Tricks with SVCHOST.EXE


Well, if you read what I wrote yesterday, you read that I put a service all
by itself in a separate SVCHOST.EXE proces.

Windows XP SP1

Service of interest:  WebClnt

Binary of interest:  WEBCLNT.DLL

Problem:  Hangs on startup.

If you run a CMD.EXE prompt (command prompt) and type:   TASKLIST
/SVC you’ll see an output like this:

F:\Documents and Settings\danvdw>tasklist /SVC

Image Name                  
PID Services
========================= ====== =============================================
System Idle Process           
0          N/A
System                                
4          N/A
services.exe                       
416       Eventlog, PlugPlay
lsass.exe                            
428        Netlogon, PolicyAgent, ProtectedStorage, SamSs
svchost.exe                        
636        RpcSs
svchost.exe                        
660        AudioSrv, BITS, CryptSvc, Dhcp, dmserver, ERSvc,
EventSystem,    
                                                          
lanmanserver, lanmanworkstation, Messenger, Netman, Nla,
                                                          
Schedule, seclogon, SENS, ShellHWDetection,
                                                          
srservice, TermService, Themes, uploadmgr,
                                                           W32Time,
winmgmt, wuauserv, WZCSVC
svchost.exe                        
772         Dnscache
svchost.exe                        
796         LmHosts, RemoteRegistry, SSDPSRV,
WebClient
spoolsv.exe                        
876         Spooler
inetinfo.exe                    
  1084         IISADMIN, SMTPSVC,
W3SVC

<Cut Short to Eliminate Boredom>

I’m interested in the one that has WebClient in it.  I see it’s Process
ID (PID) 796.

That’s nice to know, but not really want I want.  What I want to see
is WebClient all alone in an SVCHOST.EXE process.  Exactly like DNSCACHE is doing. 
Why can’t my webclient do that too?  I think it can!

If you read Raymond Chen’s blog, you’ll see he refers to Q314056 about SVCHOST.EXE.

Now, I mucked with the registry on this system.  If you muck with your
registry, make sure you make backups of the stuff before you fool with it.  I
will not be held responsible for anything you do to your registry even if it’s something
I write about.

Are we clear on that?

HKLM\Software\Microsoft\WindowsNT\CurrentVersion\svchost

Right there, under svchost, are keys and values.  I’m interested in the
*value* that is Localservice and I see it’s a REG_MULTI_SZ and is:

Alerter
WebClient
LmHosts
RemoteRegistry
upnphost
SSDPSRV

There’s my WebClient.  What if I just highlight it and take it out of
there with a DEL button press?  That works.

Okay.  But, I want it in it’s own SVCHOST.EXE.  Can I do that? 
Well, I think I can if I hack some.  So, let’s hack:

I notice that the *keys* are similar to these values.  Let’s do a new
key and value.  I’ll call it WebClntSvc.

So, I add a Key and a Value called WebClntSvc.  I could have called it
anything, like AnyNameAnything, but I called it WebClntSvc.

So, I make a REG_MULTI_SZ *value* entry called WebClntSvc and add:  WebClient.

I also make a Value entry and call it WebClntSvc.  What to add there? 
Heck, I just copied what was in the Localservice key. That key had:

AuthenticationCapabilities, REG_DWORD, 0x2000 and CoInitializeSecurityParam,
REG_DWORD, 0x1

So, I added them both.  Is that it?

No, because I see that HKLM\System\CurrentControlSet\Services is of interest
to me, based on the KB article.

If I look at HKLM\System\CurrentControlSet\Services\WebClient, I see an ImagePath
value that’s a REG_SZ.  I think I want to edit that and change it from:

%SystemRoot%\System32\svchost.exe -k LocalService

to

%SystemRoot%\System32\svchost.exe -k WebClntSvc

We can confirm this works by checking the interface.  That’s right-click
on My Computer, Select Manage, then go into the Services, find WebClient and open
it up.

Make sure the “Path to Executable” was changed.  Mine would
say:

F:\WINDOWS\System32\svchost.exe -k WebClntSvc.

F: is my system drive here.  Don’t ask me why.  You don’t want to
know.

That would make sense, right?  Does to me.  Then, I reboot. 
Now, I have a separate instance of SVCHOST.EXE running with WebClient in it.

I do.

Now, to debug it is simple.  Right, I just attach my debugger to the
process that exists as SVCHOST.EXE with the one and only service in it that’s WebClient.

However, I don’t want to debug it as it is, I want to debug it as it starts. 
Hmm… How do to that?

Well, it’s tricky and I have one trick up my sleeve to use that is this: 
Copy SVCHOST.EXE to SVCHOST1.EXE in the same place as SVCHOST.EXE and use SVCHOST1.EXE
in my ImageFileExecutionOptions registry setting and use SVCHOST1.EXE in the registry
location for the service for the executable.

Now, when I check the interface, my path says:

F:\WINDOWS\System32\svchost1.exe -k WebClntSvc.

There is a problem here.  The default SVCHOST.EXE has a timeout for any
service.  If it doesn’t start in X seconds, you get a nifty dialog telling you
it didn’t start, blah blah blah.

You don’t get the dialog for the failure on startup, but it’s not running
regarless.

I’m guessing there is a way around this, but I don’t know what yet…..

Comments (8)

  1. Mike Dimmick says:

    I see above that you’ve fixed this already, but IIRC John Robbins’ book "Debugging Applications for Microsoft .NET and Microsoft Windows" details how to debug a service on startup. IIRC, it involves setting the ImageFileOptions key in the registry.

  2. seven11 says:

    HI,

    taht was a very nice articel.

    by the way what is this webclient doing?

    if you already debugged that thing feel free to mail me…

    seven11@ny.com

  3. Alex says:

    Searching for Svchost.exe worms and found your site: It’s seems to be easy to camouflage a (worm) service as svchost.exe process? (See http://www.neuber.com/taskmanager/process/svchost.exe.html)

  4. Enegue Yellav says:

    I’m glad this is still up, still valuable, even in your absense!

    EV

  5. udayakumar says:

    in our system there was some trouble that creat some problem we want some help from facilities provoiders

  6. mohit says:

    error:—

    errors generated by svchost.exe & closed by windows

    it cause inactive paste function

    none of content shown in my network places

  7. gurcan says:

    dear sir

    whwnever I run my my computer connected to internet, a message appears noticing that "svchost.exe produced some errors and will be closed" and after this some links do not work. What can I do

    thanks

  8. rosanne says:

    Please help

    I am having a huge problem. Every time I am connected to the internet I get a message "SVCHOST.EXE has encoutered a problem and needs to close" I do send the error report and it keeps coming back, it is annoying. Also, some links does not work. Please, is there anything that can be done

    Thanks