如何在批处理脚本中使用服务的显示名称删除Windows服务？

Question

I need to delete a bunch of services that were created on PCs when they got infected with malware. The service names are random, but the display names are all the same. I am not good with batch files, so I have no idea how to write the script.

Tried using a powershell script, but could not get it to work. This is on a Windows 7 machine.

sc getkeyname ControlSysService

When I enter the code above I get the following result.

[SC] GetServiceKeyname SUCCESS

Name = zmzhsirmck

Besides ControlSysService there would be about 10 other display names. I have all the display names I just need the script to delete the service using the display name.

input Display name
get service name
sc delete service

Answer 1

You can probably do this using WMIC :

In order to use your known Display Names, you can run this from the Command Prompt

For %A In ("FirstName" "Second Name" "Third Display Name") Do @WMIC Service Where "DisplayName='%~A'" Call Delete

And as a batch file:

@Set List="FirstName" "Second Name" "Third Display Name"
@For %%A In (%List%) Do @WMIC Service Where "DisplayName='%%~A'" Call Delete

Obviously in both cases you'd replace "FirstName" "Second Name" "Third Display Name" with your known display names, (each enclosed with doublequotes).

Answer 2

Open the cmd as administrator and use the command:

sc delete "service name"

To get the service name, enter properties: properties of a service. Just take what's in the name of the service

Answer 3

@echo off
setlocal

rem List of space separated display names using regular expressions.
set "regexp=Windows\ Update ReadyBoost"

set "mainkey=HKLM\SYSTEM\CurrentControlSet\services"

for /f "delims=" %%A in ('reg query "%mainkey%"') do (

    for /f "tokens=1,2* delims= " %%B in ('2^>nul reg query "%%~A" /v DisplayName') do (
        if /i "%%~B" == "DisplayName" if not "%%~D" == "" (

            echo %%D | findstr /r /i "%regexp%" 2>nul >nul && (
                echo KeyName:     %%~nxA
                echo DisplayName: %%D
                echo sc delete "%%~D"
            )
        )
    )
)

The code iterates through the services key for the subkeys.

It will read the DisplayName value in each subkey to get the date value.

The DisplayName value is echoed to findstr which compares to a regular expression string which is space separated strings to find. The strings will be matched case insensitive as to using the argument /i with findstr . As shown with Windows Update which has a space, escape the space with a preceding backslash.

If tested OK, modify the value of regexp and remove the echo in front of the sc command.