How can I find what SC.exe is doing?

Uninstalling all Acer apps did not fix it. But disabling these services seems to have done the trick.

@pseymour ,

Thank you for your reply. We are all here to learn.

Funny, but I tried to run SC in Powershell twice this week and I got no error, but it did not execute the STOP on the service as I had requested. When I then switched Windows Terminal to CMD mode, the service was stopped, and I could delete it.

In any event, you are 100% correct. We should not be hijacking @kelper 's topic. Sorry, I am also so eager to learn more about the intricacies of Windows. I extend my apologies to him.

Thank you for your time and expertise. I will bow out.

Have a great day.

Regards,
Phil

@kelper ,

I am really glad to hear you found a solution. I apologize for hijacking your topic.

Have a great day.

Regards,
Phil

I do not feel that anyone hijacked my topic. All comments gratefully received.

kelper said:

Uninstalling all Acer apps did not fix it. But disabling these services seems to have done the trick.

Click to expand...

Congrats on figuring out, none of these services are IMO essential, so having them disabled is nothing wrong.

in time you might want to use sc.exe to remove them, it could be also that these are now remnants of acer software which you removed but that needs to investigated.

@garioch7 No worries. I don't think we hijacked, but I was being cautious about doing so. Now that OP has fixed the issue, we could discuss SC if you'd like.

If you remember what command you ran in PowerShell, let me know what it was. Without knowing, my first guess would be that you ran up against the issue of the "sc" alias in PowerShell, which is a shortcut to running the Set-Content cmdlet. So if you just typed "sc" and some arguments, PowerShell likely thought you meant "Set-Content," not "sc.exe."

Regards,

--ps

pseymour said:

@garioch7 No worries. I don't think we hijacked, but I was being cautious about doing so. Now that OP has fixed the issue, we could discuss SC if you'd like.

If you remember what command you ran in PowerShell, let me know what it was. Without knowing, my first guess would be that you ran up against the issue of the "sc" alias in PowerShell, which is a shortcut to running the Set-Content cmdlet. So if you just typed "sc" and some arguments, PowerShell likely thought you meant "Set-Content," not "sc.exe."

Regards,

--ps

Click to expand...

Yes, I did try using sc in Powershell. Thanks to you, I have just used sc.exe delete <service name> to remove those three pesky Acer services.

Those three CMD windows are back again, not when I log in with a user account, only when I log in with an admin account.
I've checked that the three sercices are not present i services.msc.

I've searched all the 'Run' keys in the registry in case an entry that should be a RunOnce had been put in a Run key in error. Nothing found out of place.

@kelper Seems like you're comfortable on the command line, so let's figure this out with Sysmon.

Grab the text file I posted in post #18. Grab a copy of Sysmon from Microsoft's site. Extract the contents of the Sysmon download, and put my text file in the same folder as sysmon.exe to make life easier. :) Open up a PowerShell/Terminal window as administrator, and navigate to the folder where sysmon sits.

Run this command to install Sysmon with the given configuration file:


Sysmon will install and watch for any sc.exe processes to be created. So, we sit back and wait for the SC windows to popup again, or maybe you can trigger it by logging in with the admin account you mentioned. Once it happens, open up Event Viewer and go to

Applications and Services Logs | Microsoft | Windows | Sysmon | Operational

You should have events with Event ID of 1, showing sc.exe processes being created. If you look at the details at the bottom, you'll be given ParentImage, which is the exectuable that started sc.exe. Then you can look for that parent executable with AutoRuns, or post the data here and we'll look at it.

Once you have the event data you need, close Event Viewer and run this to remove Sysmon.

@pseymour ,

You are correct. In Powershell, I just tried to execute SC STOP {service name}. Thank you for furthering my education. I am going to be watching this topic with interest to see how you help @kelper resolve his issue.

Thank you for sharing your expertise. Have a great day.

Regards,
Phil

Makes sense then. If I just type 'sc' into a Windows PowerShell window, I get prompted for more information, because it wants to run Set-Content.


To make matters even more confusing, this happens in Windows PowerShell, that is, the 5.1 version with the blue icon. It does not happen in newer PowerShell versions, e.g. 7.4, because the 'sc' alias does not exist.