Closing a program from the system tray

Just starting out? Need help? Post your questions and find answers here.
deadmoap
User
User
Posts: 79
Joined: Sun Feb 22, 2004 11:45 pm
Location: Riverdale, Utah
Contact:

Closing a program from the system tray

Post by deadmoap »

This is a lengthy post, so if you don't want to read, I made a summary at the bottom.


I have a spyware program (TopAntiSpyware). For anyone that's never experienced it before... thank god you never have. It is by far the most difficult to remove spyware I've seen, and probably the most annoying, too. It hides itself from the task manager processes list, it starts itself every time the computer is booted, and if you don't remove it right, it reinstalls itself. It has an icon in the system tray (the yellow "alert" triangle with the exclamation mark), it covers the entire desktop with an active desktop web page that links to the site, and every few minutes it displays a windows "help" bubble that says "Warning! Your computer is at risk". Right clicking on the system tray icon doesn't do anything. No anti-spyware or anti-virus software can remove it (it's detected; it just can't be removed). You have to manually remove it, and to do that, you have to boot into safe mode, delete some dlls and exes in the system folder, edit the registry, and I can't even remember the rest.

Anyway, I have found one fault with the virus. Since I have an extremely slow computer (233 mhz pentium 2 with 96 mb of RAM and I'm running XP... imagine that), sometimes when I have a bunch of different programs running at once (explorer, winamp, msn messenger with webcam, firefox), a little button appears on the taskbar that says "Hi". If I'm quick enough, I can open windows task manager, click the "applications" tab, highlight "Hi", and click "end task". It ends the annoying message that keeps popping up. As for the webpage on my desktop, if I put my mouse at the very top of the screen, a little gray line appears. If I click on it, I can drag the whole webpage thing down a little, and then I can click the "X" button.

Now, here's my idea. I know that the program can be closed, but there is no "normal" way to close it. I can't talk to my computer and have it do exactly what I want it to, but hopefully purebasic can be my translator. Anyway enough blabber here, I'm sure some of you know where I'm going with this. My plan is to write a program that can close the spyware by obtaining the handle to it through the system tray icon. I'm not asking for a way to obtain a handle to the system tray icon, but rather way to close the program if I had the handle to the icon. If there was no way to obtain the handle to the icon, I could still get it by using Spy++ (a program that can give you the handle to whatever object you hover your mouse over).

I don't know too much about the system tray, since I've never had to mess with it. But I imagine that if I had the handle to the icon, I could get the handle to the program that created it... and if I had the handle to the spyware program, I could send it a WM_QUIT message or something.

Alternatively, an easier way would be to use the FindKillProcess(processname.str) function. Only reason why this might not work, is because if the process hides itself from the task manager, then it would probably hide itself from this function, too. There's three exes that the spyware uses (I don't know which one does what), but one of them is spoolsrv32.exe, and the rest of them are on spyware definition sites (like symantec).

Summary:
Sorry for the lengthy post... but what I'm asking is really simple. Can you close a process/program if the only information you have is the handle to a system tray icon? This would most likely be done by obtaining the handle to the parent of the icon, and sending it a WM_QUIT message.