system is different and is going to have different needs. This information is to provide you with some additional knowledge that will help in getting better operating system performance.
I run what I call Windows Thin PC x64 (and extremely lightweight Windows 7 x64). Microsoft made a 32 bit version that you couldn't do a whole lot on. The version I have made up uses less then 1 gig of memory and has about a 10 gig storage footprint. it has less then 40 processes running out of boot. put that onto a 6 core 3.2 ghz box with 16 GB of memory with an SSD. it fairs pretty well in the performance department.
and the next 3 posts are going to be very long.
