请问如何杀死系统守护进程

clever101
博客专家认证
2018-03-15 04:43:18
公司安装了u盘管理工具来禁止u盘访问。我查看了一下这个u盘管理工具是有两个守护进程来监控的,用任务管理器无法杀死。另外u盘管理工具的安装目录也无法打开。

请问如何杀死这两个守护进程呢?
...全文
943 13 打赏 收藏 转发到动态 举报
AI 作业
写回复
用AI写文章
13 条回复
切换为时间正序
请发表友善的回复…
发表回复
fronz 2018-04-10
  • 打赏
  • 举报
回复
可以尝试下,无法杀死是否是因为两个进程之间有相互监视的作用?
clever101 2018-03-19
  • 打赏
  • 举报
回复
引用 8 楼 zhao4zhong1 的回复:
使用autoruns工具禁用相关驱动?
这个是先找出那个保护程序相关的驱动吧。
clever101 2018-03-19
  • 打赏
  • 举报
回复
引用 7 楼 zhao4zhong1 的回复:
[quote=引用 6 楼 clever101 的回复:] [quote=引用 5 楼 zhao4zhong1 的回复:] MOVEFILE_DELAY_UNTIL_REBOOT
大侠,调用了MoveFileEx(_T("C:Program file\ProtectProgram"),NULL,MOVEFILE_DELAY_UNTIL_REBOOT); 函数的返回值为1,但是重启后程序依然没有删掉。[/quote] 试试调用完之后,立即切断电源再接通电源。后果自负。[/quote] 赵老师,试了还是不行。
赵4老师 2018-03-19
  • 打赏
  • 举报
回复
使用autoruns工具禁用相关驱动?
赵4老师 2018-03-19
  • 打赏
  • 举报
回复
引用 6 楼 clever101 的回复:
[quote=引用 5 楼 zhao4zhong1 的回复:] MOVEFILE_DELAY_UNTIL_REBOOT
大侠,调用了MoveFileEx(_T("C:Program file\ProtectProgram"),NULL,MOVEFILE_DELAY_UNTIL_REBOOT); 函数的返回值为1,但是重启后程序依然没有删掉。[/quote] 试试调用完之后,立即切断电源再接通电源。后果自负。
clever101 2018-03-19
  • 打赏
  • 举报
回复
引用 5 楼 zhao4zhong1 的回复:
MOVEFILE_DELAY_UNTIL_REBOOT
大侠,调用了MoveFileEx(_T("C:Program file\ProtectProgram"),NULL,MOVEFILE_DELAY_UNTIL_REBOOT); 函数的返回值为1,但是重启后程序依然没有删掉。
赵4老师 2018-03-19
  • 打赏
  • 举报
回复
会使用WinPE盘启动吗?
赵4老师 2018-03-19
  • 打赏
  • 举报
回复
引用 10 楼 clever101 的回复:
[quote=引用 8 楼 zhao4zhong1 的回复:] 使用autoruns工具禁用相关驱动?
这个是先找出那个保护程序相关的驱动吧。[/quote] 会进入安全模式吗?
赵4老师 2018-03-16
  • 打赏
  • 举报
回复
MoveFileEx The MoveFileEx function renames an existing file or directory. BOOL MoveFileEx( LPCTSTR lpExistingFileName, // pointer to the name of the existing file LPCTSTR lpNewFileName, // pointer to the new name for the file DWORD dwFlags // flag that specifies how to move file ); Parameters lpExistingFileName Pointer to a null-terminated string that names an existing file or directory on the local machine. lpNewFileName Pointer to a null-terminated string that specifies the new name of lpExistingFileName on the local machine. When moving a file, the destination can be on a different file system or drive. If the destination is on another drive, you must set the MOVEFILE_COPY_ALLOWED flag in dwFlags. When moving a directory, the destination must be on the same drive. If dwFlags specifies MOVEFILE_DELAY_UNTIL_REBOOT, lpNewFileName can be NULL. In this case, MoveFileEx registers the lpExistingFileName file to be deleted when the system reboots. If lpExistingFileName refers to a directory, the system removes the directory at reboot only if the directory is empty. dwFlags Set of bit flags that specify how to move the file. You can specify any combination of the following values: Value Meaning MOVEFILE_COPY_ALLOWED If the file is to be moved to a different volume, the function simulates the move by using the CopyFile and DeleteFile functions. This flag cannot be used with the MOVEFILE_DELAY_UNTIL_REBOOT flag. MOVEFILE_DELAY_UNTIL_REBOOT The function does not move the file until the operating system is restarted. The system moves the file immediately after AUTOCHK is executed, but before creating any paging files. Consequently, this parameter enables the function to delete paging files from previous startups. This flag can only be used if the process is in the context of a user who belongs to the administrator group or the LocalSystem account. This flag cannot be used with the MOVEFILE_COPY_ALLOWED flag. MOVEFILE_REPLACE_EXISTING If a file of the name specified by lpNewFileName already exists, the function replaces its contents with those specified by lpExistingFileName. MOVEFILE_WRITE_THROUGH The function does not return until the file has actually been moved on the disk. Setting this flag guarantees that a move performed as a copy and delete operation is flushed to disk before the function returns. The flush occurs at the end of the copy operation. This flag has no effect if the MOVEFILE_DELAY_UNTIL_REBOOT flag is set. Return Values If the function succeeds, the return value is nonzero. If the function fails, the return value is zero. To get extended error information, call GetLastError. Remarks If the dwFlags parameter specifies MOVEFILE_DELAY_UNTIL_REBOOT, MoveFileEx stores the locations of the files to be renamed at reboot in the following registry value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations