🚀 go-pugleaf

Sounds nice and thanks for the detailed code example.

But well, the problem with these undocumented features is always, on
which platforms will it really work? Windows95, 98, NT 4.x 5.x? Could it
even depend on the service release?
I'm not a fan of M$ but the reason that some features are not documented
is usually that it is not sure whether this feature will be supported in
future (in this way). 

Conclusion: Unless you want to do and keep doing a lot or heuristic
research I'd rather not use these features.

These aren't serious reasons for a virus programmer not to use this
method of course but I'd still hope a serious virus programmer wouldn't
need (and dare) to ask these questions in a NG anyway ;-)

Gerhard


Robert Petrunic wrote:
> 
> Hi,
> 
> This is as simpleas it could be :o) .. It's not my code, i'v found it
> somwhere out there...
> 
> unit Unit1;
> 
> Interface
> 
> uses
>   Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
>     StdCtrls;
> 
> type
>   TForm1 = class (TForm)
>     Button1 : TButton;
>     procedure FormDestroy (Sender: TObject);
>     procedure FormCreate (Sender: TObject);
>   private
>     { private declarations }
>   public
>     { public declarations }
>   end;
> 
> var
>   Form1 : TForm1;
> 
> implementation
> 
> {$R *.DFM}
> 
> const
>   RSPSIMPLESERVICE     = 1;
>   RSPUNREGISTERSERVICE = 0;
> 
> function RegisterServiceProcess (dwProcessID, dwType: DWord) : DWord;
>   stdcall; external 'KERNEL32.DLL';
> 
> procedure TForm1.FormDestroy (Sender: TObject);
> begin
>   RegisterServiceProcess (GetCurrentProcessID, RSPUNREGISTERSERVICE)
> end;
> 
> procedure TForm1.FormCreate (Sender: TObject);
> begin
>   RegisterServiceProcess (GetCurrentProcessID, RSPSIMPLESERVICE)
> end;
> 
> end.
> 
>                         Robert Petrunic
> 
> J.A. Korten <jksoft@capitolonline.nl> wrote in article
> <7i30ho$9emr$1@reader3.wxs.nl>...
> > Chow Hoi Ka, Eric heeft geschreven in bericht
> > <37443283.77B7FF28@sftw.umac.mo>...
> > >Hello,
> > >
> > >Is it possible to make aa running program that will not shown in Task
> > >Manaager ?
> >
> > I'm also very interested in that!
> >
> >
> > >It means that it will not be terminated by the Task Manager..
> > There is a way (I saw one doing that at school) to work with twice the
> same
> > apl,
> > the first looks if the second it not down and else starts the second, the
> > second looks for the first and starts it when it is down, so the user
> can't
> > remove the apl, but this is a truc of course, there must be something
> more
> > nice!
> >
> > Greetings Johan
> > >
> > >Would you pleased to give me a simple example ??
> > >
> > >Best regards,
> > >Eric
> > >
> > >--
> > >     _                                                  _
> > >    / ) |~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| ( \
> > >   / /  |                                            |  \ \
> > > _( /_  | _   Chow Hoi Ka, Eric                    _ |  _) )_
> > >(((\ \> |/ )                                      ( \| </ /)))
> > >(\\\\ \_/ /   E-Mail : d951686@sftw.umac.mo        \ \_/ ////)
> > > \       /                                          \        /
> > >  \    _/     http://www.sftw.umac.mo/~d951686/      \_     /
> > >  /   / |____________________________________________| \    \
> > > /   /                                                   \    \
> > >
> > >
> >
> >
> >

-- 
---------------------------------------------------------------------
Dr. Gerhard Grosse       Phone:   +49 89 289-12567
Physik-Department E15    Fax:     +49 89 3206780
TU Muenchen              E-mail:  ggrosse@ph.tum.de
D-85747 Garching         http://srv.e15.physik.tu-muenchen.de/grosse/
Germany
---------------------------------------------------------------------