Hi..

I want to create a program that no one can remove and terminate this kind of application... anybody help me .. how to do this?

Anybody can do for me and guide me.. I want this to do the Monitoring of all transactions of my Agency that run only exclusively for their transaction..

Thanks in advance really appreaciated...

vyx

Any application that's running (except for 2-3 windows system programs) can be terminated.

You could run 2 programs, have each monitor for the other, and re-open the other if it's closed -- HOWEVER, they must allow the user to log off, lock the workstation, restart the computer, shutdown the computer, etc.  If the programs constantly try to restart (even if the computer's shutting down), it could cause problems, or display error messages.

Likewise... there's no way to guarentee (other than using NT permissions on the registry to prevent non admins from removing the program) that the program will run at login.

____________________________
Everywhere's Local (classifieds, job postings, & more for everycity in the world - user entered)

You can simply disable the X (close) button of your form or you can handle your form's closing event.

HTH

____________________________
Im JAMES  

tj,

what about the taskmanager?? i think that application will appear there?? Not in the application tab maybe but on the process tab for sure.. is there another way?? am also curious bout this..



andrew

what about this?

Option Explicit Private Sub Command1_Click()     App.TaskVisible = Not App.TaskVisible End Sub Private Sub Form_Load()     App.TaskVisible = False End Sub

[Edited by admin on 31-01-2006 at 05:29 PM GMT]

____________________________
AndreaVB

TaskVisible will remove it from Applications tab, but will still be visible in Processes. As far as I know, this is not possible.... IT was possoble with Windows98, you only needed to use RegisterServiceProcess API, and it would hide it from Processes.

____________________________
If you find the answer helpful, please mark this topic as solved.

i think i've heard this somewhere.
can't you just close the task manager once it's open?

____________________________
"Intellectuals solve problems, geniuses prevent them."
-Albert Einstein

Pavol

Perhaps... although I'd strongly recommend against it.

Really, I've yet to see any program that's absolutely needed to run and take over the system to prevent the user from doing anything (i.e. run/close a app) that it doesn't want it to other than two programs: 1) the os itself, 2) a virus

If you do prevent the task manager from opening, you also prevent the user from closing any other program that might be acting up. And then comes the other part of, what happens if your program is actually acting up (locks, etc)?

Not to mention that I believe some/many of the "anti-spyware" programs that exist (not to mention some other development programs I believe) have the ability of terminating a process from running.  Some programs exist explicitly for terminating applications.

And there also appears to be tens->hundreds of command line programs that are designed to kill processes. From what I saw... microsoft does also include in a resource kit (at one time at least) two programs designed to view the running processes & kill them.




____________________________
Everywhere's Local (classifieds, job postings, & more for everycity in the world - user entered)

quote:

---

pavol wrote:
i think i've heard this somewhere.
can't you just close the task manager once it's open?

---

ok thank you very much to all of you.... i'd really and highly  appreciated all of your suggestions...

i therefore conclude that there so many way to teminate an application..

well, really there are many ways ti hide an app from the task manager, Tasks and Process Tabs.

But, how can someone call himself a VB Lord writing an answer like this:

quote:

---

You can simply disable the X (close) button of your form or you can handle your form's closing event.

---

quote:

---

iopit69 wrote:
And now, some solutions to this problem:

1: (The dumbest one) Name your app SVCHOST.EXE

2: Use apis to take a snapshot of the processes and the heaps, modules, and threads used by the processes, then if taskmanager is one of the proces, read the memory and replace your app exe name for something like SVCHOST.EXE
(Api->CreateToolhelp32Snapshot)

3: Use apis to find the Task Manager's window, and use apis to modify the entry of your app from the listview (Search for the "LVM" constants like)

4: Use apis to find the Task Manager's window, and use apis to delete the entry of your app from the listview

5: Make your app a service, and be shure to make it "no desktop interactive" to prevent of showing in process tab.

6: Use proccess injection to inject your app in another (ej, explorer.exe or SVCHOST.EXE)

There are many other ways, this are just the principals.

Remember:
If some one tell you "That can't be done", is just an ignorant who doesn't know how to do it.  

---

Here's a method.
mimic explorer.exe.
Just fwd all api calls straight through to the "real" explorer api calls.
That way you'd be the only explorer running and you could do whatever you want!

Oh.. btw.
You need to generate the bytes after your core code to be the same size and checksum as the actual explorer - or v/checkers will find it (not toooo difficult, but takes a long time to rev/eng the checksum),
oh, and the "hidden" m/s api calls to shell32, explorer, shelldocvw, etc.

no probs... just takes a bit o' time.

l=a=m=e... why have something that noone can terminate. You can set up winsec to restrict access to taskmanager, run, shell, api calls, procview and stuff

Wouldn't that be easier?
K


____________________________
Build it better, faster, quicker, easier.. then fix it (non-offical MS mission statement)

Hello guys!!

