5

Ok, the title is my question.

No, this ain't for malware. It is for a parental control program for my own netbook.
Yes, I am tired of my brother's friends visiting porn sites on my laptop when I am away.

Oh, yes, I have red other questions and don't do the "You can't!" thing. It must be possible.

Vercas
  • 8,931
  • 15
  • 66
  • 106
  • 8
    Can you give your brother a more limited user account? It might prevent processes running as a higher account being killed. But I might be wrong. – joshcomley Apr 19 '11 at 09:06
  • It's not my brother's account... I have only the admin account and my mother will kill me if I have a password and/or my brother doesn't know it... – Vercas Apr 19 '11 at 09:08
  • +1 Other then giving your brother limited account it really is impossible. If he is a local admin he rulez the machine. – mmix Apr 19 '11 at 09:08
  • I can't rule over ATI's EEU process, for instance... but It closes when shutting down... – Vercas Apr 19 '11 at 09:10
  • Why not install a load of malware intentionally - point out it was your brother's friend's online habits that compromised and damaged the machine, and get your Mum onside with the lockdown? – Rob Levine Apr 19 '11 at 09:16
  • 1. She refuses to believe that 13-year-old kids visit porn sites and she blames me instead! (I'm 15) 2. I can't reinstall Windows. After infecting with a modern virus, I'll definitely have to reinstall it. It's a netbook so I doesn't have an optical media reader. – Vercas Apr 19 '11 at 09:22
  • Have your mum look at the content of the browser cache. That should solve the problem. – Emond Apr 19 '11 at 09:24
  • 1
    Maybe you should suggest that the best way to tackle this is to force *both of you* to have separate accounts, with passwords which the other doesn't know. Then she can isolate who is doing what. It'll be your brothers browsing history that gives him away, and his profile that ends up full of rubbish. OR - how about a different approach where you log exactly what he and his friends are up to. If you have a home router - this may have logging features too. Maybe you should try and catch him red handed. Just a thought. – Rob Levine Apr 19 '11 at 09:25
  • I am reading the router's cache (a xml file) for IP addresses and comparing them to my list... But I need to do this every 1-5 seconds so I can actually TRACK the sites... Speed isn't a problem, it's very fast... When I see a site like this, I keep taking screenshots and camera photos for 10 minutes and then pack, compress and e-mail them to me and my mom. The program is almost done, except the "unkillable" part... After that, I'll add blocking features. – Vercas Apr 19 '11 at 09:36
  • Feels like you are focused way too much on self-build technical solution. If one of my sons tried to convince me that his brother did something wrong by showing me a program(output) of a program he created I would not trust that. I'd trust separate accounts and mum being the only admin (as she is apparently the root of all authority) – Emond Apr 19 '11 at 09:45
  • My laptop camera automatically adds the BIOS date and time in the lower right corner of the image and my mom knows it, so I have proof by showing the porn screenshot and the camera side-by-side... Especially when I am at school. The culprit has school in the afternoon and no home computer and my mom trusts him to let him home. She'll totally believe it when she gets those emails every day. EDIT: Oh, and this is my way of doing things. It's the way I like. – Vercas Apr 19 '11 at 09:59
  • I have voted to close this. As much as the original question is valid for SO, reading the comments it feels much more like a rant and baiting "don't tell me this can't be done". The added value for SO is below zero. – Emond Apr 19 '11 at 10:32

4 Answers4

6

Well, you could run several processes, and when one of them is killed, one of the others would launch a replacement. You can also run a service that would monitor the process and launch another process when the process is killed.

Ilya Kogan
  • 21,995
  • 15
  • 85
  • 141
  • The service thing sounds good. But how do I do it? AFAIK services can only process commands... Edit: I didn't down-vote you... >.> – Vercas Apr 19 '11 at 09:10
  • 1
    Not sure why this got a down-vote - it is probably the best suggestion around. Maybe not ideal, but probably the only thing approaching a viable solution to the problem. Down-voter - what was your reason? (upvoting) – Rob Levine Apr 19 '11 at 09:19
2

Sorry, I can't comment so I've posted this as a 'answer'.

