China DOS Union

The system here uses a software that shields keywords in Explorer.exe to restrict downloads. But if you use taskkill /f /im Explorer.exe, it will end the desktop process explorer.exe together. I want to ask if there is any way to only end the keyword process Explorer.exe without ending the desktop process explorer.exe? I don't want to first use tasklist to find the PID value of Explorer.exe each time.

PID cannot directly distinguish between two EXPLORERs. It is just randomly assigned by the system when the process runs and does not represent a specific process. So simply looking at the PID, you won't know which EXPLORER you should terminate. But we can analyze the paths of the two processes through WMIC. As long as it is an EXPLORER not under C:\WINDOWS, terminate the PID of that process.

[ Last edited by qinbuer on 2007-7-3 at 12:04 PM ]

First, taskkill /f /im explorer.exe, then start %systemroot%\explorer.exe. Or as the brother upstairs said, check the path of the program to judge.

I'm surfing in an internet cafe.
If I use taskkill /f /im Explorer.exe, it will end the system's desktop process explorer.exe together. Reloading explorer will cause the icon of the billing system in the system tray to be invisible and unable to check out.
Of course, I might first use tasklist to find the PID value of the Explorer.exe process (here, the difference between the system process and the keyword blocking process name is that the system process is all lowercase, and the first letter of the keyword blocking process is uppercase, so I can clearly judge which one is the one to end), and then use taskkill /f /pid +PID value to end it.
But because the system has made a lot of restrictions, I find it tedious to check like this every time.
I want to ask if it is possible to first use tasklist to list the process information, then use the find function to find the PID value of the keyword process, and then use taskkill to end the process by calling the found value?

I have a simpler question. If I find there are two explorer.exe, then execute a command saying that this machine is infected with a virus. How should I write it???

Brother LX, please help me!!!

I thought about using whether the PIDs are equal to determine whether this machine has two explorer.exe. If there is one, then they must be equal; if there are two, they must be not equal. But how to judge equality?

tasklist /FI "IMAGENAME eq explorer.exe"
The system is case-insensitive...
So you will get 2. Then you can do a findstr on it (this is case-sensitive)

Then do what you want to do by yourself... Oh, by the way, you can get the PID from the above

Try this way
@echo off for /f "tokens=1,2" %%i in ('tasklist /nh /FO TABLE') do ( if "%%i" == "Explorer.exe" taskkill /FI "pid eq %%j" ) pause

taskkill /FI "pid eq %%j" may need to add /f

[ Last edited by terse on 2008-1-22 at 08:02 PM ]

Has everyone seen my question??

My question is, if I find there are two explorer.exe, then send a message to the server saying that this computer may be infected with a virus. How to do it??? I'm a big newbie. I don't know anything!!

Thanks to the script from floor 9, my script for hiding the process of a specified program has made progress