?
Solved

Getting the filename(with path) of a process

Posted on 2005-02-25
8
Medium Priority
?
397 Views
Last Modified: 2010-05-18
I'm developeing a "Anti w32.Jeefo virus" program and need to kill the virus wich is a process started from %windir%\svchost.exe.I'm stuck with the part of getting a process's filename.I know there is the Toolhelp32Snapshot wich returns the filename but only works on win9x.
Thanks in advance!
0
Comment
Question by:Centauri
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
  • +2
8 Comments
 
LVL 17

Expert Comment

by:geobul
ID: 13401508
Hi,

Toolhelp32Snapshot works on all Windows platforms except Windows NT 4. I'm afraid that there could be no separate process but a dll only loaded into the infected process. Some of the new viruses work that way.

Regards, Geo
0
 
LVL 17

Expert Comment

by:geobul
ID: 13401528
You may be interested in Madshi's madKernel package which works on all Windows versions. Check his site:
http://www.madshi.net

Regards, Geo
0
 
LVL 2

Expert Comment

by:heretoread
ID: 13402577
you could remove it's startup key then reboot and delete it.
or run through the open processes using ToolHelp and search for scvhost.exe process located in the C:Windows folder.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 10

Expert Comment

by:_Katka_
ID: 13403062
Or you can use my SVCHOST assigned files list and kill it by process PID as pointed in

http://www.experts-exchange.com/Programming/Programming_Languages/Delphi/Q_21274219.html

otherwise "tasklist /SVC" does the same thing
my code (the accepted one works for Winnt4 above)

regards,
Kate
0
 
LVL 26

Expert Comment

by:EddieShipman
ID: 13403563
Give this a try:

uses ..., TlHelp32, PSAPI;
 
function WinXPor2Kor2K3:Boolean;
begin
  Result := False;
  if ( CheckWin32Version( 5, 0 ) ) or   // Win2K
     ( CheckWin32Version( 5, 1 ) ) or   // WinXP
     ( CheckWin32Version( 5, 2 ) ) then // Win2003
  begin
    Result := True;
  end;
end;
 
function RunningProcessesList(const List: TStrings; FullPath: Boolean): Boolean;
 
function BuildListTH: Boolean;
  var
    SnapProcHandle: THandle;
    ProcEntry: TProcessEntry32;
    NextProc: Boolean;
    FileName: string;
    PFileName: PChar;
    PIDName : array [0..MAX_PATH - 1] of char;
    Handle: THandle;
  begin
    SnapProcHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    Result := (SnapProcHandle <> INVALID_HANDLE_VALUE);
    if Result then
    try
      ProcEntry.dwSize := SizeOf(ProcEntry);
      NextProc := Process32First(SnapProcHandle, ProcEntry);
      while NextProc do
      begin
        if ProcEntry.th32ProcessID = 0 then
        begin
          // PID 0 is always the "System Idle Process" but this name cannot be
          // retrieved from the system and has to be fabricated.
          FileName := 'System Idle Process';
        end
        else
        begin
          FileName := ProcEntry.szExeFile;
          if not FullPath then
          begin
            FileName := ExtractFileName(FileName);
          end
          else
          begin
            // do we really need this check???
            if WinXPor2Kor2K3 then
            begin
              Handle := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ,
                                    False, ProcEntry.th32ProcessID);
              if Handle <> 0 then
              try
                SetLength(FileName, MAX_PATH);
                if GetModuleFileNameEx(Handle, 0, PChar(FileName), MAX_PATH) > 0 then
                  SetLength(FileName, StrLen(PChar(FileName)))
                else
                  FileName := '';
              finally
                CloseHandle(Handle);
              end;
            end;
          end;
        end;
        List.AddObject(FileName, Pointer(ProcEntry.th32ProcessID));
        NextProc := Process32Next(SnapProcHandle, ProcEntry);
      end;
    finally
      CloseHandle(SnapProcHandle);
    end;
  end;
 
begin
  Result := BuildListTH;
end;
 
procedure TForm1.Startup;
var
  Startupinfo: TStartupinfo;
  Processinfo: TProcessInformation;
begin
  FillChar(StartupInfo, SizeOf(StartupInfo), 0);
  with StartupInfo do
  begin
    cb := SizeOf(TStartupInfo);
    dwFlags := STARTF_USESHOWWINDOW;
    wShowWindow := SW_HIDE;
  end;
  // Change to your executable filename!!!
  CreateProcess('C:\Program Files\Borland\Delphi6\Projects\ESPNRadioTray.exe', nil, nil, nil,
                False, NORMAL_PRIORITY_CLASS, nil, nil, StartupInfo, ProcessInfo);
  PID := ProcessInfo.dwProcessId;
end;
 