The function fails if it cannot access the registry. The PendingFileRenameOperations value is of type REG_MULTI_SZ. Each rename operation stores a pair of NULL-terminated strings. The system uses these registry entries to complete the operations at reboot in the same order that they were issued. For example, the following code fragment creates registry entries that delete szDstFile and rename szSrcFile to be szDstFile at reboot: MoveFileEx(szDstFile, NULL, MOVEFILE_DELAY_UNTIL_REBOOT); MoveFileEx(szSrcFile, szDstFile, MOVEFILE_DELAY_UNTIL_REBOOT); The system stores the following entries in PendingFileRenameOperations: szDstFile\0\0 szSrcFile\0szDstFile\0\0 Because the actual move and deletion operations specified with the MOVEFILE_DELAY_UNTIL_REBOOT flag take place after the calling application has ceased running, the return value cannot reflect success or failure in moving or deleting the file. Rather, it reflects success or failure in placing the appropriate entries into the registry. The system deletes a directory tagged for deletion with the MOVEFILE_DELAY_UNTIL_REBOOT flag only if it is empty. To ensure deletion of directories, move or delete all files from the directory before attempting to delete it. Files may be in the directory at boot time, but they must be deleted or moved before the system can delete the directory. Windows 95 and Windows 98: The MoveFileEx function is not supported. To rename or delete a file at reboot, use the following procedure. To rename or delete a file on Windows 95 and Windows 98 Check for the existence of the WININIT.INI file in the Windows directory. If WININIT.INI exists, open it and add new entries to the existing [rename] section. If the file does not exist, create the file and create a [rename] section. Add lines of the following format to the [rename] section: DestinationFileName=SourceFileName Both DestinationFileName and SourceFileName must be short filenames. To delete a file, use NUL as the value for DestinationFileName. The system processes WININIT.INI during system boot. After WININIT.INI has been processed, the system names it WININIT.BAK. QuickInfo Windows NT: Requires version 3.1 or later. Windows: Unsupported. Windows CE: Unsupported. Header: Declared in winbase.h. Import Library: Use kernel32.lib. Unicode: Implemented as Unicode and ANSI versions on Windows NT. See Also File I/O Overview, File Functions, CopyFile, DeleteFile,GetWindowsDirectory, WritePrivateProfileString 外加重启
Eleven 2018-03-16
  • 打赏
  • 举报
回复
是不是底层还有个文件过滤驱动程序?
赵4老师 2018-03-16
  • 打赏
  • 举报
回复
MOVEFILE_DELAY_UNTIL_REBOOT
clever101 2018-03-16
  • 打赏
  • 举报
回复
引用 2 楼 zhao4zhong1 的回复:
MoveFileEx The MoveFileEx function renames an existing file or directory. BOOL MoveFileEx( LPCTSTR lpExistingFileName, // pointer to the name of the existing file LPCTSTR lpNewFileName, // pointer to the new name for the file DWORD dwFlags // flag that specifies how to move file ); Parameters lpExistingFileName Pointer to a null-terminated string that names an existing file or directory on the local machine. lpNewFileName Pointer to a null-terminated string that specifies the new name of lpExistingFileName on the local machine. When moving a file, the destination can be on a different file system or drive. If the destination is on another drive, you must set the MOVEFILE_COPY_ALLOWED flag in dwFlags. When moving a directory, the destination must be on the same drive. If dwFlags specifies MOVEFILE_DELAY_UNTIL_REBOOT, lpNewFileName can be NULL. In this case, MoveFileEx registers the lpExistingFileName file to be deleted when the system reboots. If lpExistingFileName refers to a directory, the system removes the directory at reboot only if the directory is empty. dwFlags Set of bit flags that specify how to move the file. You can specify any combination of the following values: Value Meaning MOVEFILE_COPY_ALLOWED If the file is to be moved to a different volume, the function simulates the move by using the CopyFile and DeleteFile functions. This flag cannot be used with the MOVEFILE_DELAY_UNTIL_REBOOT flag. MOVEFILE_DELAY_UNTIL_REBOOT The function does not move the file until the operating system is restarted. The system moves the file immediately after AUTOCHK is executed, but before creating any paging