Is it possible to edit svhost.exe?

Discussion in 'Windows 10' started by David34, Sep 30, 2015.

  1. David34

    David34 MDL Member

    Sep 6, 2015
    211
    20
    10
    There are packages running under svhost.exe I know I can disable them or even some remove with the help of Install_wim_tweak but even when I remove package the services still remain in services and when I go to properties is says svhost.exe. That's why was wondering if it would be possible to edit and clean up svhost.exe?
     
  2. Mr.X

    Mr.X MDL Guru

    Jul 14, 2013
    5,857
    13,401
    180
    It could be successfully edited if only svhost.exe could exist... :eek::tea:
     
  3. Michaela Joy

    Michaela Joy MDL Crazy Lady

    Jul 26, 2012
    3,621
    3,914
    120
    #3 Michaela Joy, Sep 30, 2015
    Last edited: Sep 30, 2015
    @David34: Only by reverse Engineering it, producing an exact source file, editing it and recompiling. Unfortunately, the file signature difference would trigger all kinds of alarms in malware scanners.

    P.S.: It's called 'svchost.exe' :)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. David34

    David34 MDL Member

    Sep 6, 2015
    211
    20
    10
    Thanks MichaelaJoy that's what I was actually thinking as it's exe I could copy it I could decompile it and play with it a bit. And I don't use any antiviruses scanners etc. Will Google a bit about decompiling exe
     
  5. David34

    David34 MDL Member

    Sep 6, 2015
    211
    20
    10
    Mr.X svchost.exe are you happy now? ;)
     
  6. Michaela Joy

    Michaela Joy MDL Crazy Lady

    Jul 26, 2012
    3,621
    3,914
    120
    @David34: All I can say is "have at it". The learning experience will be amazing for You. :hug2:

    (I was at the exact same place over 30 years ago. ;) )
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. PaulDesmond

    PaulDesmond MDL Magnet

    Aug 6, 2009
    6,993
    7,140
    240
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. David34

    David34 MDL Member

    Sep 6, 2015
    211
    20
    10
    just found that i dont need to edit svchost.exe as all svchost.exe does is to call services to start and run at boot up or whenever needed

    heres registry key where i can remove from svchost.exe calling services i dont want it to run under svchost.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost

    i removed those
    AJRouter
    WebClient
    RemoteRegistry
    uploadmgr
    dmwappushservice
    XblAuthManager
    RetailDemo
    OneSyncSvc

    and now less errors in event viewer ;)

    anoter usefull command tasklist /SVC /FI "IMAGENAME eq svchost.exe" to list services running under svchost
     
  9. chris34

    chris34 MDL Member

    Oct 28, 2009
    188
    49
    10
  10. dmex

    dmex MDL Junior Member

    Apr 20, 2011
    92
    102
    0
    Have you tried Process Hacker (from Sourceforge) and just double-click the svchost.exe process and select the Services tab to view running services in each svhost? There's also another Services tab on the main window for managing all services :)
     
  11. David34

    David34 MDL Member

    Sep 6, 2015
    211
    20
    10
    @dmex thanks will take look at it ;)
     
  12. chris34

    chris34 MDL Member

    Oct 28, 2009
    188
    49
    10
    the task manager does the same. Go to the detail tab, select a svchost process, right click and click on "Go to service(s)"
     
  13. David34

    David34 MDL Member

    Sep 6, 2015
    211
    20
    10
    @chris I was rather talking about the none existing services svchost.exe was calling for like for example aljoyn I think best is to as I said earlier remove those things from svchost.exe registry.
     
  14. SOCRATE_MMXII

    SOCRATE_MMXII MDL Expert

    Jan 25, 2012
    1,034
    315
    60
    I suspected you just turned 31... :D:worthy:
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  15. David34

    David34 MDL Member

    Sep 6, 2015
    211
    20
    10
    31 year old female on mdl probably very pretty cute and single, and from the other side all those single males around.
     
  16. SOCRATE_MMXII

    SOCRATE_MMXII MDL Expert

    Jan 25, 2012
    1,034
    315
    60
    :eek: :laie: :laie: :laie:
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  17. totouan

    totouan MDL Novice

    Aug 12, 2009
    13
    6
    0
    A program to see what all those svchost.exe are running:


    sorry, i can't post links...
     
  18. endbase

    endbase MDL Guru

    Aug 12, 2012
    3,789
    1,102
    120
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  19. chris34

    chris34 MDL Member

    Oct 28, 2009
    188
    49
    10
    Those "hidden" services can be queries/stopped/disabled/deleted using the sc query <service name> to query or sc stop <service name> to stop it or sc control <service name> start=disabled to disable it or sc delete <service name> to delete it.

    I'm not sure what you try to achieve by editing HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost but you're more than likely doing something wrong if it's to delete or disable a service. You're just removing from what group they're part of, and possibly some security features. I hope you made a restore point before you started editing your registry.
     
  20. David34

    David34 MDL Member

    Sep 6, 2015
    211
    20
    10
    @chris HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost that's list of services svchost.exe call whenever needed whatever you remove from there SvcHost won't be looking for it anymore. If you remove aljoyn package from your windows, because that service runs under svchost.exe, svchost.exe will still be asking about it. And event viewer will show error. That's an example there's many services running under svhost.exe and even if you remove package those services are still in svchost.exe registry means svchost.exe will keep asking for it unless you remove it fromHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost