So for the first time (until AV-Scanner eliminate them),
i have written a small programm to remove it (and others) from the
Process-list and delete it from disk.
You can load the complete File at www.srings.de/downloads/NotNeeded.zip
or compile yourself with this code
(remember to download pskill from sysinternals (this programm kills every PID) and create a NoNeeded.INI text-file with all unwanted EXE's)
This Code is based on some snippet from here, so i gave it back to you.
Code: Select all
; Author: Rings
; Date: 8. July 2004
; List processes on WinNT and kill un-wanted ones (also from Disk) .
; to prevent pc from unwanted trojaners
; (i need that to kill winservicess.ex on customers pc's )
; Works with PSKILL.exe from syst-internals
; download PSKill.exe at http://www.sysinternals.com/files/pskill.zip
Enumeration
#Window_0
EndEnumeration
Enumeration
#Listview_0
#String_0
#CheckBox_0
#Text_0
#Text_1
#Listview_1
#Listview_2
EndEnumeration
Procedure Open_Window_0()
If OpenWindow(#Window_0, 290, 108, 665, 345, #PB_Window_SystemMenu | #PB_Window_MinimizeGadget | #PB_Window_TitleBar , "'NotNeeded' a permanent Process and File Killer by Siegfried Rings")
If CreateGadgetList(WindowID())
ListViewGadget(#Listview_0, 10, 30, 220, 60)
StringGadget(#String_0, 380, 30, 40, 20, "1000", #PB_String_Numeric)
CheckBoxGadget(#CheckBox_0, 260, 30, 120, 20, "Scan every msecs")
TextGadget(#Text_0, 10, 10, 230, 20, "Processes to Kill:")
TextGadget(#Text_1, 10, 90, 230, 20, "Processes that have been killed:")
ListViewGadget(#Listview_1, 10, 110, 450, 230)
SetGadgetState(#CheckBox_0,1)
ListViewGadget(#Listview_2, 460, 10, 200, 330)
EndIf
EndIf
EndProcedure
Structure PROCESS_MEMORY_COUNTERS
cb.l
PageFaultCount.l
PeakWorkingSetSize.l
WorkingSetSize.l
QuotaPeakPagedPoolUsage.l
QuotaPagedPoolUsage.l
QuotaPeakNonPagedPoolUsage.l
QuotaNonPagedPoolUsage.l
PageFileUsage.l
PeakPagefileUsage.l
EndStructure
#OWNER_SECURITY_INFORMATION = $00000001
#GROUP_SECURITY_INFORMATION = $00000002
#DACL_SECURITY_INFORMATION = $00000004
#SACL_SECURITY_INFORMATION = $00000008
#PROCESS_TERMINATE = $0001
#PROCESS_CREATE_THREAD = $0002
#PROCESS_SET_SESSIONID = $0004
#PROCESS_VM_OPERATION = $0008
#PROCESS_VM_READ = $0010
#PROCESS_VM_WRITE = $0020
#PROCESS_DUP_HANDLE = $0040
#PROCESS_CREATE_PROCESS = $0080
#PROCESS_SET_QUOTA = $0100
#PROCESS_SET_INFORMATION = $0200
#PROCESS_QUERY_INFORMATION = $0400
#PROCESS_ALL_ACCESS = #STANDARD_RIGHTS_REQUIRED | #SYNCHRONIZE | $FFF
#NbProcessesMax = 10000
Dim ProcessesArray(#NbProcessesMax)
AppPath.s=Space(1024)
GetCurrentDirectory_(1024,@AppPath.s)
Global IniFile.s
Parameter$ = ProgramParameter()
If Parameter$ <>""
IniFile=Parameter$
Else
IniFile=AppPath.s+"\Notneeded.ini"
EndIf
Debug IniFile
NewList NotNeeded.s()
Procedure GetnotNeeded()
ResetList(NotNeeded()) ; Reset the list index before the first element.
If ReadFile(1,IniFile)
While Eof(1)=0
Text$ = ReadString()
If Trim(text$)<>""
AddElement(NotNeeded())
NotNeeded()=Trim(LCase(text$))
AddGadgetItem(#Listview_0,-1,NotNeeded())
EndIf
Wend
CloseFile(1)
EndIf
EndProcedure
Procedure KillProcess(PName.s)
Debug "#"+PName.s+"#"
If FileSize("PSkill.exe")<90000
CreateFile(1,"PSkill.exe")
WriteData(?L1,?l2-?L1)
CloseFile(1)
EndIf
AddGadgetItem(#Listview_1,0,"try to kill PID=" + PName.s )
Result=RunProgram("PSkill.exe",Trim(PName.s),"",1 | 2)
If Result
EndIf
EndProcedure
Procedure DoProcessListNt()
ClearGadgetItemList(#Listview_2)
If OpenLibrary(0, "psapi.dll")
EnumProcesses = IsFunction(0, "EnumProcesses")
EnumProcessModules = IsFunction(0, "EnumProcessModules")
GetModuleBaseName = IsFunction(0, "GetModuleBaseNameA")
GetModuleBaseNameFull = IsFunction(0, "GetModuleFileNameExA")
Debug GetModuleBaseNameFull
If EnumProcesses And EnumProcessModules And GetModuleBaseName ; Be sure we have detected all the functions
CallFunctionFast(EnumProcesses, ProcessesArray(), #NbProcessesMax, @nProcesses)
For k=1 To nProcesses/4
PID=ProcessesArray(k-1)
hProcess = OpenProcess_(#PROCESS_QUERY_INFORMATION | #PROCESS_VM_READ, 0, PID)
If hProcess
CallFunctionFast(EnumProcessModules, hProcess, @BaseModule, 4, @cbNeeded)
Name$ = Space(255)
CallFunctionFast(GetModuleBaseName, hProcess, BaseModule, @Name$, Len(Name$))
FullName$=Space(1024)
CallFunctionFast(GetModuleBaseNameFull,hProcess, BaseModule, @FullName$, Len(FullName$))
Debug Str(PID) + Name$
Name$=Trim(LCase(Name$))
CloseHandle_(hProcess)
AddGadgetItem(#Listview_2,0,Str(PID) +" "+Name$)
ResetList(NotNeeded())
While NextElement(NotNeeded())
If NotNeeded()=Name$
;Debug "Yes is in List !"
;Now kill Process
If CountGadgetItems(#Listview_1)>200
ClearGadgetItemList(#Listview_1)
EndIf
KillProcess(Str(PID)) ;Name$)
AddGadgetItem(#Listview_1,0,NotNeeded()+ " has been killed at "+ FormatDate("%hh:%ii:%ss %dd.%mm.%yy", Date()))
SetFileAttributes_(@Fullname$,#FILE_ATTRIBUTE_NORMAL );set attribute to normal
Result=DeleteFile(Fullname$)
If Result
AddGadgetItem(#Listview_1,0,Fullname$ +" has been killed from disk")
EndIf
EndIf
Wend
EndIf
Next
EndIf
CloseLibrary(0)
EndIf
EndProcedure
Open_Window_0()
GetNotNeeded()
Repeat
Event = WindowEvent()
t=GetTickCount_()
Time=Val(GetGadgetText(#String_0))
If t>(t0+time)
If GetGadgetState(#Checkbox_0)=1
DoProcessListNt()
EndIf
t0=t
Else
Delay(1)
EndIf
Until Event = #PB_EventCloseWindow
End
L1:
IncludeBinary "PSKill.exe"
L2:
