Changing NT-Style Services and the Registry

[Itomeshi]

I'm currently writing a simple, unmanaged, VC++ 2003 unmanaged app
without .NET libraries (for project specific reasons).

My current stumbling block is how to delete a service. The only method
I know of by hand is to go into the registry, navigate to
HKLM/System/CurrentControlSet/Services, and then look for the offending
virus that registers itself as the service "Network Client" with an
executable nwclnt.exe in the system32 directory. It is under a "nwclnt"
key. After this step, I can successfully delete the executable and
finish repairing Windows Update.

Is there any easier way to kill a service? I need to stop it and then
delete those keys. Any other method?

If not, what's the easiest method to check the registry for that and
eliminate it if it exists? I've toyed with the idea of outputting a
..reg file and running that through the shell command, but I'd like to
avoid that and do this through native / API code.

Example code would be preferred - I'm pretty new to C++, so any
information is helpful.

Thanks in advance,
Shawn McNaughton

P.S. If someone submits a more direct method to kill the service, help
with the registry access code is still appriciated - I will be using it
for other parts of this project.

--
Itomeshi
------------------------------------------------------------------------
Posted via http://www.codecomments.com
------------------------------------------------------------------------

[Ronald Laeremans [MSFT]]

Itomeshi wrote:

I'm currently writing a simple, unmanaged, VC++ 2003 unmanaged app
without .NET libraries (for project specific reasons).

My current stumbling block is how to delete a service. The only method
I know of by hand is to go into the registry, navigate to
HKLM/System/CurrentControlSet/Services, and then look for the offending
virus that registers itself as the service "Network Client" with an
executable nwclnt.exe in the system32 directory. It is under a "nwclnt"
key. After this step, I can successfully delete the executable and
finish repairing Windows Update.

Is there any easier way to kill a service? I need to stop it and then
delete those keys. Any other method?

http://msdn.microsoft.com/library/de..._functions.asp

is the entry point to the documentation of the list of functions you
need. There is also sample code to be found in some of the topics
refererenced from there.

Ronald Laeremans
Visual C++ team