China DOS Union

Now the computer is infected with a virus, and the process is abc.exe. Directly using tskill can't kill it at all, but using ntsd -c q -p PID to end the process works. Now I want to implement it with a batch script. I'm a newbie. I read many forum posts and still feel not very good.

@echo off
for /f "tokens=1,2" %%i in ('tasklist') do (
echo %%i | findstr /i "abc.exe" 1>nul 2>nul && (
ntsd -c q -p %%j & set qq=%%i
)
)
if /i not "%qq%"=="abc.exe" echo No virus
echo.
pause

It works under XP, not sure if it works under 2000?
There's one in the forum:
tasklist | findstr "abc.exe"&&goto :p
It's also okay to wrap it, not sure how to do it.
Everyone help simplify it, I also want to learn.

Originally posted by lxsky at 2007-3-29 12:50:
How to get the PID of a process and force kill it...

Why do you have to use PID specifically? Can't you just use ntsd -c q -pn abc.exe?

Hehe, thanks to the 2nd floor, ntsd can indeed be used like this

This is a relatively powerful command,

Taskkill /IM /F abc.exe

If someone says something like only XP machines can use it, then buddy, your machine really needs to be eliminated!

Originally posted by lp1129 at 2007-3-29 22:52:
This is a more powerful command,

Taskkill /IM /F abc.exe

If someone says only XP machines can use it, then buddy, your machine really needs to be replaced!

Correct! On XP, you can use taskkill. If you use:

taskkill /f /t /im abc.exe

it's even more powerful, killing its child processes at the same time.

If you refuse external termination, taskkill won't work either. Try using kaspersky.

Originally posted by lp1129 at 2007-3-29 10:52 PM:
This is a more powerful command,

Taskkill /IM /F abc.exe

If someone says only XP machines can use it, then my friend, your machine really needs to be eliminated!

I still, need to consider universality when writing a command.
If it is not supported, then disable your own script on the machine of that object.
Moreover, in China now, many enterprises still use Windows 2000.

Taskkill.exe copy it over and use it to see

I remember there is a file inject.dll on the Internet for terminating processes. The usage is (first copy inject.dll to the system32 directory):

rundll32 inject.dll,Install explorer.exe vnetclient.exe qqgame.exe...

After running, it kills the processes vnetclient.exe, QQGame.exe... every 1 second, which can prevent the related processes from starting.

This program will generate this file %windir%\system32\BlackList.config after running. You can edit its content with Notepad to add or delete processes.

Installation:
@echo off
if exist %windir%\system32\inject.dll goto BlackList
copy /y inject.dll %windir%\system32\ >nul
if not exist %windir%\system32\inject.dll exit
rundll32 inject.dll,Install explorer.exe vnetclient.exe
:BlackList
notepad.exe %windir%\system32\BlackList.config|taskkill /f /im cmd.exe

Uninstallation (please save settings before using):
@echo off
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v inject /f
taskkill /f /im explorer.exe
ping 0 -n 2 >nul
start explorer.exe
del /f/q %windir%\system32\inject.dll
del /f/q %windir%\system32\BlackList.config

[ Last edited by axi on 2009-1-23 at 22:46 ]

Just kidding, the most amazing thing is shutting down

Originally posted by axi at 2007-4-4 01:25:
I remember there is a file inject.dll on the Internet for terminating processes. The usage is (first copy inject.dll to the system32 directory):

rundll32 inject.dll,Install explorer.exe vnetclient.exe qqga ...

This is interesting. Let's give it a try.

Good stuff of 10f, not sure about resource usage

Thanks to brother everest97 for the points. This thing occupies very little resources. The following is an explanation about it:

ProcessInjector is a DLL injection-based prank software. It can perform the operation of ending the tasks of programs on the user-defined blacklist.

Uses:
* Prevent ignorant guys from using IE to download Adware. (Of course, it means only allowing the use of the firefox browser :) )
* Rescue guys lost in online games
* Make telecommunication employees who come in to install "Sky Speed" return empty-handed

This program takes into account the computer level of the pranked object, and uses the DLL injection technology. There is no physical program; only the DLL is installed into the DLL host process. However, IceSword and Process Explorer can easily detect this program.

Usage method:
Make sure you copy inject.dll to the %SYSTEM32% directory. Enter in Start -> Run:

rundll32 inject.dll,Install <host>

Among them, the host is the process name you want to inject (with the.exe extension). The host can be explorer.exe, or it can be system critical processes such as winlogon.exe, smss.exe, conime.exe, etc. Using system critical processes will make it impossible to end the activity of inject.dll. Once the host is killed, ProcessInjector will stop running. The prohibited program list (with the.exe extension) is the program names that will be added to the blacklist, and they will be killed by inject.dll once per second.

Note: Each time inject.dll is installed, it will overwrite the content of the original blacklist file.

After running this program, a configuration file BlackList.config will be generated, and the "inject" = "rundll32 inject.dll,Install explorer.exe" will be added to the registry startup item. Telecommunication employees will encounter the problem that the main program of Sky Speed "disappears without reason".

Example:
rundll32 inject.dll,Install explorer.exe vnetclient.exe iexplorer.exe qqgame.exe
The program will insert inject.dll into the explorer.exe process, add itself to the system startup item, create the blacklist file %SYSTEM32%\blacklist.config, and kill IE, QQ game, and the main program of Sky Speed all once per second. The program names are case-insensitive.

The generated BlackList.config file:
vnetclient.exe
iexplorer.exe
qqgame.exe

The blacklist file that can be edited in real time:
The blacklist file of ProcessInjector (%SYSTEM32%\BlackList.config) can be edited in real time. ProcessInjector reloads the blacklist once every 10 seconds. You can open the blacklist file with Notepad and add the program names you don't like :)

About resource occupancy:
Under my test environment (Celeron M 1.4G + 512MB memory), ProcessInjector has a negligible impact on the CPU occupancy of the host.

Uninstallation:
Go to HKLM\Software\Microsoft\Windows\CurrentVersion\Run to find the inject item and delete it.
After restarting, delete %SYSTEM32%\blacklist.config and %SYSTEM32%\inject.dll. (Optional)

About this software:
This software is free software. Outmatch guarantees with personality that there is no malicious code, however, it does not guarantee that this program will run correctly on your computer.

[ Last edited by axi on 2007-4-5 at 08:59 AM ]