How to make my program cannot be killed by pskill?

NTFSD
1

Hello,

How to make my program cannot be killed by Process Explorer, pskill.exe and
Windows Task Manager?

regards,
walker

2

Hook NtTerminateProcess or NtOpenProcess and decline the kill request.
That’s the only way AFAIK.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of WalkerNet
Sent: Tuesday, 7 March 2006 2:12 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] How to make my program cannot be killed by pskill?

Hello,

How to make my program cannot be killed by Process Explorer, pskill.exe
and Windows Task Manager?

regards,
walker

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@pctools.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

3

ooops didn’t know your question was already answered here by Sean. By the
way, how you hook will matter. I think the SSDT patching would work great in
your case.

4
  1. This dicussion belongs more in ntdev than ntfsd, you should post there,
    which yuo did, since you cross posted :frowning:
  2. You should ignore the bad advice to hook NtTerminateProcess otherwise you
    indeed will be the author of the malware, in which case you should self
    terminate (sounds a bit like a quite from a movie) :slight_smile:

“WalkerNet” <walker_net> wrote in message news:xxxxx@ntfsd…
> Hello,
>
> How to make my program cannot be killed by Process Explorer, pskill.exe
> and
> Windows Task Manager?
>
> regards,
> walker
>
>
>
></walker_net>