Can we recover a service marked for deletion?

NTDEV
1

ERROR_SERVICE_MARKED_FOR_DELETE
1072 (0x430)
The specified service has been marked for deletion.

Assume 2 apps are accessing a single driver. App1 loads the driver and keeps it busy. App2 comes along gets a driver handle uses it and then tries to unload. But since App1 us still running the service gets marked for deletion.

Now App1 is still going on and App2 wants to access the driver again. That is when CreateService() fails with the above error.
Question, can I unmark the service and use it again? Or in other words how can I resolve this? Or is it that I have to wait for the deletion of the service to happen before I can create a new one?
thanks

2

xxxxx@gmail.com wrote:

ERROR_SERVICE_MARKED_FOR_DELETE
1072 (0x430)
The specified service has been marked for deletion.

Assume 2 apps are accessing a single driver. App1 loads the driver and keeps it busy. App2 comes along gets a driver handle uses it and then tries to unload. But since App1 us still running the service gets marked for deletion.

Now App1 is still going on and App2 wants to access the driver again. That is when CreateService() fails with the above error.
Question, can I unmark the service and use it again? Or in other words how can I resolve this? Or is it that I have to wait for the deletion of the service to happen before I can create a new one?

If the need is that dynamic, then why worry about deleting it at all?
You’re talking about six registry entries. Just leave it in there
forever and ever.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

Please assume we don’t have a choice in this matter and we have to mark App2 for deletion, later on can we unmark the service and reuse it? If there is no way this can be done that is also fine. Just as a academic curiosity I wanted to know the solution if there is one. Thanks

4

You keep mixing you metaphors. You refer to a driver and a service in the
same sentence with the inference that both are one. Then in your next post
you are marking app 2 for deletion and then unmark the service and reuse it.
Your solution?? Easy, first know what you are dealing with. Is it an
application? Is it a service? Or is it a driver? Kindly make up your mind
exactly WHAT you are trying to do. Services and drivers do cohabit the same
registry space but they are NOT the same since drivers are in the kernel and
services live happily in Never-Never Land.

Given the preponderances of your references are service/driver how in the
bloody hell do you expect to “mark” a driver/service, you decide which, for
deletion? For either one you CAN set Start to Enabled or Disabled in it’s
registry entry. Or you can simply delete the registry entry. Again your
call, but I have, in 20 years of doing this never heard of “marking a
driver/service”, again you make the choice, for deletion.

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.net

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Friday, May 14, 2010 7:42 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Can we recover a service marked for deletion?

Please assume we don’t have a choice in this matter and we have to mark App2
for deletion, later on can we unmark the service and reuse it? If there is
no way this can be done that is also fine. Just as a academic curiosity I
wanted to know the solution if there is one. Thanks

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus signature
database 5118 (20100516) __________

The message was checked by ESET Smart Security.

http://www.eset.com

__________ Information from ESET Smart Security, version of virus signature
database 5118 (20100516) __________

The message was checked by ESET Smart Security.

http://www.eset.com