What I think he's trying to say is he wants his Trainer terminated as soon as a specific process is executed.
well then, you have so many solutions to approach this, but here's some easy ones:
A System-wide hook is option one. {Hook CreateProcess & CreateThread}
or create thread / Timer / loop that'll search for the process.
if you wanna do it in a way to ensure it'll get closed faster, you could use PsCreateProcessNotifyRoutineEx {Vista SP1+} in PASSIVE_MODE.
if you're still in XP, i would suggest removing the Extended from the api, also, you compare the file name inside the callback routine which is what acutally being called.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum