problem trying to kill a service process. i can find the process but when i try to kill it i get return code 601 (no permission to kill process). i am running the installer as an administrator and can kill the process manually.
please help.
nsProcess plugin
73 posts
Killing service like that is really not very smart. Rather try to stop it with some of these methods.
thanks but i already have service control implemented in the installer. the problem is when the service is unresponsive and cannot be shut down any other way. i think we can all agree that it is bad to have the installer hang indefinitely.
i found a solution by modifying the nsProcess source code and using code provided here:
Hi jpodtbc, I'm having the exact same problem as you.
Could you be so kind to post your solution here?
Thanks a lot
Could you be so kind to post your solution here?
Thanks a lot
I ended up changing it myself. Here is the source code and dll if someone wants to use it.
thanks man...i was about to put up my modified source but you beat me to it.
No problem, I was facing a really tight deadline so I had to go for it. 🙂
Trojan AV Trigger
Is there any chance of a major change with this DLL to prevent this detection? The DLL itself is really useful, but it looks like someone has used it for less than honest purposes 👎 .
I have had to take it out of several of my installers for until this can be fixed.
Originally posted by CharlesB2This is still happening, even with 1.5 of nsProcess. It is being detected as HackTool.ProcKill.A by several AV packages.
Hey,
Since recent update of McAfee VirusScan, the use of a previous nsProcess version was detected as a Trojan (generic prockill.a)!! The last version (1.5) does not cause the problem. Thanks a lot!
Cheers
Is there any chance of a major change with this DLL to prevent this detection? The DLL itself is really useful, but it looks like someone has used it for less than honest purposes 👎 .
I have had to take it out of several of my installers for until this can be fixed.
Re: Trojan AV Trigger
Cheers
Originally posted by WhizzThe best way to handle the problem is to recompile the DLL by removing the function that kills a process, since I believe it is the one that is used by trojans. I have done it myself, if you're interested I can put it on the wiki...
This is still happening, even with 1.5 of nsProcess. It is being detected as HackTool.ProcKill.A by several AV packages.
Is there any chance of a major change with this DLL to prevent this detection? The DLL itself is really useful, but it looks like someone has used it for less than honest purposes 👎 .
Cheers
Re: Re: Trojan AV Trigger
Do you have the full source (or anyone else out there) for a Micro$oft compiler and can provide a link?
I presume its coded in C/++. I might try to obfuscate it and re-compile to see if that gets it through.
Originally posted by CharlesB2That sounds good, but actually I do need the kill a process function. So taking it out would be a bit of a pain.
The best way to handle the problem is to recompile the DLL by removing the function that kills a process, since I believe it is the one that is used by trojans. I have done it myself, if you're interested I can put it on the wiki...
Cheers
Do you have the full source (or anyone else out there) for a Micro$oft compiler and can provide a link?
I presume its coded in C/++. I might try to obfuscate it and re-compile to see if that gets it through.
Re: Re: Re: Trojan AV Trigger
Cheers
Originally posted by WhizzThe source is in the archive, on the wiki page: http://nsis.sourceforge.net/NsProcess_plugin
That sounds good, but actually I do need the kill a process function. So taking it out would be a bit of a pain.
Do you have the full source (or anyone else out there) for a Micro$oft compiler and can provide a link?
I presume its coded in C/++. I might try to obfuscate it and re-compile to see if that gets it through.
Cheers
when I am using this plugins, i have a problem which can not kill the old vesion of my application.
for example: i have version 1 : myservice
i make a new build, then install it, it can't kill verison 1 process?
I think it would a bug ???
Any thoughts?
for example: i have version 1 : myservice
i make a new build, then install it, it can't kill verison 1 process?
I think it would a bug ???
Any thoughts?
Well, if version 1 is a service, as the name you gave implies, you would need to ensure that it won't auto-recover when killed.
Originally posted by JamesKillerServices are not really like a normal program process. They are controlled by the 'Services Controller' (SC) which deals with both services and devices.
when I am using this plugins, i have a problem which can not kill the old vesion of my application.
for example: i have version 1 : myservice
i make a new build, then install it, it can't kill verison 1 process?
I think it would a bug ???
Any thoughts?
You should 'stop' your service officially, advise the SC to remove it from the database, update it, reload into the database and then 'start' it again.
If it is a protected service, then you have to advise the SC to make the changes at next boot up. Which is really quite difficult in the newer OS's of XP/Vista. And probably you shouldn't be touching anyway. 😁
NSProcess is probably not the plugin for you when dealing with services. 🙁
What AV packages are triggered by nsProcess?
Hi,
is it still an issue that nsProcess is trigger AV packages as a trojan virus?
If so do you have a list of such AV packages?
I would like to check my installer for such problem.
Hi,
is it still an issue that nsProcess is trigger AV packages as a trojan virus?
If so do you have a list of such AV packages?
I would like to check my installer for such problem.
I have not seen the problem since I re-compiled the source code myself, using my own compiler. Rather than using the distributed version from the download location. This is the distro version I use now.
