detect "task manager end process"

[e-Ricc]

Hi guys!

Im trying to detect when a user "kills" my c# app using windows task
manager, i've tried with the form events _closing and _closed managing
for example putting an if inside to detect it:

if (e.CloseReason == CloseReason.TaskManagerClosing)
{
MessageBox.Show("from task manager");
}

but it doesn´t works, any idea?

Regards
Ricc

 

[Alvin Bruney [MVP]]

I haven't found a way yet to catch this type of scenario, maybe others have.
As a substitute, it is common to write a watch dog application that monitors
for the existence of the exe and starts it if it does not detect it running.

 

[Michael Nemtsev, MVP]

Hello e-Ricc,

u need to inject dll into the taskmanager, hooking the TerminateProcess in
Kernel32
and such u can add your custom code

---
WBR,
Michael Nemtsev [.NET/C# MVP] :: blog: http://spaces.live.com/laflour

"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo


e> Hi guys!
e>
e> Im trying to detect when a user "kills" my c# app using windows task
e> manager, i've tried with the form events _closing and _closed
e> managing for example putting an if inside to detect it:
e>
e> if (e.CloseReason == CloseReason.TaskManagerClosing)
e> {
e> MessageBox.Show("from task manager");
e> }
e> but it doesn?t works, any idea?
e>
e> Regards
e> Ricc

 

[Willy Denoyette [MVP]]

Hi guys!

Im trying to detect when a user "kills" my c# app using windows task
manager, i've tried with the form events _closing and _closed managing for
example putting an if inside to detect it:

if (e.CloseReason == CloseReason.TaskManagerClosing)
{
MessageBox.Show("from task manager");
}

but it doesn´t works, any idea?

Regards
Ricc

This event (TaskManagerClosing) is raised when the "Task" is terminated, not
when the "Process" is terminated, the latter stops the process cold, no
events are raised, so there is nothing you can do from within the
application itself.
One solution for this is to Remove Taskman from the taskbar using Group
Policy Management (Local Computer Policy), sure this isn't of any help if
the user has other means to kill a running process.

To watch process termination events, you can run a watchdog (needs
administrative privileges!) which listens for WMI "Win32_ProcessStopTrace"
events using System.Management 's ManagementEventWatcher.

Willy.

 

[Ben Voigt [C++ MVP]]

Hello e-Ricc,

u need to inject dll into the taskmanager, hooking the TerminateProcess in
Kernel32
and such u can add your custom code

Would work I suspect, but no user would ever voluntarily use software that
does such a thing.

---
WBR, Michael Nemtsev [.NET/C# MVP] :: blog:
http://spaces.live.com/laflour
"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

e> Hi guys!
e> e> Im trying to detect when a user "kills" my c# app using windows task
e> manager, i've tried with the form events _closing and _closed
e> managing for example putting an if inside to detect it:
e> e> if (e.CloseReason == CloseReason.TaskManagerClosing)
e> {
e> MessageBox.Show("from task manager");
e> }
e> but it doesn?t works, any idea?
e> e> Regards
e> Ricc

 

[e-Ricc]

Oki doki!

let me look for info, thanks!!

Regards
e-Ricc

Hello e-Ricc,

u need to inject dll into the taskmanager, hooking the TerminateProcess in
Kernel32
and such u can add your custom code

Would work I suspect, but no user would ever voluntarily use software that
does such a thing.

---
WBR, Michael Nemtsev [.NET/C# MVP] :: blog:
http://spaces.live.com/laflour
"The greatest danger for most of us is not that our aim is too high and we
miss it, but that it is too low and we reach it" (c) Michelangelo

e> Hi guys!
e> e> Im trying to detect when a user "kills" my c# app using windows task
e> manager, i've tried with the form events _closing and _closed
e> managing for example putting an if inside to detect it:
e> e> if (e.CloseReason == CloseReason.TaskManagerClosing)
e> {
e> MessageBox.Show("from task manager");
e> }
e> but it doesn?t works, any idea?
e> e> Regards
e> Ricc