Member Avatar for onlinessp

hi,
I want c# source code for process killer as task manger
-> it forcefully kill the process which i want
<->it may be system process

  • 3 Contributors
  • 11 Replies
  • 187 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by privatevoid

Dani AI

Generated

As described, the typical, robust pattern used by real AV products is to split responsibilities: a low‑privilege scanner/UI runs in the user session and a privileged service (or driver) running as LocalSystem performs any operation that requires system rights (process termination, file quarantine, driver-level scanning). ’s warning is valid — killing arbitrary processes is powerful and must be gated by strong checks.

Practical architecture and flow (high level):

Scanner (user) finds suspect file -> sends signed/authorized request -> Service (LocalSystem) validates file/path/signature ->
attempt graceful shutdown (CloseMainWindow / polite IPC) -> if still unsafe, escalate to termination/quarantine -> log result

Why you saw “Access denied”

  • Insufficient privileges: a non‑elevated process cannot open/terminate processes owned by other users or SYSTEM. Running the termination code in a LocalSystem service avoids UAC/session limits.
  • Cross‑bitness & module access: a 32‑bit process frequently cannot read MainModule info from 64‑bit processes; querying module path from a 64‑bit service or using QueryFullProcessImageName/WMI avoids that.
  • Protected processes / system components: some system services and protected AV processes cannot be terminated from user mode. “System Volume Information” is a protected location; the services interacting with it may be critical or kernel‑protected.

Design and safety tips

  • Never allow unauthenticated UI requests to cause kills. Require the service to validate that the running process actually matches the infected file (path + hash + signature).
  • Prefer graceful shutdown first; use forced termination only as a last resort. Log everything and provide rollback/quarantine so killing a process doesn’t brick the machine.
  • Test across OS versions and on both x86/x64; handle exceptions when accessing process modules; run tests in VMs.

As suggested, use a secure IPC (named pipe/WCF/RPC) for requests and keep the privileged thread in a service. This keeps the scanner usable for limited users while centralizing privileged operations safely.

Recommended Answers

All 11 Replies

Member Avatar for Nick Evan

This reeks of "virus". You'll now have to convince me otherwise, or this thread is closed.

Edited by Nick Evan because: n/a
Member Avatar for onlinessp

I am developing an anti-virus in which i want to use this code.
it's only for ethical purpose
i can tell u complete detail of this software what i want to do with it.


1->when a virus found the system will check about the file name and the dependent process of file and forcefully close it.i want want to do only this its not for unethical purpose
2-> And also it's not against the rules

Thanks

Member Avatar for privatevoid

Have a look at the below, the System.Diagnostics.Process class.

Process[] processes = Process.GetProcesses();
...                      
Process p = Process.GetProcessesByName("aname");
p.Kill();
Member Avatar for onlinessp

I am also using the same code but

->i didn't know how to get the file name of a process
that's main problem occurring know

Member Avatar for privatevoid

You mean like this:

foreach(Process p in Process.GetProcesses())
{
    ProcessModule pm = p.MainModule;
    if(pm.FileName == "aname")
    {
        p.Kill();
    }
}
Member Avatar for privatevoid

If thats not good enough you could look at using wmi like this

private void wmiProcessDetails()
        {
            string queryString = "SELECT * FROM Win32_Process";

            SelectQuery query = new SelectQuery(queryString);

            ManagementObjectSearcher searcher = new ManagementObjectSearcher(queryString);
            ManagementObjectCollection processes = searcher.Get();


            foreach (ManagementObject mo in processes)
            {
                messageView.AppendText(String.Format("Name:\t{0} {1}\n", mo["Name"], mo["Handle"]));
                messageView.AppendText(String.Format("Path:\t{0}\n", mo["ExecutablePath"]));
                messageView.AppendText(String.Format("Install Date:\t{0}\n", mo["InstallDate"]));
                messageView.AppendText(String.Format("Command Line:\t{0}\n", mo["CommandLine"]));
                messageView.AppendText(String.Format("Caption:\t{0}\n\n",mo["Caption"]));
            }
        }
Member Avatar for onlinessp

sir when i am using this code when i kill the process of system volume information i get an error which show access denied

can u help me again

You are realy my great teacher
Thank's Again:)

Edited by onlinessp because: spell mistake
Member Avatar for privatevoid

According to microsoft the user account used by the program must either of created a process or be an administrator to kill it.

That basically means that you will have to run the program using an admin account and if its vista or Win 7 using run as administrator.

Member Avatar for onlinessp

But Dear Sir,


According to my information anti virus are doing scanning from limited user are able to kill that process then how they do it?

Thanks Again,

Member Avatar for onlinessp

But Dear Sir,


According to my information anti virus are doing scanning from limited user are able to kill that process then how they do it?

Thanks Again,

Member Avatar for privatevoid

Most AntiVirus programs run a number of services on the System account and a tray app within the current user. Look at "Inter Process Communication (IPC)" or using a intermediate database to do this.

The actual thread killing part will have to be in an admin account for your purposes.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.