Jump to content
Sign in to follow this  
rudi

Zombie Service after Service Install as by Autoit3 FAQ

Recommended Posts

Hello.

I'm on my way to write a watchdog program that has to watch for a certain service to be running.

The EXE is running fine. So I wanted to install it as a service using RunAsSvc.exe as specified in the sticky FAQ posting here.

The service does show up in the Services list in SERVICES.MSC, but it doesn't startup:

The Service "MMArrayWatchdog" on "Local Computer" cannot be started:

Error 3: The System cannot find the path given.

I specified the full path to my MMArrayWatchdog.EXE, no parameters, workingdir=Folder of this exe.

SC.EXE is telling that this service is not an installalled service.

When I delete the following Registry keys / values, in the SERVICES.MSC list just the startup type changes from "Automatic" to "" (no value):

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{08CECC71-A9B1-417d-AB3A-C57C4F854F53}2306714535]
"Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):22,00,48,00,3a,00,5c,00,44,00,41,00,54,00,45,00,4e,00,5c,00,\
  50,00,52,00,49,00,56,00,41,00,54,00,45,00,5c,00,53,00,59,00,53,00,4f,00,50,\
  00,5c,00,4e,00,45,00,54,00,5a,00,5c,00,42,00,61,00,74,00,63,00,68,00,5c,00,\
  61,00,75,00,74,00,6f,00,69,00,74,00,33,00,5c,00,21,00,2d,00,52,00,75,00,6e,\
  00,2d,00,41,00,73,00,2d,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,2d,00,\
  21,00,5c,00,72,00,75,00,6e,00,61,00,73,00,73,00,76,00,63,00,5c,00,52,00,75,\
  00,6e,00,41,00,73,00,53,00,76,00,63,00,2e,00,65,00,78,00,65,00,22,00,20,00,\
  2d,00,73,00,20,00,7b,00,30,00,38,00,43,00,45,00,43,00,43,00,37,00,31,00,2d,\
  00,41,00,39,00,42,00,31,00,2d,00,34,00,31,00,37,00,64,00,2d,00,41,00,42,00,\
  33,00,41,00,2d,00,43,00,35,00,37,00,43,00,34,00,46,00,38,00,35,00,34,00,46,\
  00,35,00,33,00,7d,00,32,00,33,00,30,00,36,00,37,00,31,00,34,00,35,00,33,00,\
  35,00,00,00
"DisplayName"="MMArrayWatchdog"
"ObjectName"="LocalSystem"
"Description"="Ɯberwacht MailMarshal ArrayManager (Logfile, Warn Emails)"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{08CECC71-A9B1-417d-AB3A-C57C4F854F53}2306714535\Parameters]
"Executable"="C:\\Programme\\MailMarshalWatchdogService\\MMArrayWatchDog.exe"
"Parameters"=""
"WorkingDirectory"="C:\\Programme\\MailMarshalWatchdogService"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{08CECC71-A9B1-417d-AB3A-C57C4F854F53}2306714535\Security]
"Security"=hex:01,00,14,80,b8,00,00,00,c4,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,88,00,06,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
  00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,00,01,\
  00,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,00,18,00,fd,01,02,00,01,02,00,\
  00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,\
  01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{08CECC71-A9B1-417d-AB3A-C57C4F854F53}2306714535\Enum]
"0"="Root\\LEGACY_{08CECC71-A9B1-417D-AB3A-C57C4F854F53}2306714535\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

How to get rid of this zombie service?

I've already tried SRVINST.EXE and SC.EXE. As SC reports that this isn't an installed service I'm wondering where is the list of installed services as presented by SERVICES.MSC, and how is it possible that SERVICES.MSC is presenting a list that is not consistent with "SC.EXE query"?

Windows 2003 Server R2 SP1.

Any suggestions appreciated, Rudi.


Earth is flat, pigs can fly, and Nuclear Power is SAFE!

Share this post


Link to post
Share on other sites

:) I've found my mistake: ^_^

I copied RunAsSvc.exe to C:\Programme\MailMarshalWatchdogService\, but when I used this program I started it from a network :"> drive to which the service has no access.

Amazing: After correcting the value "ImagePath" in key [{08CECC71-A9B1-417d-AB3A-C57C4F854F53}2306714535] to reflect the local copy of RunAsSvc.exe ("C:\Programme\MailMarshalWatchdogService\RunAsSvc.exe" -s {08CECC71-A9B1-417d-AB3A-C57C4F854F53}2306714535) also SC.EXE recognizes this service as an installed service.

So it looks like that a service with broken path information is no longer recognized as an installed service by SC.EXE, as this program obviously is doing extra checks SERVICES.MSC is not doing.

Well, everything is working fine now :)

Edited by rudi

Earth is flat, pigs can fly, and Nuclear Power is SAFE!

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×
×
  • Create New...