create and modify services in windows

hi all,

a new question:

i came across the process nprotect.exe from norton and i saw that i was not able to kill it via the taskmgr or anything else.

so i went and checked and found that the file nprotect.exe is started via a service...
this service isn't standard in windows so that means that norton must have created it during installation.

now im getting curious of how they did that, i've googled for over an hour now, but haven't find anything usefull yet, although i don't think it should be that hard...

so if anyone can tell me how i can do this, i would be really glad! :)

google "instsrv.exe" and pick your poison.......

Or have a look at what SRVANY.exe does (it's from a resource kit but I cannot remember which one).

It basicly means you have to create a couple of keys in
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\

Sir Dice:

instsrv and srvany go hand in hand..... Srvany allows the app to run as a service and is installed by instsrv. Instsrv also creates the initial registry entries under services, then you go in and add the details.

There are APIs which let you create a service, can't remember exactly what they are. NtCreateService or something.

The installer just used that.

Slarty

Quote:

---

Originally posted here by Tiger Shark
instsrv and srvany go hand in hand..... Srvany allows the app to run as a service and is installed by instsrv. Instsrv also creates the initial registry entries under services, then you go in and add the details.

---

Ah. I used srvany back in the NT4 days. Had to do everything by hand :eek:
These days I just tell the windows guys 'n gals what I want and they go and do it :D

thanks for all your replies, i'll go and check it out!

but for my other question, how do you modify a existing service??
which keys are exactly used in the registry???

The defacto answer to that is "it depends".

When you say modify, are you speaking of a native service to the OS? If so, then clearly the answer is that you don't. If you are speaking of a third party service, then the answer is maybe. Look over the EULA and see what it says about mods. Typically you will find source code along with the service.

Also, when you say modify, you are using the biggest generalization on the planet. Something like, "How can I change the number of threads are spawned by a service or how can I change the default port a service runs on?" would be much better than the general nature of your question. A detailed description of what you are doing wouldn't hurt either.

--TH13

leprichaun..

as with your previous thread... on Windows you don't modify any services..
you just configure what was given by the grace of Microsoft (config pannel etc)..

If you realy want to modify services you should go for an open source platform and change some source and recompile the service..

I fail to see why we should continue to answer these stupid questions?

Leprechaun (correct spelling) why don't you buy a legit copy of Windows and go away and play with it?

You are starting to become boring................I am sure you think you are very 1337?...........well that is an opinion I do not share............

And I notice that the_JinX is onto your game as well?

If anyone has a problem with this, might I respectfully suggest that you check out his last dozen posts or so?

My view

I'm with horse, JinX and Nihil on this one - why the hell would you want to kill a process thats trying to protect your computer anyway?!?!?

Zone: Cos daddy, (the admin), put it there and stupid can't download something he wants????

Just a thought..... ;)

Tiger... you know - its times like this I'm damn glad I don't have and don't intend on having kids.... I am obviously overlooking the obvious - thank you for reminding me to be suspicious again :)

You'll have to forgive me - I'm on a second bottle of wine tonight and my thought processes have gone to treacle (that and a 3 1/2 hour meeting that really did my head in earlier today hasn't helped).

"Methinks she protests too loudly" (Bill Shakespeare)

There is something going on here?...............not too sure what, but why are all these questions going in one direction?

It almost sounds as if a hack journalist is trying to dish some dirt on AO?............like "and they told me how to do this"

As I said................check out this person's posts of late.................unidirectional? and I have not negged once, just commented?

Cheers

I've read all of his/her posts and I too feel that something is out of place. Because the questions display a clear lack of technical understanding, my opinion falls along the lines of a fishing expedition. In other words, this person must have heard or read something that he/she does not fully understand. By throwing the questions out the way they are worded, this person must believe that the general population here are morons or that we may feel empathy for a n00b and delve out the missing information that he/she wants.

Bottom line, until intentions are made clear (fat chance) don't feed the bears. ;)

gee, what a lot of replies, and a lot of childisch ones too!!!
first of all,

i'm admin to my system and it is a legit copy, second of all, i don't want to modify any services of windows, just norton, since this is what's bothering me... i've bought a notebook with win xp on it, but on the recovery cd's there is norton installed with the os, and i would like another virusscanner.... nn
that's why i would kike to kill it, so i can delete it!

as for all the other comments, yes i'm still learning, but who doesn't?

and when i see something that i don't understand, i'll go and see if i can find an answer to it....

b.t.w. i'm not a child anymore, my age is 25, born on 16 february 1979, for that matter...


o yeah, one last thing, i'm learning MSCE at the moment, to become a network administrator, but with that study, some questions may pop up, that's why i ask them....


believe it or not, that's your choice, but if i wanted to do something destructive, there are other channels i can get information from....
the only reason i don't use that channels, is cause i don't want to do anything destructive and i trust the answers that are given here more then the replies on hackers/crackers sites / irc....

Lep:

Quote:

---

and i would like another virusscanner

---

Er.... Ever thought of uninstalling Norton through the control panel? That usually takes it away..... Ever thought of going into Services, disabling it and restarting the box.... That usually gets rid of services too..... Ever thought of going to the registry and removing it fromthe list of services? I've had that work too......

