Process Explorer can only see/find the processes that are in the process list which is a doubly linked list sitting somewhere in memory. There's an open source monitor called YaProcmon (Yet Another Process Monitor) that has a feature that specifically looks for process hiding mechanisms, and attempts to expose them. But if a hidden process is accessing the registry, files, or communicating over the network it would be shown here. The downside is that the output is massive, and you generally have to know what you're looking for.
It bases its output off of Windows API file/registry/network function calls.
Procmon is awesome for process monitoring. It also links into VirusTotal to let you know if any currently running processes it sees is known to be malicious. Process Explorer is very nice from a GUI perspective. SysInternals Suite has multiple different monitoring programs. That being said there are a couple of good tools out there. Regardless of which monitoring program you use you're not guaranteed to find all processes running. So it's dependent on the particular piece of software trying to hide as well as the monitoring software trying to find it. If certain Windows API functions are hooked, then process managers using those functions will not see the process. Perhaps it isn't enough time, I'm using 250ms intervals.This really depends on how the process is hidden. I'm making a guess here that it's because I don't have sufficient permissions to close Windows background processes even running as administrator and that's why I'm getting the exception.Īfter each kill call, I put my program to sleep for a short amount of time to give the process time to close to avoid calling kill on a terminating process which will also throw the exception. My problem is that more than half the time I run this program I get a Win32Exception and the program won't finish closing anything left open. When running my program it closes all of my applications and some underlying Windows applications/processes because the screen, taskbar, and desktop go black for a second and refresh. I know it's not ideal, but this works for the most part. If ((p.Id != CurrentProcess.Id & p.MainWindowHandle != IntPtr.Zero))įirst it asks the process to close nicely with p.CloseMainWindow(), then kills the process if exceptions are returned. After doing a lot of searching I came across this code: foreach (Process p in Process.GetProcesses(Environment.MachineName)) I'm making a 'simple' program to close down all active applications on Windows 10 that I have running i.e.
0 kommentar(er)
