How to 'track' svchost services properly that are reset by Windows after a while.

[ghost]

Fixed by amazing tnodir in Fort v3.9.7+

[tnodir]

I'm going to add monitoring of services in user-mode part of Fort, using NotifyServiceStatusChangeA() or SubscribeServiceChangeNotifications().

Current tracking mechanism will be left as fallback and in most cases not needed.

[tnodir]

DoSvc will get reset to defaults after a while

Is the "Type" value still equal to "16" (Own Process) after reset?

[ghost]

That's the original value is 16, the only thing different is Fort adding -s DoSvc to the path of the service, and that's what gets reset after a while, even without the computer being shutdown or restarted, svchost will show in the log.

[tnodir]

@Emi-TheDhamphirInLoveUnderTheFrozenStar Please check the v3.9.7-test1.

It should not require manual tracking of DoSvc (and other SvcHost services with "Type" = "16" (Own Process)) now.

[ghost]

Cool! thanks.
I am testing now. Putting everything back the way it was and waiting to see if something weird happens, it takes days for it to show the problems.
In fact, I haven't shut down my computer in days as usual, not even a restart or anything, and when I was removing the DoSVC and putting the original one and untracking them, the -s DoSvc already wasn't even there!, my solution only made changes last longer, but the problem still there.

[ghost]

It works great.
No problems so far that I could notice in my computer and the other one that gets suspended, shutdown and hibernated often.

👍👍

[bluelayer]

Not really opening this issue, just leaving a big warning about what services you put under track, I don't know how many or what services I made trackable, but just ended in endless boot(!), I just reset win 11 installation to fix it. So, take care!

[ghost]

Well, Tnodir fixed it so you don't need to 'make trackable' services anymore.
About the endless loop, I don't know how this can cause an issue, all it does it adds few values And it shouldn't cause endless loops, because all it did was to change few meaningless values, in the services.

And backup the values in DWORD values like _Fort_ImagePath %SystemRoot%\System32\svchost.exe -k NetworkService -p _Fort_Type but usually most services have already 0x00000010or decimal of 16, so nothing was changed there and_FortTrackFlags with a value of 3` which was the one that told Fort that the key was made trackable.

Most of the processes just got the -s ServiceName added and done, like in this case for DoSvc was just adding %SystemRoot%\System32\svchost.exe -k NetworkService -p -s DoSvc

That's all. nothing that should cause endless loop.

What you had to understand is Win10 and win11 already split most svchost, so I don't know why you were making so many services trackable, when it wasn't needed, the more RAM you have the more services that will get split.

But [In the past] What you had to do, to track only the ones that weren't getting split by Windows, was to go to the Statistics Blocked log, and find Host Process for Windows Services or svchost.exe, the logger will display the PID (Proc. ID) of the program or service being blocked, so all you had to do was to go to Task manager which has a nice filtering bar in Win11, or systeminformer which is better task manager, or even to the Fort's service window, and look for the same PID and make it trackable.
In my case, it was only DiagTrack, but I never tracked it because I just blocked it with autoruns and then DoSvc which had this reset problem, and InstallService which is what Windows Store uses and it was always tracked okay by Fort's old method. Everything else, any other svchost was split by Win11. The split is automatic, BTW, it depends on your memory, by default the value will split most of the processes but it can be stopped (for whatever reason) by modifying registry keys.
Either globally by modifying the SvcHostSplitThresholdInKB Value, or by process by adding SvcHostSplitDisable DWORD in the process you don't want it to get split.

But anyway, Tnodir fixed it and the make trackable is only there now for backwards compatibility. but people should revert changes when the new update arrives and it will be better since it will work without doing any work. Since you reset, windows 11, just install the latest pre-release and you won't have to do anything.
If you didn't see the little wrench tool icon next to the service, that means maybe an update or Windows put the service back to defaults (like happens in upgrades) and then it wasn't Fort causing the endless loop, I mean, the only thing that could cause loop for crashing, I would say is the Driver used by Fort, but then you would see the bluescreen and all that, so I doubt it was Fort.

BTW you don't need to reset Windows for any registry change ever, well, you could, but it is kind of useless, first, the best method to revert changes back is to do In Place Upgrades so you keep files and programs and services get reset to default and all that.

But you can use the Windows Installation in a USB or whatever, and then access the registry that way and undo the changes you made like Fort ones in case you believe it was Fort.
When you go to the Windows Installation, then you press Shift+10 to bring the CMD. then you type REGEDIT like you would in windows and done.
You just need to load the HIVE which should be in many places, depending if it is the USER or MACHINE keys.

You can find the HIVE list in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist so it is pretty easy to know wher ethey are.
Basically your User has the ntuser.dat

and the others which are machine wide are in %windir%\system32\config\

And then the other that might be useful is usrClass.dat in %localappdata%\Microsoft\Windows\

Messing and recovering Windows is pretty easy, people think Windows is so locked down, but to me it is pretty open, people hate Registry, but I love how easy it is to deal with it.
So just a little guide how to deal with that kind of stuff, it if was something about your registry ntuser.dat being corrupted you could have easily got the one from Default and well, which would obviously reset some stuff, but faster than resetting Windows, In Place Upgrades is what I recommend to fix most issues and keeping files and settings and 99.9% of everything untouched. 👍

[bluelayer]

Well... that is an explanation! Thanks!

I didn't fully understand that I didn't have to make some services trackable and I played with some, sometimes I just lost access to explorer, but that time the system really stopped booting! I really know the problem come from the "trackable" area because I made some changes to the service list, and got funny results after that, each time I made different services trackable, I got different behavior in windows (things stopped working).

I know the regedit can be edited from boot tools, but I didn't know what to revert etc, for me was easier to just reset it, 10 minutes and all was clean, I don't have much stuff.