nsProcess plugin

[jpodtbc]

problem trying to kill a service process. i can find the process but when i try to kill it i get return code 601 (no permission to kill process). i am running the installer as an administrator and can kill the process manually.

please help.

[{_trueparuex^}]

Killing service like that is really not very smart. Rather try to stop it with some of these methods.

http://nsis.sourceforge.net/How_do_I_start/stop/create/remove/check_a_service

[jpodtbc]

thanks but i already have service control implemented in the installer. the problem is when the service is unresponsive and cannot be shut down any other way. i think we can all agree that it is bad to have the installer hang indefinitely.

[jpodtbc]

i found a solution by modifying the nsProcess source code and using code provided here:

http://www.alexfedotov.com/articles/killproc.asp?pane=0

[hbatista]

Hi jpodtbc, I'm having the exact same problem as you.
Could you be so kind to post your solution here?
Thanks a lot

[hbatista]

I ended up changing it myself. Here is the source code and dll if someone wants to use it.

[jpodtbc]

thanks man...i was about to put up my modified source but you beat me to it.

[hbatista]

No problem, I was facing a really tight deadline so I had to go for it.

[Whizz]

Trojan AV Trigger

Originally posted by CharlesB2
Hey,

Since recent update of McAfee VirusScan, the use of a previous nsProcess version was detected as a Trojan (generic prockill.a)!! The last version (1.5) does not cause the problem. Thanks a lot!

Cheers

This is still happening, even with 1.5 of nsProcess. It is being detected as HackTool.ProcKill.A by several AV packages.

Is there any chance of a major change with this DLL to prevent this detection? The DLL itself is really useful, but it looks like someone has used it for less than honest purposes .

I have had to take it out of several of my installers for until this can be fixed.

[CharlesB2]

Re: Trojan AV Trigger

Originally posted by Whizz
This is still happening, even with 1.5 of nsProcess. It is being detected as HackTool.ProcKill.A by several AV packages.

Is there any chance of a major change with this DLL to prevent this detection? The DLL itself is really useful, but it looks like someone has used it for less than honest purposes .

The best way to handle the problem is to recompile the DLL by removing the function that kills a process, since I believe it is the one that is used by trojans. I have done it myself, if you're interested I can put it on the wiki...

Cheers

[Whizz]

Re: Re: Trojan AV Trigger

Originally posted by CharlesB2
The best way to handle the problem is to recompile the DLL by removing the function that kills a process, since I believe it is the one that is used by trojans. I have done it myself, if you're interested I can put it on the wiki...

Cheers

That sounds good, but actually I do need the kill a process function. So taking it out would be a bit of a pain.

Do you have the full source (or anyone else out there) for a Micro$oft compiler and can provide a link?

I presume its coded in C/++. I might try to obfuscate it and re-compile to see if that gets it through.

[CharlesB2]

Re: Re: Re: Trojan AV Trigger

Originally posted by Whizz
That sounds good, but actually I do need the kill a process function. So taking it out would be a bit of a pain.

Do you have the full source (or anyone else out there) for a Micro$oft compiler and can provide a link?

I presume its coded in C/++. I might try to obfuscate it and re-compile to see if that gets it through.

The source is in the archive, on the wiki page: http://nsis.sourceforge.net/NsProcess_plugin

Cheers

[JamesKiller]

when I am using this plugins, i have a problem which can not kill the old vesion of my application.
for example: i have version 1 : myservice
i make a new build, then install it, it can't kill verison 1 process?
I think it would a bug ???
Any thoughts?

[goldy1064]

Well, if version 1 is a service, as the name you gave implies, you would need to ensure that it won't auto-recover when killed.

[Whizz]

Originally posted by JamesKiller
when I am using this plugins, i have a problem which can not kill the old vesion of my application.
for example: i have version 1 : myservice
i make a new build, then install it, it can't kill verison 1 process?
I think it would a bug ???
Any thoughts?

Services are not really like a normal program process. They are controlled by the 'Services Controller' (SC) which deals with both services and devices.

You should 'stop' your service officially, advise the SC to remove it from the database, update it, reload into the database and then 'start' it again.

If it is a protected service, then you have to advise the SC to make the changes at next boot up. Which is really quite difficult in the newer OS's of XP/Vista. And probably you shouldn't be touching anyway.

NSProcess is probably not the plugin for you when dealing with services.