Deny Termination

[oleg]

Is anybody aware of way denying termination of an application or a service ?

[mikeytown2]

Run it as a different user, that has given me limited success.

Also look at this thread

http://www.autoitscript.com/forum/index.ph...topic=11710&hl=

What are you going to use this for?

[oleg]

I want to create a process / service that will monitor an application and will restart it if terminated ... So actually i want to disallow all users to terminate it .

The link you provided dosent drive me anywhere

Edited March 2, 2006 by oleg

[oleg]

So is there no way ?

[SmOke_N]

I want to create a process / service that will monitor an application and will restart it if terminated ... So actually i want to disallow all users to terminate it .

The link you provided dosent drive me anywhere

Some of your questions seem so un-ethical at times...

[mikeytown2]

What environment are you doing this in?

I used the RunAsSet to run the script at login (using command switches), that the current user could not kill because they where not admin.

Some of your questions seem so un-ethical at times...

@oleg

what exactly are you trying to do? why do you need to always have this program running?

[CyberSlug]

After quick google search: name your process csrss.exe, winlogon.exe, smss.exe or services.exe and task manager will refuse to kill it (other tools will still be able to kill it).

Of course there are always ways of terminating critical processes:

http://weblogs.asp.net/rosherove/archive/2.../21/218212.aspx

http://www.sysinternals.com/Utilities/ProcessExplorer.html

[oleg]

After quick google search: name your process csrss.exe, winlogon.exe, smss.exe or services.exe and task manager will refuse to kill it (other tools will still be able to kill it).

Of course there are always ways of terminating critical processes:

http://weblogs.asp.net/rosherove/archive/2.../21/218212.aspx

http://www.sysinternals.com/Utilities/ProcessExplorer.html

Thanks CyberSlug Even so its helps

But really guys isnt there a way to deny process termination , i dont care if it possible to kill the process with ntsd or other process management tools im sure only advanced users is aware of them but any average user wont .

[mikeytown2]

In my second post of this thread i gave you an idea on how to do it. look at the last post in that thread; it's by me. there's some VB script in there on how to hide the process.

Please answer me and SmOke_N's inquires about why you want to do this.

[oleg]

In my second post of this thread i gave you an idea on how to do it. look at the last post in that thread; it's by me. there's some VB script in there on how to hide the process.

Please answer me and SmOke_N's inquires about why you want to do this.

Dude im not writing a virus or some other malicious software

This is as i stated above is done to montior client / server application that we run actually because the application itself is reall easy to terminate so im looking into many ways how to protect it from that The application that i want to write will search for a certain exe and if its not running will restart it But i dont want to have the monitoring application to be exposed see ?

The link you gave indeed have some interisting info but how this can be done in autoit ?

Dll call user32 GetWindow ?

Edited March 3, 2006 by oleg

[mikeytown2]

Thats the part I'm not sure about... but here is a simple example where it hides the close from a cmd window. I got this off the forums from somewhere, i forgot. This should get you started. I don't know how to do what your asking, so if you get it working let me know.

#include <GUIConstants.au3>
AutoItSetOption("WinTitleMatchMode", 4)
$SC_CLOSE = 0xF060
Run(@ComSpec)
WinWait(@ComSpec)

; Get the handle
$handle = WinGetHandle("classname=ConsoleWindowClass", "")
If @error Then
    MsgBox(4096, "Error", "Could not find the correct window")
Else
    $dSysMenu = DllCall("User32.dll", "hwnd", "GetSystemMenu", "hwnd", $handle, "int", 0)
    $hSysMenu = $dSysMenu[0]
    DllCall("User32.dll", "int", "RemoveMenu", "hwnd", $hSysMenu, "int", $SC_CLOSE, "int", 0)
    DllCall("User32.dll", "int", "DrawMenuBar", "hwnd", $handle)
EndIf

Good Luck!

[oleg]

Thats the part I'm not sure about... but here is a simple example where it hides the close from a cmd window. I got this off the forums from somewhere, i forgot. This should get you started. I don't know how to do what your asking, so if you get it working let me know.

#include <GUIConstants.au3>
AutoItSetOption("WinTitleMatchMode", 4)
$SC_CLOSE = 0xF060
Run(@ComSpec)
WinWait(@ComSpec)

; Get the handle
$handle = WinGetHandle("classname=ConsoleWindowClass", "")
If @error Then
    MsgBox(4096, "Error", "Could not find the correct window")
Else
    $dSysMenu = DllCall("User32.dll", "hwnd", "GetSystemMenu", "hwnd", $handle, "int", 0)
    $hSysMenu = $dSysMenu[0]
    DllCall("User32.dll", "int", "RemoveMenu", "hwnd", $hSysMenu, "int", $SC_CLOSE, "int", 0)
    DllCall("User32.dll", "int", "DrawMenuBar", "hwnd", $handle)
EndIf

Good Luck!

Even if i wont figure it out CyberSlug method will do the job

Thanks guys