本帖最后由 ~零度 于 2018-4-21 15:57 编辑
楼主在安装QQ之后发现后台总是存在名为“QQProtect.exe”的进程，并且修改应用程序服务的方式时提示拒绝访问，而且不知为何在自己的电脑上无法使用“tasklist、taskkill”等命令，所以基于Windows API和C++编写了这个自动检测进程和杀死进程的命令行工具。您可以将“killprocess /e QQProtect”添加为开机启动来实现阻止黑名单程序的运行。
使用方法（英文）：
中文翻译：
KillProcess 版本: 1.0 构建日期: 2018 / 4 / 21 作者:～零度( @52PoJiE )
用法:
killprocess [ / E EXE文件名] [ /I 两次检测的时间间隔] [ /M 最大运行时间] [ /N 最大杀进程次数]
/E 指定进程名称。这是必要的参数。
/I 指定检测之间的间隔(以秒为单位，默认值: 3 )。如果此值小于或等于0，程序将连续检测(不推荐)。
/M 指定此程序的最长时间(以秒为单位，默认值: 30 )。如果此值小于或等于0，程序将连续运行。
/N 指定成功终止进程的最大次数(默认值: 1 )。如果此值小于或等于0，则次数将是无限的。
您可以将此程序添加到PATH环境变量中。
不带参数运行程序可以查看帮助信息，不区分大小写，后缀".exe"可写可不写。
killprocess.rar
(156.7 KB, 下载次数: 94)
如果有什么问题欢迎大家和我讨论！编写程序不易，如果您觉得好用，望给个评分。开发平台：Win7 x86_64
以下是源代码：[C++] 纯文本查看 复制代码 #include <windows.h>
#include <process.h>
#include <Tlhelp32.h>
#include <winbase.h>
#include <string.h>
#include <iostream>
#include <cstdio>
#include <ctime>
using namespace std;
int success(0);
bool killProcess(const char *filename)
{
HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL);
PROCESSENTRY32 pEntry;
pEntry.dwSize = sizeof (pEntry);
BOOL hRes = Process32First(hSnapShot, &pEntry);
bool match=false;
int i;
while (hRes)
{
for(i=0; filename[i]!='\0'&&pEntry.szExeFile[i]!='\0'; ++i)
if(filename[i]!=pEntry.szExeFile[i]&&(filename[i]-pEntry.szExeFile[i])!=32&&(pEntry.szExeFile[i]-filename[i])!=32)
{
match=false;
break;
}
else
{
match=true;
}
if(match&&pEntry.szExeFile[i]!='\0')
{
if(pEntry.szExeFile[i]!='.'||(pEntry.szExeFile[i+1]!='e'&&pEntry.szExeFile[i+1]!='E')||(pEntry.szExeFile[i+2]!='x'&&pEntry.szExeFile[i+2]!='X')||(pEntry.szExeFile[i+3]!='e'&&pEntry.szExeFile[i+3]!='E')||pEntry.szExeFile[i+4]!='\0')
{
match=false;
}
}
if (match)
{
HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, 0,(DWORD) pEntry.th32ProcessID);
if (hProcess != NULL)
{
TerminateProcess(hProcess, 9);
++success;
CloseHandle(hProcess);
CloseHandle(hSnapShot);
return true;
}
}
hRes = Process32Next(hSnapShot, &pEntry);
}
CloseHandle(hSnapShot);
return false;
}
typedef struct _MyData//Parameter structure to the child thread
{
char *EXEFileName;
int TimeInterval,NumofTimes;
} MYDATA, *PMYDATA;
DWORD WINAPI ThreadProc(LPVOID lpParam)
{
PMYDATA pData;
pData=(PMYDATA)lpParam;
int TimeInterval=pData->TimeInterval,NumofTimes=pData->NumofTimes;
char *EXEFileName=pData->EXEFileName;
for(;;)
{
killProcess(EXEFileName);
if(NumofTimes>0&&success>=NumofTimes)return 0;
if(TimeInterval>0)Sleep(TimeInterval*CLOCKS_PER_SEC);
}
return 0;
}
int main(int argc,char *argv[])
{
int TimeInterval(3),MaximumTime(30),NumberofTimes(1);
char *EXEFileName(NULL);
if(argc<=1)
{
cout<<"KillProcess Version:1.0 Build Date:2018/4/21 Author:~零度(@52pojie)\n"
<<"Usage:\n\n killprocess [/E EXE File Name] [/I Time Interval] [/M Maximum Time] [/N Number of Times]\n"
<<"\n /E Specifies the process name. This is a necessary parameter.\n"
<<"\n /I Specifies the interval between detections(in seconds,default:3). If this value is less than or equal to 0, the program will detect continuously(not recommended).\n"
<<"\n /M Specifies the maximum time for this program(in seconds,default:30). If this value is less than or equal to 0, the program will run continuously.\n"
<<"\n /N Specifies the maximum number of successfully terminating the process(default:1). If this value is less than or equal to 0, the number of times will be infinite.\n"
<<"\n\n You can add this program to your PATH environmental variable.\n";
return 0;
}
else
{
for(int i=1; i<argc; i+=2)
{
if(argv[i][0]=='/')
switch(argv[i][1])
{
case 'E':
case 'e':
EXEFileName=argv[i+1];
break;
case 'I':
case 'i':
sscanf(argv[i+1],"%d",&TimeInterval);
break;
case 'M':
case 'm':
sscanf(argv[i+1],"%d",&MaximumTime);
break;
case 'N':
case 'n':
sscanf(argv[i+1],"%d",&NumberofTimes);
break;
default:
cout<<"Error: Unknown Parameters!\nYou can run this program without parameters to see the usage.\n";
return -1;
}
else
{
cout<<"Error: Unknown Parameters!\nYou can run this program without parameters to see the usage.\n";
return -1;
}
}
}
if(EXEFileName==NULL)
{
cout<<"Error: [/E EXEFileName] is a necessary parameter.You can run this program without parameters to see the usage.\n";
return -1;
}
else
{
if(MaximumTime<=0)
for(;;)
{
killProcess(argv[1]);
if(NumberofTimes>0&&success>=NumberofTimes)
return success;
if(TimeInterval>0)Sleep(TimeInterval*CLOCKS_PER_SEC);
}
else
{
HANDLE hThread;
DWORD ThreadId;
PMYDATA pData=(PMYDATA)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(MYDATA));
pData->EXEFileName=EXEFileName;
pData->TimeInterval=TimeInterval;
pData->NumofTimes=NumberofTimes;
hThread=CreateThread(NULL,0,ThreadProc,pData,0,&ThreadId);
//Create a child thread to compute DFT directly
if(WaitForMultipleObjects(1,&hThread, TRUE, MaximumTime*CLOCKS_PER_SEC))
{
TerminateThread(hThread,-1);
}
//wait for the child thread to return, if time exceeded then kill the child thread
CloseHandle(hThread);
}
return success;
}
}
| 
[复制链接]
发表于 2018-4-21 15:53
|
发表于 2018-4-21 18:39
