windowsdelphiprocessmessagetaskmanager

How can I keep Task Manager from killing my program?


Is there any way to protect my Delphi application from being killed by the Windows task manager (or others like Process Explorer)?

I think Windows messages can do that (by doing a hook and intercepting the TerminateProcess message).

I want an example of this protection. The Kaspersky Anti-Virus suites are like this; we can't end their process in Task Manager.


Solution

  • AV Programs like Kaspersky probably use a driver and use hook to prevent termination. In your situation I would advise to set an ACL on the process, this prevents termination with Task Manager or cmdline tools (if the user does not have the Debug privilege). Of course the user can always use a tool like Process Explorer, take ownership of the process, set new ACL and Terminate.

    If the user is not an administrator it would suffice to run the process in a different user context (eg launch it from a service).

    Setting a process ACL is very easy with the Jedi Windows Security Library as this sample shows.