A few things to consider:

  • Is a 13 year old or his friends going to notice a process in taskmanager that shouldn't be there? (for example a second explorer.exe, svchost.exe etc.)

  • What are you trying to actually achieve as there may be other ways to do what it is you want. Are you trying to block them from going on certain sites? Are you trying to monitor what they do? Are you trying to prove to your mum what they are doing? Something else?

  • Unless you are trying to block them, will they care about anything you may have running? Would they bother to look for 'logging' software running on the PC? I would guess that they wouldn't bother to even open task manager unless the sites weren't working.

If you are trying to give proof or monitor your pc, running a VNC service in the background allows you to connect a viewer from another computer so that you/your mum can watch a live view of what they are up to.

If you want to monitor the sites then you have a wide range of options: keylogging software, browser logging software, proxy software or logging software on your router

If you want to block the sites then you also have a wide range of solutions: hosts file, dns based blocking (e.g. openDNS), blocking software on the pc (e.g. netnanny), blocking software on the router, etc.

Remember: If you are trying to block sites remember that nothing will block 100% of websites. You will only achieve 1 of 2 things: (Ideally) it becomes too much effort trying to find sites not blocked and they use another computer for their porn -or- they persist and find a way around it/to disable it/sites that it doesn't catch

syserr0r
  • 654
  • 6
  • 17
  • Nice points! But no. I want my mom not to let him in the house anymore... He smells like his dogs, like the cigarettes he smokes, like the alcohol he drinks and is full of fleas. My brother's too stupid to care and my mom won't do anything to upset him. I need solid proof for this thing! My mom is totally against porn, public sex and things like this so she'll definitely kick him out after seeing it... – Vercas Apr 19 '11 at 10:18
  • Take a look at ultraVNC or TightVNC -- it allows you to see your desktop from another computer. That way your mum could watch what your brother is doing, problem solved? :-) – syserr0r Apr 19 '11 at 10:28
  • She works with computers but she can't install programs, so I guess this might not be an option. But, I'll take a look... – Vercas Apr 19 '11 at 11:01
1

what about unstoppable service ? MSDN

cnd
  • 32,616
  • 62
  • 183
  • 313
  • I need an events loop in my monitoring program so a service won't work. The first thing I actually tried was an unstoppable service, and I've had SERIOUS TROUBLE stopping it! (Yes, it is possible...) – Vercas Apr 19 '11 at 09:13
  • That will only only prevent someone being able to stop the process from the service control manager or from the command line. It won't actually stop someone killing the process using task manager or something like pskill. – Rob Levine Apr 19 '11 at 09:14
  • @Vercas what exactly doesn't work for you with it ? that is really good way for such things like events loop, keylogger, another logger or whatever you want to make. – cnd Apr 19 '11 at 09:15
  • AFAIK services can only act at startup, closing and power events and custom commands. – Vercas Apr 19 '11 at 09:18
  • @Vercas you can easy google examples like "Windows Service Keylogger" , by the way unstoppable service is not malware way. Else way you can just create an rootkit. – cnd Apr 19 '11 at 09:24
  • I've found some interesting things... But none in C#. – Vercas Apr 19 '11 at 09:28
0

Yes, it is possible, I recently wanted to do the same thing, just came across what is known as Protected Windows Services.

I know this requires a lot of effort but when it's successfully implemented there's no way not even Admin can kill the process.

You'll need to write an additional ELAM Driver for this to work :ELAM Prerequisites - Microsoft Docs

Here is the link where it is described Register service as protected service

Posted this answer as an Idea ...... If there's any problem I'll delete it.

Ashwin Raikar
  • 108
  • 1
  • 2
  • 8