Killing "un-kill-able" apps with vb...

[FyreLance]

My apologies if this is in the wrong forum...


Cliff Notes Version: I want to know how to kill processes that you can't normally kill, namely "vsmon.exe" and "iclient.exe" (part of ZoneAlarm).




The challenge: Our company's remote access suite for VPNing in to our corporate network consists of four programs: iPass, Contivity VPN Client, Nortel Networks Tunnelguard, and ZoneLabs Integrity Client. These programs are required for remote access, but not every day use. When installed (standard on our current image), all four items load at startup, eating up valuable system resources. The boot times are increased dramatically. So I am attempting to write a script which I will include on our image which will Stop and Start the programs when ran, to negate the need for auto startup.

The problem: Two of the tasks, namely "vsmon.exe" and "iclient.exe" (which start when ZoneLabs Integrity Client is opened) refuse to be terminated. The only way I can get rid of them is by physically right clicking on the system tray and telling the program to close, which doesn't work too well for scripting I don't think. But I have been unsuccessful in my attempts to automate closing them.

I cannot even close these tasks in the Task Manager. It returns a dialog box: "The operation could not be completed. Access is denied." Whether the related Service ("TrueVector Internet Monitor") is started or not seems to make little difference.


I have made the following command line attempts:

tskill vsmon
- End Process failed for vsmon:Access is denied.

pskill vsmon <==== a program by SysInternals
- Unable to kill process vsmon:
- Acess is denied.

taskkill -IM vsmon.exe
- ERROR: The process "vsmon.exe" with PID 2424 could not be terminated.
- Reason: This process can only be terminated forcefully (with /F option).

taskkill -IM vsmon.exe /F
- ERROR: "The process "vsmon.exe" with PID 2424 could not be terminated.
- Reason: Access is denied.

NET STOP vsmon
- The requested pause or stop is not valid for this service.
- More help is available by typing NET HELPMSG 2191.


I have tried using the "at" command to use the task scheduler to complete the app, since this causes it to be run by the SYSTEM account (ex: at 8:23 /interactive taskkill vsmon.exe) but it does not happen. I also tried having the "at" command open the task manager and manually closing it. Still access denied.


I have tried using SendKeys to simulate the necessary keystrokes to close the app:

set wshell = CreateObject("WScript.Shell")  

' "Re-open" Integrity Client so that its window will appear.
' This will start Integrity Client if it was not already running.
wshell.Exec "C:\Program Files\Zone Labs\Integrity Client\iclient.exe"

WScript.Sleep 1500 ' Gives it some time to load

' Ensures that Integrity Client is the active window
Do Until Success = True
 Success = wshell.AppActivate("Zone Labs Integrity Flex")
 wscript.Sleep 1000
Loop

wscript.Sleep 5000

' Right now I'm just trying to get the menu to pop up
wshell.SendKeys "%{ }"
'wshell.SendKeys "%s"
'wshell.SendKeys "%s"
'wshell.Sendkeys "{ENTER}"

set wshell = nothing

But that does not work. It's like the application completely ignores the keystrokes. Which I don't understand, since it should be the same thing as me hitting the keys manually (which DOES work). If I change the script to work with Notepad, it works like a champ. Just not with this app.

Can anyone help me with finding a way to automate closing this app? I've been working on this for a few days, but I'm a scripting n00b so perhaps I'm overlooking something. THANKS!

[ididntdoit]

I'm not sure if it works with processes, or command line args (which you;d need to specify the program with code), but the program Unlocker can remove the handle on files that prevents them from being deleted, so maybe there's something similar out there for processes.

[FyreLance]

I'm not sure if it works with processes, or command line args (which you;d need to specify the program with code), but the program Unlocker can remove the handle on files that prevents them from being deleted, so maybe there's something similar out there for processes.

I gave that a shot (it does work with command line!) but the utility simply tells me:

No Locking handle found.

However Unlocker can help you deal with this object.

Choose the action you want to perform on the object.

(No Action)
(Delete)
(Rename)
(Move)

Well, I don't want to delete, rename, or move it, I just want to turn it off.

[iPrank]

Are they service or normal exe ?
If they are normal exe loaded during startup, you can enable/disable them by running MSCONFIG from Run dialog.
If they are service, you can disable them from Control Panel|Administrative Tools|Services.

No idea how to automate the taks.

[FyreLance]

Are they service or normal exe ?
If they are normal exe loaded during startup, you can enable/disable them by running MSCONFIG from Run dialog.
If they are service, you can disable them from Control Panel|Administrative Tools|Services.

Obviously.

As I said, I'm trying to write a script to open and close four programs so that my end users do not have to.

There is a service associated with it, but even if I manually stop the service, the aforementioned methods still do not work.

[iPrank]

Have you tried any code similar to this one.

I don't think it will work for 'protected' services...but still...

[FyreLance]

Have you tried any code similar to this one.

I don't think it will work for 'protected' services...but still...

As I said, even if I manually disable the service, I still can't kill the aforementioned tasks.

[schoolbusdriver]

How about:- http://support.microsoft.com/kb/171773

[FyreLance]

How about:- http://support.microsoft.com/kb/171773

I have tried a lot of apps that do the same thing, but no, I haven't specifically tried kill.exe from the Win2K Resource Kit yet. I guess I kinda had it in my head that if the other ones didn't work, why would this one? I suppose it's worth a shot though.

[schoolbusdriver]

Just in case your CD is in the bottom of a drawer: http://www.mattkruse.com/utilities/, or just goole for kill.exe

[FyreLance]

Just in case your CD is in the bottom of a drawer: http://www.mattkruse.com/utilities/, or just goole for kill.exe

"Process #16 could not be killed"

[schoolbusdriver]

Hmmm... the guys at zonealarm obviously don't want it unloaded. Googling for iclient.exe shows it's a known problem. The only way I can think of is altering the registry and rebooting.

[dark_shadow]

why have your vb app create a bat file with the Net Stop command to stop the services and have the vb app shell the bat file?

i know its kinda dirty but its a way of doing it

[MartinLiss]

I don't know anything about ZoneAlarm but since the two programs that you mention are a part of it. could you have your users configure ZoneAlarm to allow what you want to do?

[the182guy]

I don't know anything about ZoneAlarm but since the two programs that you mention are a part of it. could you have your users configure ZoneAlarm to allow what you want to do?

I'd do that^. killing it seems a bit risky.

By the way if this is for a commercial environment you could get it done cheap @ www.RentACoder.com

[BillBoeBaggins]

I wish I could add something, but mainly I am glad ZoneAlarm is making this difficult I would hate to think some simple script kiddy malware would turn it off heh.

[rory]

EDIT

well this terminates "almost" any process.

you need to stop the service first, right after that,
terminate the exe's.

You may need to loop a couple times also for certain processes.

I can totally stop nortons services and processes so im sure it can be done with any other program. There are some tricks i wont reveal here though. Certain processes will also require send keys.

Ps. I prefer AVG anyways now :-)

Ps. Ps. It is probably easier (preferable) just adding your app to run once, taking the program off startup, restart, do your thing, add the program back to startup, then restart.

Option Explicit

'// STOP EXE PROGRAM
Function StopProcess(Name)
    Dim Process, Sql
    If Len(Name) = 0 Then Exit Function
    Sql = "Select Name from Win32_Process Where Name = '" & Name & "'"
    For Each Process In GetObject("winmgmts:").ExecQuery(Sql)
        Process.Terminate: StopProcess = True
    Next
End Function

'// TEST THE FUNCTION
If StopProcess("SOMETHING.EXE") Then
    MsgBox "Program Closed"
Else
    MsgBox "Program not found"
End If