Detect taskmanager kill

I have an application that need to be in memory always. The app detect some files like limewire, edonkey or whatever file (with wildcards) or app title (with wildcards too) you want

The app is for my work, to prevent people to run some files that eat bandwidth

I hide the app with some shortcut-key..

Ok, the problem is that i can kill the app with the task manager. I want to detect when some user try to kill the app and the app must run another instance of itself

I try with query_unload, unload, terminate events and nothing. I try subclassing the wm_close, wm_quit, wm_destroy events and nothing

Anybody have a answer ?

Please, not say "query_unload must work". Just answer if you have tested the answer and works fine :blush:

Sorry about my bad english, and thanks to all people who answer to the other post (about Vista and VB6)

In query unload write this line:

VB Code:

shell app.path & "\" & app.exeName

I say before..

Quote:

---

Please, not say "query_unload must work". Just answer if you have tested the answer and works fine

---

And in fact, the app.exename returns the file without the ".exe" part

I say before..

Quote:

---

I try with query_unload, unload, terminate events and nothing. I try subclassing the wm_close, wm_quit, wm_destroy events and nothing

---

Maybe the query_unload works with Win98 or Win2K but not works with my XP

Sorry if i sound little rude

If have a code that works please post it here.. :(

Attached Example which disables/Enables Task Manager (CTL-ALT-DEL)
(works on XP)

If you want to do this by taking away the means for your users to disable your app through taskmanager by disabling ctrl+alt+del, look at Disabling ctrl+alt+del. You can also hide your app in taskmanagers Applications list by using:-

VB Code:

Private Sub Form_Load()
'Hide it in the Taskmanagers Applications tab, but not the processes tab.
   App.TaskVisible = False
End Sub

But it will still show your executable in the Processes tab. (Give your app a suitably confusing exe name such as videserv.exe and they'll be to scared to terminate it :) )
EDIT:- I'm assuming you've set ShowInTaskbar to False.

@rory. Nice one! Doesn't even produce a "disabled by admin" message.

It will if you dont enable it back again before closing the program out ..in that case you will need to open it back up and click enable to reenable it again ;)

Basically disable on program start, enable on program end .. got the code from a couple sources on the web ... actually its just a small part of much bigger code which "disables everything" :-)

... a login form would let everyone know who was the boss :bigyello: .... particularly if it displayed a "Your action has been logged - your Manager will be contacting you shortly" message :lol:

well i'll leave that part up to him ... he has a couple options now to get him on his feet .. :bigyello:

Uhmm.. hope not be rude

Block task manager ? Having two app's ? That is not my cuestion, thats easy

I ask : how to detect when taskmanager (or any app) is trying to close my app

dont know. perhaps a hook or something, best check in the API section for that .. one last thing, you can also name your exe Services.exe and it cant be closed from the Task Manager ... ;)

Quote:

---

Originally Posted by sunco

I ask : how to detect when taskmanager (or any app) is trying to close my app

---

I doubt that there's anything a process can do to prevent itself from being killed by task manager. It's what it was designed to do. Also, how would windows shut down if your app couldn't be unloaded ? It would hang every time.

There was some discussion of this in this thread:- http://www.vbforums.com/showthread.php?t=394374

Sunco, you can't do things in a work environment like blocking task manager. If you want people to not be able to use a lot of bandwidth, or not to be able to u se certain apps, attack it where it will work, not change workstations, and be completely out of the hands of the users - at the internet pipe. Set the router (or a computer sitting between the router and the LAN) to either not allow those programs, or to limit the bandwidth per workstation.

Attack the problem, not the symptom.

Like one month ago, i infect (by myself) with a virus and it reopen itself when i crash it from TaskManager, then must be a way

The Query_Unload event is perfect, but for some strange reason don't work with TaskManager

The really way must be subclass but need the exact msg that the app receive.. i must subclass the app again and save all the msg that receive in a txt file to check it :ehh:

heres another suggestion find a way to take the name of your program out of the taskmanager listbox, Using API of course. I can't do it personaly but im sure i heard someone who did it. He built an antivirus program that hid its name in taskmanager using API.

Quote:

---

Originally Posted by sunco

Like one month ago, i infect (by myself) with a virus and it reopen itself when i crash it from TaskManager, then must be a way

The Query_Unload event is perfect, but for some strange reason don't work with TaskManager

The really way must be subclass but need the exact msg that the app receive.. i must subclass the app again and save all the msg that receive in a txt file to check it :ehh:

---

why not just use Nortons, or the free AVG /.?
if its a trojan which it sounds like .. install Ewido .

Quote:

---

Originally Posted by sunco

Like one month ago, i infect (by myself) with a virus and it reopen itself when i crash it from TaskManager, then must be a way

---

The method you are talking about there does not involve disabling task manager's ability to kill the app. 2 or more extra executables/dlls are started by the main apps unload event - if they're not already running. After a few seconds/minutes, these other executables restart the main app. They also have unload code which restarts the main app - which in turn restarts them, and is why they are such a pain in the a*** to remove. They are still visible in the Processes tab. You should note that this method can cause your user's PCs to hang when unloading windows (just like viruses do)

If you want to prevent the TM from terminating your program you have to hook the TerminateProcess API which, as I understand it, is pretty difficult to do properly using pure VB. Improperly hooking the API will prevent Windows shutdowns, in certain instances, as well as some programs normal termination.

A properly hooked API results in an "Access Denied" message being returned when the TM attempts to terminate the app.

I'm going to take the g4hsean suggestion first (remove the app from taskmanager list with some apis.. have an idea how)

If can't (maybe because is subclassed by itself [or something like that], just like Msn Messenger) then im goin to check again with subclassing my app

The other can be as schoolbusdriver says, a dll that re-ejxecute the app (is easy with an exe.. but i don't know how load a dll yet)

Thanks to all people who try to help me in this

Quote:

---

Originally Posted by schoolbusdriver

I doubt that there's anything a process can do to prevent itself from being killed by task manager. It's what it was designed to do. Also, how would windows shut down if your app couldn't be unloaded ? It would hang every time.

There was some discussion of this in this thread:- http://www.vbforums.com/showthread.php?t=394374

---

acually when killing explorer.exe with exitcode 0 it runs again !!! but when killing the explorer.exe with exitcode of 1 it will not run again , the task manager always kills softwares with exitcode 1 , but the shutdown kills the softwares using exitcode 0 and if the program is not terminated it rekills it with exitcode 1 and if it is not working too , windows displays the "end now" msg with that progress bar then removes it from the kernel and memory whatever it was !

so if there's a way to find out the exitcode sent to your software when another software kills it , you can manage that thing ... i am having the same problem . i am developing a software to give a user for example an hour working on a PC then restart the PC when time is up , so if he kills my app , it will be a problem !!! for sure

Checkout the link:

How to find the user is trying to close the application using task manager or by pressing the X in Title bar, etc. How to restrict/refuse that