locked
Mysterious "Service1" RRS feed

  • Question

  • I saw my Application Log contains record said:

    Service started successfully.

    Source: Service1

    Event ID:0

    Keywords:classic

    And I check the services under "Service and Applications", there is no service that has the name "Service1".Open "RegEdit.exe", I found HKLM\SYSTEM\ControlSet001\services\eventlog\application\Service1 node,

    It has this value:

    EventMessageFile=C:\Windows\Microsoft.NET\Framework\v4.0.30319\EventLogMessages.dll

    Is there any way to find which exe that is corresponding to "Service1"?

    Saturday, December 6, 2014 1:16 PM

Answers

  • 1.  Check services.msc. Find Service1, right-click on it, choose properties, and then look at the Path to Executable.

    2.  Open a command prompt. Run the command sc qc Service1. It will be in the BINARY_PATH_NAME field.

    3.  Programmatically, use OpenSCManager to do the service controller, OpenService to open the service, QueryServiceConfig to get the service configuration, look at the lpBinaryPathName to get the executable path, and then use CloseSCHandle to close both the handles that were opened.

    • Marked as answer by Marvin_Guo Tuesday, December 16, 2014 2:57 AM
    Saturday, December 6, 2014 1:40 PM

All replies

  • 1.  Check services.msc. Find Service1, right-click on it, choose properties, and then look at the Path to Executable.

    2.  Open a command prompt. Run the command sc qc Service1. It will be in the BINARY_PATH_NAME field.

    3.  Programmatically, use OpenSCManager to do the service controller, OpenService to open the service, QueryServiceConfig to get the service configuration, look at the lpBinaryPathName to get the executable path, and then use CloseSCHandle to close both the handles that were opened.

    • Marked as answer by Marvin_Guo Tuesday, December 16, 2014 2:57 AM
    Saturday, December 6, 2014 1:40 PM
  • it is the default event source before your service changes it. If you don't have log writing code with that source, change ServiceBase.AutoLog (you can do this in the service designer or in code) to turn autologging off.


    Visual C++ MVP

    Saturday, December 6, 2014 3:15 PM