Stopping a service with command line 1

[maxthedork]

I'm trying to figure out if I can stop and start a service using a command. As I'm writing this I'm thinking it may not be possible, given the service I'm trying to stop. The problem is, our antivirus is slowing software distribution horribly, and even though we're pushing apps out through a software distribution engine, the AV is scanning all the files coming in and bringing the distribution process to its knees. It works eventually but it's horribly slow, especially for large distributions (like Office 2003, for example), so I wanted to specify a command to stop the AV engine while the distribution is occurring then restart it after it's done. Trouble is, wouldn't an AV engine be resistent to this type of activity, otherwise virus writers would employ the same practice.

Anyway, back to the original question: Stop and start a service with a command? Yes or no?

 

[chipk]

Yes. If you're using Symantec for instance:

NET STOP "SYMANTEC ANTIVIRUS"

Whether you can unload your service is dependent upon your settings (e.g., if you run Symantec Corporate, they will come from a "Parent" server).

 

[chipk]

And of course...to restart it:

NET START "SYMANTEC ANTIVIRUS

 

[erikhertzel]

Yes, use these commands:

NET START
NET STOP

ie...

net stop Alerter
net start Alerter

You can use this in a batch file like this:

name: stopservice.cmd


net stop Alerter
net start Alerter

Good luck

Erik

 

[smah]

Do you really mean a service, or do you mean a process?

Services can be stopped with: net stop [service]
Processes can be stopped/killed with any of several add-on tools like pskill, KillProc or several others. Because some virus writers use these methods to shutdown AV processes, some AV scanners will detect these as potentially unwanted programs.

 

[maxthedork]

smah, no I do mean Service, not process. Stopping the service also unloads related processes. This is eTrust Antivirus (which I hate but that's a whole 'nother story), formerly InnoculateIT, so there's three services running that need to be stopped.

Thanks to everyone who responded with this (-:

 

[cmeagan656]

maxthedork:

We use eTrust antivirus and the only service that you should need to stop is your realtime service. The RPC server and the job server can be left alone. The 1st is just for broadcasting the AV status to the admin server and the 2nd is for scheduling scan jobs, etc.

Also, rather than stopping the entire AV have you tried just exempting the software distribution engine's executable? This will exempt all files accessed by the executable from being scanned. NOTE: This assumes you have access to either eTrust's Antivirus' admin server or, if the realtime policy isn't an enforced policy, to the realtime policy on the servers/workstations in question.

Cheers.

 

[markdmac]

For what it is worth, from the command line you can restart a service like this using a single command:

net stop SMTP & net start SMTP

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript