Tcc Antivirus Prevent From Terminating Process Delphi

Asked

Viewed 232 times

1

I am completing a project, creating an application that simulates an antivirus.

The application is in Delphi, what I want to know is how antivirus do to register a process as user system, and when you click to finish the process appears , 'Access Denied!'.

Below I found a light only that records the process in the system, but without success.

Function RegisterServiceProcess(DwProcessID, dwType: DWord): DWord; StdCall; External 'KERNEL32.dll';
//Para chamar
RegisterServiceProcess(GetCurrentProcessID, 1);

Some light?

delphi delphi-7 delphi-xe3

1 answer

1


In Form Create add the call to that function:

function PreventProcessKill: Integer;
var
  hProcess:Thandle;
  EmptyDacl: TACL ;
  pEmptyDacl: PACL ;
  dwErr : DWORD ;
begin
  hProcess := GetCurrentProcess();
  ZeroMemory(@EmptyDacl, SizeOF(tacl));
  pEmptyDacl := @EmptyDacl;

  if (not InitializeAcl(EmptyDacl, sizeof(tACL), 2)) then
    dwErr := GetLastError()
  else  
    dwErr := SetSecurityInfo(OpenProcess(PROCESS_ALL_ACCESS, False, GetCurrentProcessID),
             SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, nil, nil, @ACL, nil);
  Result:= dwErr;
end;

You need to declare in uses: Aclapi and Accctrl.

Note: Accctrl is a Dll, usually not found in all versions windows

  • Great tip, however my project is occurring an error when starting, it is not able to interpret @ACL in the part of Else. I tested and if I put nil it rotates normally, know tell me what can be?

  • Does this function start my process as a system user? tried to compile and as you reported there was an error related to Accctrl, exactly on that line SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, nil, @ACL, nil); what would be the solution .

  • A process started as a system does not guarantee that it cannot be completed! This function increases the security level of your process, in order not to be able to terminate by other means, about the error is as I said, you need the DLL, you will have to expand your search!

Browser other questions tagged delphi delphi-7 delphi-xe3

You are not signed in. Login or sign up in order to post.