Why does one script work and the other doesn't?

[KWiz]

Why does the first script work, and the second one doesn't?
I'm using Windows XP. The only difference between these two scripts is the very last line of the script.

I'm unfamiliar with VBScript. I got the first script from an MJT representative a long time ago. I just tried "rewriting" the script to terminate another service, aawservice.exe, but I guess my rewriting didn't work. Why not?

Thanks,
KWiz

Script 1:

VBSTART
Sub killProcess(pgm)
set wmi = getobject("winmgmts:")
sQuery = "select * from win32_process " & "where name='" & pgm & "'"
set processes = wmi.execquery(sQuery)
for each process in processes
process.terminate
next
End Sub
VBEND

VBRun>KillProcess,AcroRd32.exe





Script 2:

VBSTART
Sub killProcess(pgm)
set wmi = getobject("winmgmts:")
sQuery = "select * from win32_process " & "where name='" & pgm & "'"
set processes = wmi.execquery(sQuery)
for each process in processes
process.terminate
next
End Sub
VBEND

VBRun>KillProcess,aawservice.exe

[Me_again]

It may actually be working, but aawservice has a nasty habit of automatically restarting itself. I don't know if it will do what you want, but it may be better to just stop it autostarting.

(aawaservice is Ad Aware, sometimes the cure is worse than the disease )

[KWiz]

No, that's not it. I just learned something new about the problem.

On the Task manager, on the processes tab, under the heading "username", I see four different usernames as follows:

Local Service
Network Service
System
My Name

This particular script only effects processes running under "My Name".

How can I change this script so that it effects processes running under "System"?

Thanks for any ideas from anybody.

KWiz

[gdyvig]

Is the SQL query finding the process?

Or is the kill command not working?

Can you kill it from the Task Manager?

[KWiz]

Yes, I can kill it from the Task Manager.

I don't know what you mean by the SQL query finding the process (I don't know what SQL queries are).... but I'm guessing that must be it??

Well thanks for your consideration here, hopefully you can solve the problem

Kwiz

[Me_again]

I confirm your result, that vbscript cannot kill a process owned by system.

One solution is to download pstools http://technet.microsoft.com/en-us/sysi ... 96649.aspx and automate the command line pskill command. It does kill system owned processes, I just tested it.

[JRL]

Have you tried DOS? Its free. No need to search the internet and download potentially dangerous programs. In this case its even fewer lines of code than VBScript. I have not tested because I don't use AdAware.

Code: Select all

Let>RP_WAIT=1
Let>RP_WINDOWMODE=0
Run>cmd /c TASKKILL /F /IM aawservice.exe

[Me_again]

I tried to kill a system owned process (spysweeper.exe) with TASKKILL and if failed with "Access Denied".

pstools is a very useful set of utilities, and (since the author was hired by them) it is from microsoft.

[KWiz]

That worked for me, JRL. Thanks! I don't know if it works for all SYSTEM processes (apparently not Spysweeper), but it worked for aawservice.

Thanks again,
Kwiz