procedure TForm1.FormShow(Sender: TObject);
begin
  PID := High(DWord);
end;
 
procedure TForm1.Timer1Timer(Sender: TObject);
var
  ProcessList: TStringList;
  i: Integer;
  FRunning: Boolean;
begin
  if PID = High(DWord) then
    Timer1.Interval := 900000;
  ProcessList := TStringList.Create;
  try
    RunningProcessesList(ProcessList, True);
    FRunning := False;
    for i := 0 to ProcessList.Count-1 do
    begin
      if DWORD(ProcessList.Objects[i]) = PID then
      begin
        FRunning := True;
        Break;
      end;
    end;
  finally
    ProcessList.Free;
  end;
  if not FRunning then
  begin
    Startup;
  end;
end;
0
 
LVL 26

Expert Comment

by:EddieShipman
ID: 13403574
I don't rememeber where I got this but I took out the stuff for
Win9x.
0
 
LVL 5

Accepted Solution

by:
Hypoviax earned 1000 total points
ID: 13407414
Function ReturnFilePath(PID:Integer);
var
  c : cardinal;
  me : TModuleEntry32;
begin
  c := CreateToolhelp32Snapshot(TH32CS_SnapModule, PID);
  me.dwSize := sizeof(me);
  Module32First(c, me);
  result:=me.szExePath;
  CloseHandle(c);
end;

OR

function getfilepath(pid:integer):string;
var
    FileName: String;
    Handle: THandle;
    Index:integer;
begin
Handle := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ,
                                    False, PID);
              if Handle <> 0 then
              try
                SetLength(FileName, MAX_PATH);
                // Use the psapi function GetModuleFileNameEX to get the full path
                if GetModuleFileNameEx(Handle, 0, PChar(FileName), MAX_PATH) > 0 then
                 FileName := pchar(FileName)// SetLength(FileName, StrLen(PChar(FileName)))
                else
                  FileName := '';   //doesn't exist apparently
              finally
                CloseHandle(Handle);
              end;

             result:=filename
end;

All you need to find the filepath is the PID of the process

What if i  don't know the PID but know the exename?

Then use this function:

function FindPID(ExeFileName: string): integer; //used to find the pid of an app
const
PROCESS_TERMINATE=$0001;
var
ContinueLoop: BOOL;
FSnapshotHandle: THandle;
FProcessEntry32: TProcessEntry32;
begin
result := 0;
FSnapshotHandle := CreateToolhelp32Snapshot
(TH32CS_SNAPPROCESS, 0);
FProcessEntry32.dwSize := Sizeof(FProcessEntry32);
ContinueLoop := Process32First(FSnapshotHandle,
FProcessEntry32);
while integer(ContinueLoop) <> 0 do
begin
if ((UpperCase(ExtractFileName(FProcessEntry32.szExeFile))=UpperCase(ExeFileName))
or (UpperCase(FProcessEntry32.szExeFile) =
UpperCase(ExeFileName))) then
  begin
    Result :=FProcessEntry32.th32ProcessID
  end;
ContinueLoop := Process32Next(FSnapshotHandle,
FProcessEntry32);
end;
CloseHandle(FSnapshotHandle);
end;

Seeings as there are numerous svchost.exe files you can then go through the list and check out the filename of each and if it resides in the location known to be the nasty one then you can kill it. I can provide code if you need to terminate it.

Regards,

Hypoviax


0
 
LVL 5

Expert Comment

by:Hypoviax
ID: 13632911
Thanks :-),

I hope it helped

0

Featured Post

Enroll in August's Course of the Month

August's CompTIA IT Fundamentals course includes 19 hours of basic computer principle modules and prepares you for the certification exam. It's free for Premium Members, Team Accounts, and Qualified Experts!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this tutorial I will show you how to use the Windows Speech API in Delphi. I will only cover basic functions such as text to speech and controlling the speed of the speech. SAPI Installation First you need to install the SAPI type library, th…
Creating an auto free TStringList The TStringList is a basic and frequently used object in Delphi. On many occasions, you may want to create a temporary list, process some items in the list and be done with the list. In such cases, you have to…
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question