Process Monitor

[anixon]

Comments and improvements would be appreciated.

I thought that an INI file would avoid unnecessary changes to the code.

I guess that it should have also included the name of the program to be monitored.

; Program monitor on anyprogram.exe

;

; Check that INI File available

;

$file = FileOpen(@scriptdir&"\ypmonitor.ini", 0)

if $file = -1 then

MsgBox(0, "Processing Error", "Unable to open ypmonitor.ini")

exit

EndIf

; Read INI File Variables

;

$var8 = iniread(@scriptdir&"\ypmonitor.ini", "monitor", "countm", "60000")

$var9 = iniread(@scriptdir&"\ypmonitor.ini", "stealth", "mode", "0")

;Process stealth mode setting

;

if $var9() = 1 then

#NoTrayIcon

EndIf

;Monitor anyprogram for restart

;

While 1 = 1

$PID = ProcessExists("anyprogram.exe") ; Will return the PID or 0 if the process isn't found.

If $PID = 0 Then

Run ("c:\program files\program\anyprogram.exe")

endif

Sleep ($var8)

Wend

;

;End of script

[sheck]

Fixed it up a bit.

If Not FileExists(@ScriptDir & "\ypmonitor.ini") Then 
MsgBox(0, "Processing Error", "Unable to open ypmonitor.ini")
exit
EndIf

; Read INI File Variables
;
$var8 = iniread(@scriptdir&"\ypmonitor.ini", "monitor", "countm", "60000")
$var9 = iniread(@scriptdir&"\ypmonitor.ini", "stealth", "mode", "0")

;Process stealth mode setting
;
if $var9 = 1 then
#NoTrayIcon
EndIf

;Monitor anyprogram for restart
;
While 1
$PID = ProcessExists("anyprogram.exe"); Will return the PID or 0 if the process isn't found.
If $PID = 0 Then
Run ("c:\program files\program\anyprogram.exe")
endif
Sleep ($var8)
Wend

[Fossil Rock]

Sounds malicious to me ..... hummmmm

[anixon]

Sounds malicious to me ..... hummmmm

Its part of a system I am working on that manages a home security surveillance system. If an unauthorised person gets access and attempts to close the surveillance software then this monitor will restart it and keep it running and recording video of the intruders.

[anixon]

Fixed it up a bit.

If Not FileExists(@ScriptDir & "\ypmonitor.ini") Then 
MsgBox(0, "Processing Error", "Unable to open ypmonitor.ini")
exit
EndIf

; Read INI File Variables
;
$var8 = iniread(@scriptdir&"\ypmonitor.ini", "monitor", "countm", "60000")
$var9 = iniread(@scriptdir&"\ypmonitor.ini", "stealth", "mode", "0")

;Process stealth mode setting
;
if $var9 = 1 then
#NoTrayIcon
EndIf

;Monitor anyprogram for restart
;
While 1
$PID = ProcessExists("anyprogram.exe"); Will return the PID or 0 if the process isn't found.
If $PID = 0 Then
Run ("c:\program files\program\anyprogram.exe")
endif
Sleep ($var8)
Wend

Thanks for the help. Like many things in this life there is a way that it works and there is an elegant way

[Fossil Rock]

Its part of a system I am working on that manages a home security surveillance system. If an unauthorised person gets access and attempts to close the surveillance software then this monitor will restart it and keep it running and recording video of the intruders.

What happens when they turn the computer off ? Does it restart the computer too ?

[anixon]

What happens when they turn the computer off ? Does it restart the computer too ?

[anixon]

System runs on a wireless networked stand-alone-computer box supported by a UPS installed in a locked and not obvious facility. Network Router and Wireless Internet Modem also supported by UPS. Loss of mains power to either system will trigger an immediate SMS alert to a user nominated GSM/CDMA mobile phone. Email with photo attachments are also triggered to a user nominated off site email address.

If access to the computer is gained and switched off or disconnected from the power supply well no more surveillance. But with hidden camera's covering all approaches and the surveillance system not on display I think I have got a better than even chance of getting footage that the police would find useful and also as proof to the insurance company that the property was broken into.

