[๖ۣۜMrRoot]

and what if you do Kill process tree?

[Only3]

for all that say it can be kill i try it by accident and needed to restart as i cant kill it even with process explorer

[He B TeMy]

for all that say it can be kill i try it by accident and needed to restart as i cant kill it even with process explorer

I bet i can kill it with process explorer, just like i can kill eset with Process Hacker.

Edit: I got the code, i just never tested it..

[CottleSilver]

Send pm with no response, can someone send me the link with the source?

[Malware]

In process hacker, go to properties of the process and kill all of the threads

[.cYRil.]

Sounds like interestiing wanna check this out

[Malware]

Code

Public Class ProtectProcessNew
    Private Delegate Function VarPtrCallbackDelegate(ByVal address As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
    <DllImport("ntdll.dll")>
    Private Shared Function ZwSetInformationProcess(ByVal _1 As IntPtr, ByVal _2 As IntPtr, ByVal _3 As IntPtr, ByVal _4 As IntPtr) As IntPtr
    End Function
    <DllImport("user32.dll")>
    Private Shared Function CallWindowProcA(ByVal wndProc As VarPtrCallbackDelegate, ByRef var As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
    End Function
    Private Shared Function VarPtrCallback(ByVal address As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
      Return address
    End Function
    Public Shared Sub Protect()
      ZwSetInformationProcess(System.Diagnostics.Process.GetCurrentProcess().Handle, &H21&, CallWindowProcA(AddressOf VarPtrCallback, &H8000F129, 0, 0, 0), &H4&)
    End Sub
End Class

[CottleSilver]

Dose not work with windows 8 :) This is useless

[TheExclusive]

False claims aside, you have no say in who you give this to since it isn't yours.

Code

Imports System.Runtime.InteropServices

Public Class ProtectExecutable
    Private Delegate Function VarPtrCallbackDelegate(ByVal address As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
    Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal wndProc As VarPtrCallbackDelegate, ByRef var As Short, _
      ByVal unused1 As Integer, ByVal unused2 As Integer, _
      ByVal unused3 As Integer) As Integer
    Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal wndProc As VarPtrCallbackDelegate, ByRef var As Integer, _
      ByVal unused1 As Integer, ByVal unused2 As Integer, _
      ByVal unused3 As Integer) As Integer
    Private Shared Function VarPtrCallback(ByVal address As Integer, ByVal unused1 As Integer, ByVal unused2 As Integer, ByVal unused3 As Integer) As Integer
      Return address
    End Function
    Private Shared Function VarPtr(ByRef var As Short) As Integer
      Return CallWindowProc(AddressOf VarPtrCallback, var, 0, 0, 0)
    End Function
    Private Shared Function VarPtr(ByRef var As Integer) As Integer
      Return CallWindowProc(AddressOf VarPtrCallback, var, 0, 0, 0)
    End Function

    <DllImport("Kernel32.dll")>
    Private Shared Function GetCurrentProcess() As IntPtr
    End Function

    <DllImport("ntdll.dll")>
    Private Shared Function ZwSetInformationProcess(ByVal _1 As IntPtr, ByVal _2 As IntPtr, ByVal _3 As IntPtr, ByVal _4 As IntPtr) As IntPtr
    End Function

    Public Shared Sub Main()
      ZwSetInformationProcess(GetCurrentProcess(), &H21&, VarPtr(&H8000F129), &H4&)
    End Sub
End Class

I never said i choose the one i send it to.
I have just send the direct link to every user that pmed me.

[ali_m0000]

May I have the code please ?
I will pm u

---

Ooops I just discovered that I can't pm you
will you please pm me ?

[nathan72389]

May I have the code please ?
I will pm u

---

Ooops I just discovered that I can't pm you
will you please pm me ?

just signed up to leach something.
too bad you cant read because you would of seen that the code is posted in the post DIRECTLY before yours.

[CottleSilver]

Test on windows 8:
Spoiler (Click to View)

[Menalix]

Worst shit code......
It's so easy preventing process from being killed anyways, just unlist it with NtQuerySystemInformation hook.

[nepHaXOr]

Private me good method. Seems you are pro in this methods :D

[AshleyUK]

Private me good method. Seems you are pro in this methods :D

You do realize the last post was 5 months ago. The post also says to PM him not to grave dig.