When is a deleted service not deleted?

When is a deleted service not deleted?

Post by Stefan Kuh » Sun, 15 Jun 2008 00:11:53


Hello everyone,

we currently have a big problem with a service of ours that doesn't get
deleted properly. We use the DeleteService API (what else?) and it
succeeds. Most of the time, handles are still open to that service so it
is marked for deletion. So far, so good. However, on roughly 30% of the
client computers of one of our customers, the service shows up again
after *reboot*, which I think should be impossible.

Is there any known bug with DeleteService returning with success but the
service still existent after a reboot? Platform is XP x86 SP2 with most
probably all current patches applied.

I know that our call to the DeleteService API succeeded because our log
files say so unanimously. I know it is still there after a reboot
because subsequent installs of the service fail with
ERROR_SERVICE_EXISTS and the service's registry key in
HKLM\System\CurrentControlSet\Services still exists after reboot.


Any ideas how this can happen?

--
S
 
 
 

When is a deleted service not deleted?

Post by Volodymyr » Sun, 15 Jun 2008 00:28:22

DeleteService(...) should do the job. However, if you have buggy MSI which
recovers files it can *** up the situation. One of my collegue is fighting
against simular problem: the services actually cannot be deleted, because on
next reboot the MSI restores it. Also, the MSI cannot be deleted, because it
re-appears in "add remove programs" after reboot even if you delete it.

--
V.
This posting is provided "AS IS" with no warranties, and confers no
rights.

 
 
 

When is a deleted service not deleted?

Post by Stefan Kuh » Sun, 15 Jun 2008 00:29:54

Hi Volodymyr,



There is no MSI involved in our problem. It is a "temporary" service
that our software creates and deletes again. However, as we see, it is
not as temporary as it should be...

--
Stefan
 
 
 

When is a deleted service not deleted?

Post by Phil Wilso » Sun, 15 Jun 2008 03:31:30

The only time I've seen thi kind of behavior is when there are handles to
the service that are still open (or leaked) so that the service can't be
completely deleted. These usually cause the service to go into Disabled
state, IIRC, so it can't actually run. So I can only suggest that you check
for in-use handles. One issue I've seen is in .NET code with the
ServiceController class, where the code was keeping an instance of it (and
its wrapped service handle) alive. Dispose() releases the wrapped handle.

--
Phil Wilson
Definitive Guide to Windows Installer
http://www.yqcomputer.com/
 
 
 

When is a deleted service not deleted?

Post by » Sun, 15 Jun 2008 06:38:18

Hi Stefan,

the only Situation i faced when a service wont be deleted
was the case when there where still handles open to it. So
the Documentation tells the same:

"The DeleteService function marks a service for deletion from the service
control manager database. The database entry is not removed until all open
handles to the service have been closed by calls to the CloseServiceHandle
function, and the service is not running. A running service is stopped by a
call to the ControlService function with the SERVICE_CONTROL_STOP control
code. If the service cannot be stopped, the database entry is removed when
the system is restarted.The service control manager deletes the service by
deleting the service key and its subkeys from the registry."

You can try to search for handles to the service with Process Explorer or
similar tool that gets open handles to your service executable, if it runs
as
Win32 self hosting service.

Regards

Kerem


--
-----------------------
Beste Gr黶se / Best regards / Votre bien devoue
Kerem G黰r黭c? Microsoft Live Space: http://www.yqcomputer.com/
Latest Open-Source Projects: http://www.yqcomputer.com/
-----------------------
"This reply is provided as is, without warranty express or implied."
"Stefan Kuhr" < XXXX@XXXXX.COM > schrieb im Newsbeitrag
 
 
 

When is a deleted service not deleted?

Post by Stefan Kuh » Sun, 15 Jun 2008 16:25:04

Hi Phil,



Yes, I am aware of the service going into the "marked for deletion"
state. I observed that if the service is marked for deletion, a special
DWORD registry value is created under the service's key in
HKLM\System\CurrentControlSet\Services\MyServiceName, something like
"MarkDelete" or similar in name. I assume that the SCM uses this value
to delete services after the reboot. At least in my tests, if the
service is marked for deletion, even after a simulated power outage, the
service was gone after a reboot. In the normal case where the computer
runs and finally the last handle is closed, I observed that the service
vanishes and its corresponding registry key is removed immediately after
the last handle is closed.

So I still don't understand what makes the service reappear in the
active services database after reboot.

--
Stefan
 
 
 

When is a deleted service not deleted?

Post by Volodymyr » Tue, 17 Jun 2008 16:40:20

Any special software installed on clients machines? The one, which could
block deletion of registry key? On your place I would ask customer to run a
test utility (written by you) which will collect logs and do a test removal
of some reg keys.

--
V.
This posting is provided "AS IS" with no warranties, and confers no
rights.
 
 
 

When is a deleted service not deleted?

Post by suhredaya » Tue, 17 Jun 2008 18:53:46

Was the Services.msc opened with the service in question selected. May be
this can leave an handle to the service opened. I remember having seen this
in Windows 2000 however not sure about XP.
 
 
 

When is a deleted service not deleted?

Post by Stefan Kuh » Tue, 17 Jun 2008 19:20:51

Hello suhredayan,



Yes I have seen this as well. The services snap-in for MMC frequently
leads to the situation of handles still open to a service and when
deleting the service, this leads to the "marked for deletion" state.
However, this still doesn't explain why for this customer the service
isn't deleted after the last handle closes and why it is still there
even after reboot.

--
Stefan
 
 
 

When is a deleted service not deleted?

Post by Pavel A » Tue, 17 Jun 2008 21:14:44

You can try to workaround this by deleting the service in two steps.
a. Set startup to disabled
b. Delete

Even if the service will persist after reboot, it *should* be disabled.

If this won't help - delete the reg. key manually, after delete service
returned success.

Regards,
--PA
 
 
 

When is a deleted service not deleted?

Post by Stefan Kuh » Wed, 18 Jun 2008 05:52:17

Hi Volodymyr,



We had an engineer at the site who removed via a batch file the service
key remotely from the the affected computers and restarted them. After
that, everything worked smoothly again. However, since all of that is
part of our automatic client update process, which obviously is not so
automatic anymore because of this zombie service, I wonder how often I
will encounter this again. I will have to release a patch that will
tackle this problem from a different angle and that sometimes cannot be
applied automatically because the patch that allows this patch to be
applied successfully, is missing.... Classical chicken-and-egg problem.

--
Stefan
 
 
 

When is a deleted service not deleted?

Post by Stefan Kuh » Wed, 18 Jun 2008 05:57:09

Hi Pavel,



Good idea. But not helpful in my case because I made the mistake to bail
out from service installation under every condition, even if the service
already exists, which wouldn't have hurt in this case. My defense
strategy is to delete the service every time a companion service starts
up and ship this as part of a product patch and also to continue if
service installation fails if the service is already installed. I hope
this will help.


--
Stefan