Zombie Service after Service Install as by Autoit3 FAQ

[rudi]

Hello.

I'm on my way to write a watchdog program that has to watch for a certain service to be running.

The EXE is running fine. So I wanted to install it as a service using RunAsSvc.exe as specified in the sticky FAQ posting here.

The service does show up in the Services list in SERVICES.MSC, but it doesn't startup:

The Service "MMArrayWatchdog" on "Local Computer" cannot be started:

Error 3: The System cannot find the path given.

I specified the full path to my MMArrayWatchdog.EXE, no parameters, workingdir=Folder of this exe.

SC.EXE is telling that this service is not an installalled service.

When I delete the following Registry keys / values, in the SERVICES.MSC list just the startup type changes from "Automatic" to "" (no value):

expandcollapse popup

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{08CECC71-A9B1-417d-AB3A-C57C4F854F53}2306714535]
"Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):22,00,48,00,3a,00,5c,00,44,00,41,00,54,00,45,00,4e,00,5c,00,\
  50,00,52,00,49,00,56,00,41,00,54,00,45,00,5c,00,53,00,59,00,53,00,4f,00,50,\
  00,5c,00,4e,00,45,00,54,00,5a,00,5c,00,42,00,61,00,74,00,63,00,68,00,5c,00,\
  61,00,75,00,74,00,6f,00,69,00,74,00,33,00,5c,00,21,00,2d,00,52,00,75,00,6e,\
  00,2d,00,41,00,73,00,2d,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,2d,00,\
  21,00,5c,00,72,00,75,00,6e,00,61,00,73,00,73,00,76,00,63,00,5c,00,52,00,75,\
  00,6e,00,41,00,73,00,53,00,76,00,63,00,2e,00,65,00,78,00,65,00,22,00,20,00,\
  2d,00,73,00,20,00,7b,00,30,00,38,00,43,00,45,00,43,00,43,00,37,00,31,00,2d,\
  00,41,00,39,00,42,00,31,00,2d,00,34,00,31,00,37,00,64,00,2d,00,41,00,42,00,\
  33,00,41,00,2d,00,43,00,35,00,37,00,43,00,34,00,46,00,38,00,35,00,34,00,46,\
  00,35,00,33,00,7d,00,32,00,33,00,30,00,36,00,37,00,31,00,34,00,35,00,33,00,\
  35,00,00,00
"DisplayName"="MMArrayWatchdog"
"ObjectName"="LocalSystem"
"Description"="Überwacht MailMarshal ArrayManager (Logfile, Warn Emails)"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{08CECC71-A9B1-417d-AB3A-C57C4F854F53}2306714535\Parameters]
"Executable"="C:\\Programme\\MailMarshalWatchdogService\\MMArrayWatchDog.exe"
"Parameters"=""
"WorkingDirectory"="C:\\Programme\\MailMarshalWatchdogService"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{08CECC71-A9B1-417d-AB3A-C57C4F854F53}2306714535\Security]
"Security"=hex:01,00,14,80,b8,00,00,00,c4,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,88,00,06,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
  00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,00,01,\
  00,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,00,18,00,fd,01,02,00,01,02,00,\
  00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,00,00,00,00,00,05,12,00,00,00,\
  01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{08CECC71-A9B1-417d-AB3A-C57C4F854F53}2306714535\Enum]
"0"="Root\\LEGACY_{08CECC71-A9B1-417D-AB3A-C57C4F854F53}2306714535\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

How to get rid of this zombie service?

I've already tried SRVINST.EXE and SC.EXE. As SC reports that this isn't an installed service I'm wondering where is the list of installed services as presented by SERVICES.MSC, and how is it possible that SERVICES.MSC is presenting a list that is not consistent with "SC.EXE query"?

Windows 2003 Server R2 SP1.

Any suggestions appreciated, Rudi.

[rudi]

I've found my mistake:

I copied RunAsSvc.exe to C:\Programme\MailMarshalWatchdogService\, but when I used this program I started it from a network :"> drive to which the service has no access.

Amazing: After correcting the value "ImagePath" in key [{08CECC71-A9B1-417d-AB3A-C57C4F854F53}2306714535] to reflect the local copy of RunAsSvc.exe ("C:\Programme\MailMarshalWatchdogService\RunAsSvc.exe" -s {08CECC71-A9B1-417d-AB3A-C57C4F854F53}2306714535) also SC.EXE recognizes this service as an installed service.

So it looks like that a service with broken path information is no longer recognized as an installed service by SC.EXE, as this program obviously is doing extra checks SERVICES.MSC is not doing.

Well, everything is working fine now

Edited December 12, 2007 by rudi