how to inject system process SERVICES.EXE as system restart?

[Vic.Dong]

Hello. all:

I want to inject a DLL of my custome hook dll to system serice SERVICES.EXE
application as every OS restart?

B.R.

VIC

 

[William DePalo [MVP VC++]]

I want to inject a DLL of my custome hook dll to system serice
SERVICES.EXE application as every OS restart?

Why not take a step back an explain what you want to do and not how to do
it?

Regards,
Will

 

[Scherbina Vladimir]

Why exactly to services.exe? Try documented approach - winlogon notification
packages - it will allow you to create your own dll that will handle
winlogon.exe events and process them in the address space of winlogon
process.

 

[Vic.Dong]

Hello:

Sorry.
I make a application that is about some file data security. I want to delete
my some important temp file as OS restart.
If I put it to registry "HKEY...\RUN" setting, but it maybe be deleted by
someone.


B.R.

VIC

 

[William DePalo [MVP VC++]]

I make a application that is about some file data security. I want to
delete my some important temp file as OS restart.
If I put it to registry "HKEY...\RUN" setting, but it maybe be deleted by
someone.

Can you open the file exclusive access and with the
FILE_FLAG_DELETE_ON_CLOSE option set. By the way, it is not enough to delete
the file. You should overwrite its sensitive data. There are published
algorithms and standards for this kind of thing, btw.

Regards,
Will

 

[Tim Roberts]

Why exactly to services.exe? Try documented approach - winlogon notification
packages - it will allow you to create your own dll that will handle
winlogon.exe events and process them in the address space of winlogon
process.

The rumor is that this ability will be removed from Vista, because almost
the only users of winlogon add-ins have been spyware.

 

[Scherbina Vladimir]

Yes, I remember this rumor. I hear it each time when the talk about winlogon
notification packages begin. Thanks for reminding once again.