Today I'm gonna show you how to kill a process using a very short vbscript code.
There are some reasons why you want to use VBscript to kill a process instead of using task manager or dos commands. One of the reason is to counter the virus activity, and that is our goal in this how to blog.
There are some viruses nowadays that disables regedit, taskmanager, and dos command. If that happens you cannot terminate a malicious process using taskmanager or dos command, and you cannot edit your registry using regedit or dos command so that you can remove values that is made by virus.
The only way (for me) we can get through in this situation is to use VBScript (.vbs). VBScript stands for Visual Basic Scripting.
We can create .vbs file in this way:
Go to run and type 'notepad', without quotes, then press enter. A notepad will open, then go to file then click Save As.. then change the Save As Type into All Files. Then insert .vbs at the end of your file name. Example: (myfilename.vbs).
Listing all processes without using Taskmanager or DOS Commands
First create a vbs file by following the instructions above, then inside it paste this code:
set a=getobject("winmgmts://./root/cimv2")
set b = a.execquery("SELECT * FROM Win32_process")
for each c in b
str=str & vbcrlf & c.name
next
wscript.echo str
wscript.quit
Save it as 'view_process.vbs', then double click it to execute the code. You will see a new window will appear that has a list of all the processes running in your computer. Now write down the process name that you want to kill. (ex. notepad.exe)
Killing/Terminating a process without using Taskmanager or DOS Commands
Make a new .vbs file by following the instructions above, then paste this code:
set a=getobject("winmgmts://./root/cimv2")
set b = a.execquery("SELECT * FROM Win32_process WHERE name='notepad.exe'")
for each c in b
c.terminate()
next
wscript.echo "process killed"
wscript.quit
NOTE: the second and third line of codes is not separate, that is, it should be one line only "set b = a.execquery("SELECT * FROM Win32_process WHERE name='notepad.exe'")"
Save it as 'kill_process.vbs', then go to Start click RUN then type NOTEPAD then press enter. Then run the kill_process.vbs by double clicking the file. You will notice that the notepad you had opened will disappear! Thats how this code does.
So if you found for example 'scvhost.exe' in the list of processes that you have created then replace notepad.exe with scvhost.exe in the above code.
By the way, the process SCVHOST.EXE is not a legitimate windows process, the legit process name is SVCHOST.EXE. Note the first three letters of the two processes.
Thats all folks!
Read More...
Summary only...
Posts