Your comments are valid as it forces one to think of all likely events

Cheers Ant

[Richard Robertson]

Your #NoTrayIcon always takes effect. It doesn't matter if you put it in the If block. Use the Opt code for hiding the icon instead.

Why is there so much security?

[nitekram]

Why is there so much security?

???

Its part of a system I am working on that manages a home security surveillance system. If an unauthorised person gets access and attempts to close the surveillance software then this monitor will restart it and keep it running and recording video of the intruders.

???

System runs on a wireless networked stand-alone-computer box supported by a UPS installed in a locked and not obvious facility. Network Router and Wireless Internet Modem also supported by UPS. Loss of mains power to either system will trigger an immediate SMS alert to a user nominated GSM/CDMA mobile phone. Email with photo attachments are also triggered to a user nominated off site email address.

If access to the computer is gained and switched off or disconnected from the power supply well no more surveillance. But with hidden camera's covering all approaches and the surveillance system not on display I think I have got a better than even chance of getting footage that the police would find useful and also as proof to the insurance company that the property was broken into.

Your comments are valid as it forces one to think of all likely events

Cheers Ant

If you are worried about them gaining access to this computer to turn off a process that is running on a locked computer then you might want to get a firewall and turn off everything - that way unless they get into the room - where I am sure the computer will be locked in a server rack and the computer password protected - you might want to put in a door contact or PIR on the inside of the door to notify of entry and tie it into the pager part.

[anixon]

???

???

If you are worried about them gaining access to this computer to turn off a process that is running on a locked computer then you might want to get a firewall and turn off everything - that way unless they get into the room - where I am sure the computer will be locked in a server rack and the computer password protected - you might want to put in a door contact or PIR on the inside of the door to notify of entry and tie it into the pager part.

Already run a firewall on the router as well as the computer and thanks for the door contact suggestion

Cheers Ant

[anixon]

???

???

If you are worried about them gaining access to this computer to turn off a process that is running on a locked computer then you might want to get a firewall and turn off everything - that way unless they get into the room - where I am sure the computer will be locked in a server rack and the computer password protected - you might want to put in a door contact or PIR on the inside of the door to notify of entry and tie it into the pager part.

Why so much security, well have you ever been burgled and then made a claim on an insurance company that wants evidence, more evidence and more evidence before they will consider the claim. Have you checked lately what a stand-a-lone security costs to install and monitor (in Australia that is).

And whats more important since I have retired all I like a challenge.

[Fossil Rock]

Why so much security, well have you ever been burgled and then made a claim on an insurance company that wants evidence, more evidence and more evidence before they will consider the claim. Have you checked lately what a stand-a-lone security costs to install and monitor (in Australia that is).

And whats more important since I have retired all I like a challenge.

I've done security in the past with server rooms and private offices and one of the easiest ways to 'trap' an intruder is to leave 'bait' easily accessible.

Example: Set up a cheap computer with cheap surveillance and leave it in plain site, or in a somewhat obvious location, leaving the true security hidden. The intruder will discover the 'obvious' security and disable it and then proceed under the impression that they have defeated the security system, thus giving you much more evidence.

Sending the video directly to a server on the internet is a good way to ensure they can't delete the evidence.

Low tech ideas - dogs, motion sensor lights, noise makers like bells or wind chimes on doors and windows.

[anixon]

I've done security in the past with server rooms and private offices and one of the easiest ways to 'trap' an intruder is to leave 'bait' easily accessible.

Example: Set up a cheap computer with cheap surveillance and leave it in plain site, or in a somewhat obvious location, leaving the true security hidden. The intruder will discover the 'obvious' security and disable it and then proceed under the impression that they have defeated the security system, thus giving you much more evidence.

Sending the video directly to a server on the internet is a good way to ensure they can't delete the evidence.

Low tech ideas - dogs, motion sensor lights, noise makers like bells or wind chimes on doors and windows.

Low tech ideas do work according to a friend of mine who suggested that a very hungry Rotweiller was a good security option, which begs the question as to what then would be the bait? Sending the videos to the internet is all part of my strategy and a good idea.

[arcker]

did you know that WMI can manage processes ?

you can tell him to make events with them

just take a look on scriptcenter at MSDN