Quote:

---

i'm learning MSCE at the moment

---

I dunno, but I think this demonstrates what I have said for years.... Those nice little pieces of paper don't necessarily mean squat...... You seem not to have tried the things I suggested above which implies you don't know they are potential solutions for your problem. I don't know how far you are along in your course but I hope they cover this before you finish.

ok...

Quote:

---

i'm admin to my system and it is a legit copy

---

yes anyone can say that - you can't proove it and at the moment we don't trust you - do you know how many times we have seen similar requests?

Quote:

---

i don't want to modify any services of windows

---

tskmgr.exe??? another thread I know - but we do read most of the things that get posted you know - putting all together does create a rather suspicious profile of you

Quote:

---

but on the recovery cd's there is norton installed with the os, and i would like another virusscanner.... nn that's why i would kike to kill it, so i can delete it!

---

fair enough - I don't like norton either. However shouldn't nortons uninstaller handle this? It should do...

bear in mind you also asked

Quote:

---

how do you modify a existing service

---

how else are we supposed to take that?

Quote:

---

as for all the other comments, yes i'm still learning, but who doesn't?

---

only those people who are dead stop learning (and thats debatable if you want to get metaphysical) - fair comment so help us to learn about you so we can see if we trust you - anything wrong with that?

Quote:

---

b.t.w. i'm not a child anymore, my age is 25, born on 16 february 1979, for that matter

---

fine thats nice but this isn't necessarily borne out from your replies - I'm 31 but people like Nihil and TigerShark are a tad older than me. The age doesn't matter - maybe you're just not so cynical as some. thats not meant as an insult to anyone btw

Quote:

---

o yeah, one last thing, i'm learning MSCE at the moment, to become a network administrator, but with that study, some questions may pop up, that's why i ask them....

---

thats nice - but we aren't psychic how in the hell are we supposed to know that straight off?? Also the problem with being cynical is that we have heard of things called lies - I'm not calling you a liar but a lot of people here have heard similar things before from people who were less than reputable.

Quote:

---

the only reason i don't use that channels, is cause i don't want to do anything destructive and i trust the answers that are given here more then the replies on hackers/crackers sites / irc....

---

fair enough - why don't you hang around for a bit, help others out where you can - let us get to know you better before you expect answers to questions like the above?

I'm being optimistic today - can anyone tell?

Z

Ah!

Now if you had said that all you wanted to do was replace Norton, I would have understood. :)

I would recommend booting into safe mode and doing it from there. If you try to do it in a normal Windows sesssion stuff will get left behind that may cause you problems later. That seems to be a fairly common problem with Norton?

REMEMBER! if you are using the XP Recovery Point System, you need to create a manual one as soon as you have uninstalled, or it will obviously come back if you do a restore.

That should do the trick for you.

thanks for the replies.... this is somewhat strange.... always when i come to this site i click the link "new posts" but i missed the replies on this one... as on some others... why is this?

i sometimes do a search for all my posts and that's how i saw the replies... but this happens only once a week or so, so sorry for my late reaction....

grtz


and i'll keep in mind to be more detailed about my goal!

Jinx:

Quote:

---

If you realy want to modify services you should go for an open source platform and change some source and recompile the service

---

That does not:

1. Solve the question of how to modify Windows services
2. Prove that an open source platform can do something windows can not.

The facts:

1. Windows CAN alter services, just like an open source platform, and just as easily.
2. The question has been answered, solved, and expanded upon.
3. Because of one and two, there is NO reason to switch OSes. Any OS can accomplish the same goal in the end, even if it uses different routes.

Quote:

---

as with your previous thread... on Windows you don't modify any services..
you just configure what was given by the grace of Microsoft (config pannel etc)..

---

I trust the registry editing tool, the control panel, manual configuration files, resource checking, memory checking, and logs in Windows as much as I trust that the simple configuration files in *nix to show COMPLETE documentation on each setting, feature, and configuration option. Both have risks, but it isn't how you whine about it, it is how you come to master those tools to make the most and best out of either situation.

so if ur admin why aren't you just stopn the service?
if you want to get other processes still workin even if they'd been killed ,
try firedaemon (plz google yourself)

instsrv / srvany won't help ,
it's just a startup as service.
you may stop the service and the process will stay

i already stopped the service, but i wanted to remove it manually... just to know how it works...

but i'll check firedeamon, maybe it's something usefull....
thanks

How to remove a service..

You'll MODIFIED your registry! Be SURE of what you'll do. I use to delete Oracle8 Client Service this way so I'll probably work on other service.

Check the Registry :
HKEY__LOCAL_MACHINE\SYSTEM\CONTROLSET001\Services
HKEY__LOCAL_MACHINE\SYSTEM\CONTROLSET002\Services
HKEY__LOCAL_MACHINE\SYSTEM\CONTROLSET003\Services
HKEY__LOCAL_MACHINE\SYSTEM\CONTROLSET004\Services

Basically, all the HKEY__LOCAL_MACHINE\SYSTEM\CONTROLSET***\Services. On my computer (Xp Pro, I have CONTROLSET001 and CONTROLSET003 but I saw some computer have 001 and 002)

Those keys created service. You'll need to research that key created that service but this should be a good start for you. You need to delete the key on all Controlset*** for it to work.

thanks, i'll go test it right away!