0

I am working on Lab11-03 in "Practical Malware Analysis" book.
The malware I am analyzing trojanized the file cisvc.exe which is the indexing service in Windows XP.

After that the malware start the service by running the command net start cisvc.
I put a breakpoint before it starts the service:
enter image description here

I want to debug the service (cisvc.exe).
I opened it in another instance of OllyDbg but I received an exception:
enter image description here

There is an option to attach processes but the serivce it currently stopped.
I need some way to put a breakpoint in the very beginning of it.

Any idea how can I do it ?

E235
  • 583
  • 8
  • 24

1 Answers1

0

I solved it by using updated version of OllyDbg => OllyDbg 2.01

I also found another reference that provides another way to solve such problem in the future:
Debugging malware that will only run as a service

E235
  • 583
  • 8
  • 24