?
Solved

Terminate a system process with .vbs

Posted on 2009-04-29
14
Medium Priority
?
861 Views
Last Modified: 2013-11-26
Hi Experts,

I have a script that I have been working which should terminate specific processes I target.

It works fine for the user processes...but it seems to ignore the System processes...  I can manually go in to the Process List and end the process...so permissions, I believe, are not the issue.

Please provide me with the code required to kill a process by either the PID or the .exe.

Many thanks!
0
Comment
Question by:r_johnston
  • 8
  • 5
14 Comments
 
LVL 7

Expert Comment

by:dineesh
ID: 24260684
Hi,

try a "Run as" on your script and see if it is able to terminate system processes?

regards
Dinesh
0
 
LVL 2

Expert Comment

by:joshlunsford
ID: 24261645
You can try:
Option Explicit
Dim objWMI, objP, colP
Dim strComputer, strProcess
strComputer = "."
strProcess = "'notepad.exe'" 
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
 
Set colP = objWMI.ExecQuery _
("Select * from Win32_Process Where Name = " & strProcess )
For Each objP in colP
	objP.Terminate()
Next 

Open in new window

0
 

Author Comment

by:r_johnston
ID: 24262336
Joshlunsford, thx for the input, but I have that already and it will not close items that are listed under the User Name as System...

dineesh, code example please.

Thanks y'all.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 2

Expert Comment

by:joshlunsford
ID: 24262372
try running taskkill -f -im notepad.exe
Set objShell = CreateObject("Shell.Application")
shell.run "taskkill.exe -f -im notepad.exe"
0
 

Author Comment

by:r_johnston
ID: 24268982
I have attached the code that I have thus far for reference.

As of right now...the items marked with 'System Process will not close, the other items will.

The items that I marked as such I can manually go into CTRL+ALT+DEL and close them...I wish to have them close automatically with this .vbs script.

Option Explicit
 
'--------------------------------------------------------------------------------------
 
'This script loops the Cease sub every 5 minutes, time can be set to anything.
 
   while true
      Cease()
      WScript.Sleep 300000  '60 seconds = 60000
   wend
 
'--------------------------------------------------------------------------------------
 
'The following kills the individual programs running in the background.
 
 
Cease
 
Sub Cease
 
'-----------------------------------------------------
'The following code kills User level processes.
 
	Dim objWMIService, objProcess, colProcess
	Dim strComputer, strProcessKill1, strProcessKill2, strProcessKill3, strProcessKill4, strProcessKill5, strProcessKill6, strProcessKill7, strProcessKill8, strProcessKill9, strProcesskill10
 
		strComputer = "."
		strProcessKill1 = "'CCC.exe'" 						'User Level
		strProcessKill2 = "'DWRCST.exe'"					'User Level
		strProcessKill3 = "'LSSrvc.exe'"					'System Level
		strProcessKill4 = "'DWRCS.exe'"						'System Level
		strProcessKill5 = "'xferwan.exe'"					'System Level
		strProcessKill6 = "'cagent32.exe'"					'System Level
		strProcessKill7 = "'connectivity.EDMWS.Server.exe'"			'System Level
		strProcessKill8 = "'connectivity.windowsservice.jobdispatch.exe'"	'System Level
		strProcessKill9 = "'sqlservr.exe'"					'System Level
		strProcessKill10 = "'mom.exe'"						'User Level
 
Killtask 1624
 
 
			Set objWMIService = GetObject("winmgmts:" _
			& "{impersonationLevel=impersonate}!\\" _
			& strComputer & "\root\cimv2")
 
			Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill1 )
				For Each objProcess in colProcess
					objProcess.Terminate()
				Next
		
			Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill2 )
				For Each objProcess in colProcess
					objProcess.Terminate()
				Next
 
			Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill3 )
				For Each objProcess in colProcess
					objProcess.Terminate()
				Next
		
			Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill4 )
				For Each objProcess in colProcess
					objProcess.Terminate()
				Next
 
			Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill5 )
				For Each objProcess in colProcess
					objProcess.Terminate()
				Next
				
			Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill6 )
				For Each objProcess in colProcess
					objProcess.Terminate()
				Next
		
			Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill7 )
				For Each objProcess in colProcess
					objProcess.Terminate()
				Next
				
			Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill8 )
				For Each objProcess in colProcess
					objProcess.Terminate()
				Next
 
			Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill9 )
				For Each objProcess in colProcess
					objProcess.Terminate()
				Next
 
			Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = " & strProcessKill10 )
				For Each objProcess in colProcess
					objProcess.Terminate()
				Next
		
	Exit Sub	
	
End Sub

Open in new window

0
 

Author Comment

by:r_johnston
ID: 24268996
Ignore the Killtask line, I forgot to remove it from the script.
0
 

Author Comment

by:r_johnston
ID: 24296854
So no one knows how to kill a SYSTEM task?
0
 
LVL 2

Expert Comment

by:joshlunsford
ID: 24298902
Both the taskkill and the WMI ways work fine if you have rights to close out the process in question. Do you have admin rights to this machine?
0
 

Author Comment

by:r_johnston
ID: 24303959
joshlunsford, yes, I have full rights to the machine, but I am not familiar with programming the taskkill method.

I could probably search it out, but that would defeat me opening this question.  :o)

Please provide a code example for me to try and if it works, you win and I win!!

Thanks!
0
 
LVL 2

Accepted Solution

by:
joshlunsford earned 2000 total points
ID: 24304100
Set objShell = WScript.CreateObject( "WScript.Shell" )
strPrograms = "calc.exe,spoolsv.exe,notepad.exe"
arrPrograms = split(strPrograms,",")
for each program in arrPrograms
      objShell.run "taskkill.exe -f -im " & program
Next
0
 

Author Comment

by:r_johnston
ID: 24306033
I got it to work, thanks so much!!!

I have one last Q for ya, is there a way to make it so the boxes don't have to pop up???
0
 

Author Closing Comment

by:r_johnston
ID: 31575951
Just had to set the Dim for the variables, other than that, worked like a charm!
0
 
LVL 2

Expert Comment

by:joshlunsford
ID: 24306165
yes you can
change
   objShell.run "taskkill.exe -f -im " & program
to
   objShell.run "taskkill.exe -f -im " & program,7

if you want to wait for each program to close before moving to the next change it to
   objShell.run "taskkill.exe -f -im " & program,7,true
0
 

Author Comment

by:r_johnston
ID: 24307512
Many thanks!

I have attached my final code with notes for anyone else that should need this information.

BE SURE TO CHANGE THE ATTACHED FILE EXTENSION TO .DLL, I CHANGED IT TO .DOC SO IT COULD BE POSTED!!

Option Explicit
 
 
'--------------------------------------------------------------------------------------
 
'The following causes this script to loop every 15 minutes; time can be set to anything.
 
   while true
      Cease()
      WScript.Sleep 900000  '60 seconds = 60000
   wend
 
 
 
'--------------------------------------------------------------------------------------
 
'The following code kills ANY level processes.
'The dbghelp.dll file will be required in the c:\windows\system32 folder.
'It must also be registered by going to the "Run" option on the start menu and typing in "regsvr32 *.dll".
 
'To get rid of the pop-up windows change the following from
   'objShell.run "taskkill.exe -f -im " & program
'to
   'objShell.run "taskkill.exe -f -im " & program,7
 
'if you want to wait for each program to close before moving to the next change it to
   'objShell.run "taskkill.exe -f -im " & program,7,true
 
 
Cease
 
Sub Cease
 
 
	Dim objshell, strprograms, arrprograms, program
 
			Set objShell = WScript.CreateObject( "WScript.Shell" )
			strPrograms = "Program1.exe,Program2.exe,Program3.exe,ProgramN.exe"
			arrPrograms = split(strPrograms,",")
			for each program in arrPrograms
      			objShell.run "taskkill.exe -f -im " & program
			Next
		
	Exit Sub	
	
End Sub

Open in new window

DbgHelp.doc
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

IntroductionWhile developing web applications, a single page might contain many regions and each region might contain many number of controls with the capability to perform  postback. Many times you might need to perform some action on an ASP.NET po…
Today I had a very interesting conundrum that had to get solved quickly. Needless to say, it wasn't resolved quickly because when we needed it we were very rushed, but as soon as the conference call was over and I took a step back I saw the correct …
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…
Suggested Courses
Course of the Month13 days, 22 hours left to enroll

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question