files. Consequently, this parameter enables the function to delete paging files from previous startups. This flag can only be used if the process is in the context of a user who belongs to the administrator group or the LocalSystem account. This flag cannot be used with the MOVEFILE_COPY_ALLOWED flag. MOVEFILE_REPLACE_EXISTING If a file of the name specified by lpNewFileName already exists, the function replaces its contents with those specified by lpExistingFileName. MOVEFILE_WRITE_THROUGH The function does not return until the file has actually been moved on the disk. Setting this flag guarantees that a move performed as a copy and delete operation is flushed to disk before the function returns. The flush occurs at the end of the copy operation. This flag has no effect if the MOVEFILE_DELAY_UNTIL_REBOOT flag is set. Return Values If the function succeeds, the return value is nonzero. If the function fails, the return value is zero. To get extended error information, call GetLastError. Remarks If the dwFlags parameter specifies MOVEFILE_DELAY_UNTIL_REBOOT, MoveFileEx stores the locations of the files to be renamed at reboot in the following registry value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations The function fails if it cannot access the registry. The PendingFileRenameOperations value is of type REG_MULTI_SZ. Each rename operation stores a pair of NULL-terminated strings. The system uses these registry entries to complete the operations at reboot in the same order that they were issued. For example, the following code fragment creates registry entries that delete szDstFile and rename szSrcFile to be szDstFile at reboot: MoveFileEx(szDstFile, NULL, MOVEFILE_DELAY_UNTIL_REBOOT); MoveFileEx(szSrcFile, szDstFile, MOVEFILE_DELAY_UNTIL_REBOOT); The system stores the following entries in PendingFileRenameOperations: szDstFile\0\0 szSrcFile\0szDstFile\0\0 Because the actual move and deletion operations specified with the MOVEFILE_DELAY_UNTIL_REBOOT flag take place after the calling application has ceased running, the return value cannot reflect success or failure in moving or deleting the file. Rather, it reflects success or failure in placing the appropriate entries into the registry. The system deletes a directory tagged for deletion with the MOVEFILE_DELAY_UNTIL_REBOOT flag only if it is empty. To ensure deletion of directories, move or delete all files from the directory before attempting to delete it. Files may be in the directory at boot time, but they must be deleted or moved before the system can delete the directory. Windows 95 and Windows 98: The MoveFileEx function is not supported. To rename or delete a file at reboot, use the following procedure. To rename or delete a file on Windows 95 and Windows 98 Check for the existence of the WININIT.INI file in the Windows directory. If WININIT.INI exists, open it and add new entries to the existing [rename] section. If the file does not exist, create the file and create a [rename] section. Add lines of the following format to the [rename] section: DestinationFileName=SourceFileName Both DestinationFileName and SourceFileName must be short filenames. To delete a file, use NUL as the value for DestinationFileName. The system processes WININIT.INI during system boot. After WININIT.INI has been processed, the system names it WININIT.BAK. QuickInfo Windows NT: Requires version 3.1 or later. Windows: Unsupported. Windows CE: Unsupported. Header: Declared in winbase.h. Import Library: Use kernel32.lib. Unicode: Implemented as Unicode and ANSI versions on Windows NT. See Also File I/O Overview, File Functions, CopyFile, DeleteFile,GetWindowsDirectory, WritePrivateProfileString 外加重启
大侠,你的意思是这个文件夹重命名吗? 但是进程正在运行,肯定是重命名不了的。
clever101 2018-03-16
  • 打赏
  • 举报
回复
引用 1 楼 VisualEleven 的回复:
是不是底层还有个文件过滤驱动程序?
这个不清楚,是之前网管安装的。大侠,到底怎么破呢?

16,548

社区成员

发帖
与我相关
我的任务
社区描述
VC/MFC相关问题讨论
社区管理员
  • 基础类社区
  • AIGC Browser
  • encoderlee
加入社区
  • 近7日
  • 近30日
  • 至今
社区公告

        VC/MFC社区版块或许是CSDN最“古老”的版块了,记忆之中,与CSDN的年龄几乎差不多。随着时间的推移,MFC技术渐渐的偏离了开发主流,若干年之后的今天,当我们面对着微软的这个经典之笔,内心充满着敬意,那些曾经的记忆,可以说代表着二十年前曾经的辉煌……
        向经典致敬,或许是老一代程序员内心里面难以释怀的感受。互联网大行其道的今天,我们期待着MFC技术能够恢复其曾经的辉煌,或许这个期待会永远成为一种“梦想”,或许一切皆有可能……
        我们希望这个版块可以很好的适配Web时代,期待更好的互联网技术能够使得MFC技术框架得以重现活力,……

试试用AI创作助手写篇文章吧