中国DOS联盟

The SC command in NT systems is very useful. But recently, when making an antivirus software NOD32, the original antivirus software cannot be ended using the Task Manager to end ekrn.exe after installation (it prompts that the system process cannot be ended), and the sc delete cannot be used to delete the service. However, the process I created myself using the command "%WINDIR%\SYSTEM32\SC.EXE" CREATE "ekrn" TYPE= INTERACT TYPE= OWN START= AUTO BINPATH= "%CD%\ekrn.exe" DISPLAYNAME= "Eset Service" can not only be ended using any manager but also the service can be deleted using sc delete.
Asking all the experts, is there any way to make the created process service not be able to be ended manually. Waiting online......

I found a way to delete a service, which is to add permissions to the service using SETACL so that it can't be deleted.

In addition, SETACL can also set the permissions of SRV. I don't know how to use it. Maybe this can also achieve the effect.

Why is it so quiet today? Keep bumping.

It is obviously not related to SC at all. Then what is the function of the self-protection function of the antivirus software?

After closing 360, then deleting its folder, a prompt box pops up: as shown in the figure
My process list is as shown in the figure:
Using unlocker shows that there is no locking operation, why is there still a prompt box?
How does 360 do it? How does it protect itself?

SC CREATE  "ekrn" TYPE= INTERACT TYPE= OWN START= AUTO BINPATH= "%CD%\ekrn.exe" DISPLAYNAME= "Eset Service"

REM SC failure ekrn reset= 60 actions= restart/60/restart/60/restart/60

REG ADD  "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ekrn" /v "FailureActions" /t REG_BINARY /d "3C000000000000000000000001000000000000000100000000000000" /f

NET START  "Eset Service">NUL

set op=-ot reg -actn ace -ace "n:everyone;p:read;m:grant;w:dacl" -actn setprot -op "dacl:p_nc"

IF NOT "%WINDIR:~-2%"=="PE" setacl -on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ekrn" %op%

set svr=-ot srv -actn ace -ace "n:Everyone;m:grant;p:read;i:sc"

Found the method. The idea is very simple, mainly the following points.

First, FailureActions: this is actually the operation after startup failure. After testing, it is also the operation after the service process ends (fails). This is the key. Without this operation, the process will not automatically restart the service after ending. The following FailureActions of mine cannot be ended no matter how you end it because it will be automatically generated.

Second, use setacl to set the registry permissions of the service to prohibit deletion, so that you cannot stop the process when using the service manager.

Third, use setacl to set the operation permissions of the service to read-only, so that users cannot stop the service.

The code is as follows: For details, you can refer to my BLOG: http://xbdsoft.kmip.net/article/gsoft/52.htm

SC CREATE  "ekrn" TYPE= INTERACT TYPE= OWN START= AUTO BINPATH= "%CD%\ekrn.exe" DISPLAYNAME= "Eset Service"

REM SC failure ekrn reset= 60 actions= restart/60/restart/60/restart/60

REG ADD  "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ekrn" /v "FailureActions" /t REG_BINARY /d "3C000000000000000000000001000000000000000100000000000000" /f

NET START  "Eset Service">NUL

set op=-ot reg -actn ace -ace "n:everyone;p:read;m:grant;w:dacl" -actn setprot -op "dacl:p_nc"

IF NOT "%WINDIR:~-2%"=="PE" setacl -on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ekrn" %op%

set svr=-ot srv -actn ace -ace "n:Everyone;m:grant;p:read;i:sc"

Last edited by HUNRYBECKY on 2009-3-18 at 06:02 ]