Click here to Skip to main content
15,895,142 members
Articles / Desktop Programming / Win32

Process Suspender and Advanced Terminator

Rate me:
Please Sign up or sign in to vote.
4.94/5 (10 votes)
28 Feb 2013CPOL3 min read 53.2K   4.8K   23  
This article explains using unmanaged APIs to suspend and terminate processes.
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Diagnostics;
using System.IO;

namespace kill_virus
{
    public partial class Intrfc : Form
    {
        KernelCalls kc = new KernelCalls();
        bool IsSuspended=false;
        List<int> SusLis = new List<int>();
        
        public Intrfc()
        {
            InitializeComponent();
        }

        private void Intrfc_Load(object sender, EventArgs e)
        {
            populateLB();
        }

        private void Movepl_Click(object sender, EventArgs e)
        {
            System.Collections.IEnumerator enumerator = Plist.SelectedItems.GetEnumerator();
            while (enumerator.MoveNext())
            {
                Object p = (Object)enumerator.Current;
                Selpl.Items.Add(Plist.GetItemText(p));
            }
            UpdateContrls();          
           
        }

        private void Rempl_Click(object sender, EventArgs e)
        {
            Object[] divoba=new Object[Selpl.SelectedItems.Count];           
            Selpl.SelectedItems.CopyTo(divoba, 0);
            foreach(Object disval in divoba)
            {
                Selpl.Items.Remove(disval);
            }
            
        }

        private void kill_Click(object sender, EventArgs e)
        {
            ActionType(2);
        }

        private void Refresh_Click(object sender, EventArgs e)
        {
            populateLB();
        }

        private void populateLB()
        {
            Process[] prcs = Process.GetProcesses();
            Plist.Items.Clear();
            foreach (Process pn in prcs)
            {
                
                Plist.Items.Add(String.Format("{0}, ({1})",pn.ProcessName, pn.Id ));
            }
        }

        private void Plist_SelectedIndexChanged(object sender, EventArgs e)
        {
            try
            {
                if (Plist.SelectedItems.Count < 2)
                {

                    InfoBox.ReshowDelay=1;
                    String[] prvl = (Plist.GetItemText(Plist.SelectedItem)).Split(',');
                    InfoBox.ToolTipTitle = prvl[0];
                    int prid = int.Parse((prvl[1].Replace('(', ' ')).Replace(')', ' '));
                    Process piin = Process.GetProcessById(prid);
                    ProcessModule spm = piin.MainModule;

                    InfoBox.Show(String.Format("Filename:{0}\nMemory Size:{1}\nCreation Time:{2}", spm.FileName, spm.ModuleMemorySize, File.GetCreationTime(spm.FileName)), Plist);
                }
            }
            catch { }
        }

        private void Suspend_Click(object sender, EventArgs e)
        {
            if (IsSuspended)
            { ActionType(0); }
            else { ActionType(1); }
        }

        private void ActionType(int level)
        {
            List<int> pidtk = new List<int>();
            try
            {
                foreach (Object sobj in Selpl.Items)
                {
                    String[] prvl = (Plist.GetItemText(sobj)).Split(',');
                    InfoBox.ToolTipTitle = prvl[0];
                    int prid = int.Parse((prvl[1].Replace('(', ' ')).Replace(')', ' '));
                    pidtk.Add(prid);
                                   
                }

                if ((level == 0) & (IsSuspended))
                {
                    
                    foreach (int prd in SusLis)
                    {
                        try
                        {
                            if (!Process.GetProcessById(prd).HasExited)
                            {
                                kc.ResumeProcess(prd);                                
                            }

                        }
                        catch { }
                    }
                    SusLis.Clear();
                    IsSuspended = false;
                    
                }

                if ((level == 1 | level == 2) & (!IsSuspended))
                {
                    SusLis.Clear();
                    foreach (int prd in pidtk)
                    {
                        try
                        {
                            if (!Process.GetProcessById(prd).HasExited)
                            {
                                kc.SuspendProcess(prd);
                                SusLis.Add(prd);
                            }
                                
                        }
                        catch { }
                    }
                    IsSuspended = true;
                }

                if (level == 2)
                {

                    foreach (int prd in pidtk)
                    {
                        try
                        {
                            if (!Process.GetProcessById(prd).HasExited)
                                Process.GetProcessById(prd).Kill();
                        }
                        catch { }
                    }
                    IsSuspended = false;
                    Selpl.Items.Clear();
                }

                UpdateContrls();

            }
            catch { }
            
        }

        private void UpdateContrls()
        {
            if (IsSuspended)
            {
                Suspend.Text = "Resume";
            }
            else { Suspend.Text = "Suspend"; }
            if (Selpl.Items.Count > 0 & !Suspend.Enabled)
            {
                Suspend.Enabled = true;
            }
            if (Selpl.Items.Count <1) 
            {
                Suspend.Enabled = false;
            }
        }
    }
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Systems Engineer
United States United States
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Comments and Discussions