@@ -736,6 +736,8 @@ internal static void DisableProtectedService(string serviceName)
736736 allServicesKey . GrantFullControlOnSubKey ( serviceName ) ;
737737 using ( RegistryKey serviceKey = allServicesKey . OpenSubKeyWritable ( serviceName ) )
738738 {
739+ if ( serviceKey == null ) return ;
740+
739741 foreach ( string subkeyName in serviceKey . GetSubKeyNames ( ) )
740742 {
741743 serviceKey . TakeOwnershipOnSubKey ( subkeyName ) ;
@@ -780,6 +782,8 @@ internal static void EnableProtectedService(string serviceName)
780782 allServicesKey . GrantFullControlOnSubKey ( serviceName ) ;
781783 using ( RegistryKey serviceKey = allServicesKey . OpenSubKeyWritable ( serviceName ) )
782784 {
785+ if ( serviceKey == null ) return ;
786+
783787 foreach ( string subkeyName in serviceKey . GetSubKeyNames ( ) )
784788 {
785789 serviceKey . TakeOwnershipOnSubKey ( subkeyName ) ;
@@ -794,6 +798,7 @@ internal static void EnableProtectedService(string serviceName)
794798 public static RegistryKey OpenSubKeyWritable ( this RegistryKey registryKey , string subkeyName , RegistryRights ? rights = null )
795799 {
796800 RegistryKey subKey = null ;
801+
797802 if ( rights == null )
798803 subKey = registryKey . OpenSubKey ( subkeyName , RegistryKeyPermissionCheck . ReadWriteSubTree ) ;
799804 else
@@ -892,5 +897,37 @@ internal static void SearchWith(string term, bool ddg)
892897 }
893898 catch { }
894899 }
900+
901+ internal static void PreventProcessFromRunning ( string pName )
902+ {
903+ try
904+ {
905+ using ( RegistryKey ifeo = Registry . LocalMachine . OpenSubKeyWritable ( @"SOFTWARE\Microsoft\Windows NT\CurrentVersion" ) )
906+ {
907+ if ( ifeo == null ) return ;
908+
909+ ifeo . GrantFullControlOnSubKey ( "Image File Execution Options" ) ;
910+
911+ using ( RegistryKey k = ifeo . OpenSubKeyWritable ( "Image File Execution Options" ) )
912+ {
913+ if ( k == null ) return ;
914+
915+ k . CreateSubKey ( pName ) ;
916+ k . GrantFullControlOnSubKey ( pName ) ;
917+
918+ using ( RegistryKey f = k . OpenSubKeyWritable ( pName ) )
919+ {
920+ if ( f == null ) return ;
921+
922+ f . SetValue ( "Debugger" , @"%windir%\System32\taskkill.exe" ) ;
923+ }
924+ }
925+ }
926+ }
927+ catch ( Exception ex )
928+ {
929+ ErrorLogger . LogError ( "Utilities.PreventProcessFromRunning" , ex . Message , ex . StackTrace ) ;
930+ }
931+ }
895932 }
896933}
0 commit comments