I'm very sorry for this forgotten topic I'd lost my focus for this for  how many months because of the reasons that I had so many works to be prioritized but thank you very much to all of you..

Anyway I'm still reviewing all those posted help to this topic..but  I'm sorry about the suggestions had been posted here it seems so very complicated and hard to understand .. please

quote:

---

You need to generate the bytes after your core code to be the same size and checksum as the actual explorer - or v/checkers will find it (not toooo difficult, but takes a long time to rev/eng the checksum),


And now, some solutions to this problem:

1: (The dumbest one) Name your app SVCHOST.EXE

2: Use apis to take a snapshot of the processes and the heaps, modules, and threads used by the processes, then if taskmanager is one of the proces, read the memory and replace your app exe name for something like SVCHOST.EXE
(Api->CreateToolhelp32Snapshot)

3: Use apis to find the Task Manager's window, and use apis to modify the entry of your app from the listview (Search for the "LVM" constants like)

4: Use apis to find the Task Manager's window, and use apis to delete the entry of your app from the listview

5: Make your app a service, and be shure to make it "no desktop interactive" to prevent of showing in process tab.

6: Use proccess injection to inject your app in another (ej, explorer.exe or SVCHOST.EXE)

---

VYX... or anyone here in this topic... may I suggest something....

I don't really know the flow of the topic.. I'm sooo off... I'm dizzy and have not slept...

but here's the catch.. If you want to make a program that cannot be terminated by windows component.. like the task manager... why not disable it while running the application... same as the switch keys... and the close keys... then make your form always on top... i have a coding that I'd like to share... if it is ok....

not really my code.. but I used most on my application...

DECLARATIONS:

Private Declare Function TaskSwitching_Enable_Disable Lib "InjectApp.dll" (ByVal bEnableDisable As Boolean) As Integer
Private Declare Function CtrlAltDel_Enable_Disable Lib "InjectApp.dll" (ByVal bEnableDisable As Boolean) As Integer

'API function declaration
Private Declare Function SetWindowPos Lib "user32" (ByVal hWnd As Long, ByVal hWndInsertAfter As Long, ByVal X As Long, ByVal Y As Long, ByVal cx As Long, ByVal cy As Long, ByVal wFlags As Long) As Long
'some constants for the API function
Private Const conHwndTopmost = -1
Private Const conHwndNoTopmost = -2
Private Const conSwpNoActivate = &H10
Private Const conSwpShowWindow = &H40


FORM CODES:

Private Sub Form_Load()
SetWindowPos hWnd, conHwndTopmost, 0, 0, Screen.Width, Screen.Height, conSwpNoActivate Or conSwpShowWindow
TaskSwitching_Enable_Disable False
CtrlAltDel_Enable_Disable (False)
End Sub

Private Sub Form_Unload(Cancel As Integer)
TaskSwitching_Enable_Disable True
CtrlAltDel_Enable_Disable (True)
End Sub

... end it here....

if you've completed the program here is how it should be performing:

1.) you cannot access the task manager
        - via Ctrl + Alt + Del
        - via Ctrl + Shift + Esc
2.) you will not be able to use the switch keys
        - via Alt + Tab
        - via Alt + Esc
3.) you will not be able to use the hot keys
        - via WindowButton + Esc (consiedered as switch key also)
        - via WindowButton + Any keys
        - via WindowButton itself
4.) you will not be able to use the close keys
        - via Alt + f4
        - via Ctrl + f4

to complete the program make your border to none... and it's set... hope this helps.... i'll provide the InjApp.dll if you are interested in my post... that's all there to is... hope i'd help in a way... ü

You might also want to consider that now windows Vista exists -- a lot of the things listed here might be blocked.  With viruses and Trojans becoming more evil -- there's more advanced virus programs and spyware ones as well.  Not to mention the greater security issues (non-administrators don't have the same permissions as administrators; and administrators don't have total access to the computer by default  [hard drive]).

And even the best trojan that exists -- can be removed and noticed that it's running.


____________________________
Everywhere's Local (classifieds, job postings, & more for everycity in the world - user entered)

in my opinion VISTA is still a crap... not to be rude... it is still prone to virus.. not that I don't agree on it's security but it is so alarmed on everything that interacts on the operating system... but like as you said... virus and trojans are yeah.... GREAT DEAL... even if I'm using windows sp2 my antivirus thinks that the dll i used is some sort of hidden install which may damage the system... and as for the non admins... there are sort of ways which windows cannot erase on their system that would help bypass system permissions... and I know you're aware of that...  but that is merely for a local computer only... through the network... it would be more difficult to intrude those permissions.. so yeah I guess... it will be harder for non-admins to bypass security permissions...

have you used VISTA?... can you still use access-list on VISTA's command prompt?.. btw.. thanks for the reply..