When I was experimenting, I found that the following AV systems did trigger a false detection:
Panda
Macafee/NAI
BitDefender
F-Secure
Symantec/Norton
I did not have access to any other AV engines to test further. Actually 1 detection was too many!!! 😱
Once I recompiled and the issue went away, then I did not test any further. Nor have I tried downloading to see if there was a newer version by the author.
I guess the original was being compiled with an non-fully patched version of MS:C++. I did no changes, just compiled and used the resultant file.
When I was experimenting, I found that the following AV systems did trigger a false detection:
Panda
Macafee/NAI
BitDefender
F-Secure
Symantec/Norton
I did not have access to any other AV engines to test further. Actually 1 detection was too many!!! 😱
Once I recompiled and the issue went away, then I did not test any further. Nor have I tried downloading to see if there was a newer version by the author.
I guess the original was being compiled with an non-fully patched version of MS:C++. I did no changes, just compiled and used the resultant file.
Is there source code available for the nsProcess plugn?
As stated by CharlesB2 earlier in the thread. It is in the Archive on the Wiki page.
Did you read the whole of this thread?? I guess not.🙄
Did you read the whole of this thread?? I guess not.🙄
Do you have a link to your re-compiled DLL by any chance, Whizz? Maybe you could add it to the wiki? I don't do much Windows programming and don't have everything set up to compile my own. You can also reach me at "a" at my domain --- littleshoot.org. Would be a huge help. I'd even paypal you $10 -- seriously.
-Adam Fisk
-Adam Fisk
I've patched this plugin to add a CloseProcess method, a nicer alternative to KillProcess.
I offer no guarantees as to its quality, as C++ is not my primary skill. However, the updated nsProcess.c file is attached for anyone who might find it useful.
I offer no guarantees as to its quality, as C++ is not my primary skill. However, the updated nsProcess.c file is attached for anyone who might find it useful.
Any plans to make a version that could be used to kill processes by PID?
Hello,
the plugin works well for normal build of nsis under x64. However, it failed to find processes for nsis unicode build
Do you have a solution for this?
Thanks in advance
the plugin works well for normal build of nsis under x64. However, it failed to find processes for nsis unicode build
Do you have a solution for this?
Thanks in advance
Windows 7
Hello,
FYI, the FindProcess function works on Windows 7 - even when the process was started by a different user. Thanks! 😉
Hello,
FYI, the FindProcess function works on Windows 7 - even when the process was started by a different user. Thanks! 😉
It won't work on x64 Windows (unless it uses WMI).
Stu
Stu
nsProcess 1.6 with NSIS UNICODE support
It actually works for me on Win7 x64, but I have UAC prompts disabled, mb this is the reason.
Please find NSIS UNICODE/ANSI version attached, I'm too lazy to rebuild installer so you'll have to rename nsProcessW.dll to nsProcess.dll manually.
It also contains new function _CloseProcess, which tries to close all windows first, waits for 3 seconds for process to exit (so it can save all data), and then terminates it.
It actually works for me on Win7 x64, but I have UAC prompts disabled, mb this is the reason.
Please find NSIS UNICODE/ANSI version attached, I'm too lazy to rebuild installer so you'll have to rename nsProcessW.dll to nsProcess.dll manually.
It also contains new function _CloseProcess, which tries to close all windows first, waits for 3 seconds for process to exit (so it can save all data), and then terminates it.
Hi,for me this plugin doesn't work,I'm on W10x64 ,NSIS v3.02.1
Example code always returns value 6 for any process tested
There is other alternative to find a running process?
thanks!
Example code always returns value 6 for any process tested
There is other alternative to find a running process?
thanks!
hi my friendOriginally Posted by mrjohn View PostHi,for me this plugin doesn't work,I'm on W10x64 ,NSIS v3.02.1
Example code always returns value 6 for any process tested
There is other alternative to find a running process?
thanks!
also i have windows 10 x64
i tested,everything is right,Perhaps you are faced with this problem: in windows 10 Calc.exe process name is Calculator.exe you must edit example scrip!
if plugin not found process name return 603 and if find process return 0 !
this is nsProcess plugin return values:
// Return codes are as follows: // 0 = Success // 601 = No permission to terminate process // 602 = Not all processes terminated successfully // 603 = Process was not currently running // 604 = Unable to identify system type // 605 = Unsupported OS // 606 = Unable to load NTDLL.DLL // 607 = Unable to get procedure address from NTDLL.DLL // 608 = NtQuerySystemInformation failed // 609 = Unable to load KERNEL32.DLL // 610 = Unable to get procedure address from KERNEL32.DLL // 611 = CreateToolhelp32Snapshot failed
FindProcDLL::FindProc "Calculator.exe" MessageBox MB_OK "$R0"
and if found process return 1
I've solved for my case using a simple trick:trying to open main exe file for append and catch error in case if it is running
@r2du-soft: I've done test again, nsProcess 1.6 gives me always value 6 for any process tested,and your second solution gives always 0,dll downloaded from there