i want make removal i want help

[q8wars]

hello

i need some help

see lets go

the virus make him self in 3 file

%windir%\system\svchost.exe

%windir%\system\rundll32.exe

%windir%\system\winlogon.exe

but if i do

ProcessClose("svchost.exe")

ProcessClose("rundll32.exe")

ProcessClose("winlogon.exe")

that make problem in pc

now i use this code

$proc = ProcessList("svchost.exe")
    for $p = 1 to $proc[0][0]
        MsgBox(0, "ProcID: " & $proc[$p][1],"ProcName: " & $proc[$p][0])
    Next

how i get ProcDir ?????????

thanks for help

[Valuater]

Process Path by PID/Process

Func _ProcessGetPath($pid) ;borrowed
    If IsString($pid) Then $pid = ProcessExists($pid)
    $Path = DllStructCreate("char[1000]")
    $dll = DllOpen("Kernel32.dll")
    $handle = DllCall($dll, "int", "OpenProcess", "dword", 0x0400 + 0x0010, "int", 0, "dword", $pid)
    $ret = DllCall("Psapi.dll", "long", "GetModuleFileNameEx", "long", $handle[0], "int", 0, "ptr", DllStructGetPtr($Path), "long", DllStructGetSize($Path))
    $ret = DllCall($dll, "int", "CloseHandle", "hwnd", $handle[0])
    DllClose($dll)
    Return DllStructGetData($Path, 1)
EndFunc   ;==>_ProcessGetPath

8)

[Jos]

Get a good AV program and use that to fix your mistake.

Jos