For firewall purposes I made a copy of svchost.exe
called mysvchost.exe
and made some services run on mysvchost.exe
by editing their ImagePath
in the registry (under HKLM\SYSTEM\CurrentControlSet\Services
). However, on reboot I noticed that the settings have reverted back to the old svchost.exe
. How do I make the changed ImagePath
stick through the reboot?
svchost.exe
inSystem32
by its exact copy (and not even replacing, just keeping the copy under the namemysvchost
alongside it). I don't see svchost in WinSXS. Regarding the viruses, Windows can just check thatmysvchost
has exactly the same hash as the original svchost and is digitally signed by Microsoft.system32
. Also my copy of it,mysvchost.exe
is still there as well, not deleted by Windows Defender or whatever. The only thing I changed wasImagePath
in the registry for some services and those registry edits got reverted by Windows.