I am working on Lab11-03 in "Practical Malware Analysis" book.
The malware I am analyzing trojanized the file cisvc.exe which is the indexing service in Windows XP.

After that the malware start the service by running the command net start cisvc.
I put a breakpoint before it starts the service:
enter image description here

I want to debug the service (cisvc.exe).
I opened it in another instance of OllyDbg but I received an exception:
enter image description here

There is an option to attach processes but the serivce it currently stopped.
I need some way to put a breakpoint in the very beginning of it.

Any idea how can I do it ?

1 Answer 1


I solved it by using updated version of OllyDbg => OllyDbg 2.01

I also found another reference that provides another way to solve such problem in the future:
Debugging malware that will only run as a service

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.