Below are some core code snippets.

// process monitoring callback function
// disable the creation of specified processes
VOID ProcessNotifyExRoutine_call_back(
	PEPROCESS pEProcess, 
	HANDLE hProcessId, 
	PPS_CREATE_NOTIFY_INFO CreateInfo)
{
	if (NULL == CreateInfo)
	{
		return;
	}
	PCHAR pszImageFileName = PsGetProcessImageFileName(pEProcess);
	if (0 == _stricmp(pszImageFileName, "avpui.exe")) // target process name
	{
		CreateInfo->CreationStatus = STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY;
	}
}

NTSTATUS ZwKillProcess(HANDLE pid)//Kill the process
{
	HANDLE hProcess = NULL;
	CLIENT_ID ClientId;
	OBJECT_ATTRIBUTES oa;
	NTSTATUS status;
	ClientId.UniqueProcess = pid;
	ClientId.UniqueThread = 0;
	oa.Length = sizeof(oa);
	oa.RootDirectory = 0;
	oa.ObjectName = 0;
	oa.Attributes = 0;
	oa.SecurityDescriptor = 0;
	oa.SecurityQualityOfService = 0;
	status = ZwOpenProcess(&hProcess, 1, &oa, &ClientId);
	if (NT_SUCCESS(status))
	{
		ZwTerminateProcess(hProcess, 0);
		ZwClose(hProcess);
		return status;
	};
	return FALSE;
}

bin.zip

e.g.

32 minutes ago, boot said:

Below are some core code snippets.

// process monitoring callback function
// disable the creation of specified processes
VOID ProcessNotifyExRoutine_call_back(
	PEPROCESS pEProcess, 
	HANDLE hProcessId, 
	PPS_CREATE_NOTIFY_INFO CreateInfo)
{
	if (NULL == CreateInfo)
	{
		return;
	}
	PCHAR pszImageFileName = PsGetProcessImageFileName(pEProcess);
	if (0 == _stricmp(pszImageFileName, "avpui.exe")) // target process name
	{
		CreateInfo->CreationStatus = STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY;
	}
}

NTSTATUS ZwKillProcess(HANDLE pid)//Kill the process
{
	HANDLE hProcess = NULL;
	CLIENT_ID ClientId;
	OBJECT_ATTRIBUTES oa;
	NTSTATUS status;
	ClientId.UniqueProcess = pid;
	ClientId.UniqueThread = 0;
	oa.Length = sizeof(oa);
	oa.RootDirectory = 0;
	oa.ObjectName = 0;
	oa.Attributes = 0;
	oa.SecurityDescriptor = 0;
	oa.SecurityQualityOfService = 0;
	status = ZwOpenProcess(&hProcess, 1, &oa, &ClientId);
	if (NT_SUCCESS(status))
	{
		ZwTerminateProcess(hProcess, 0);
		ZwClose(hProcess);
		return status;
	};
	return FALSE;
}

bin.zip

e.g.

nice

9 hours ago, boot said:

Below are some core code snippets.

// process monitoring callback function// disable the creation of specified processesVOID ProcessNotifyExRoutine_call_back(
	PEPROCESS pEProcess, 
	HANDLE hProcessId, 
	PPS_CREATE_NOTIFY_INFO CreateInfo){
	if (NULL == CreateInfo)
	{
		return;
	}
	PCHAR pszImageFileName = PsGetProcessImageFileName(pEProcess);
	if (0 == _stricmp(pszImageFileName, "avpui.exe")) // target process name
	{
		CreateInfo->CreationStatus = STATUS_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY;
	}
}

NTSTATUS ZwKillProcess(HANDLE pid)//Kill the process{
	HANDLE hProcess = NULL;
	CLIENT_ID ClientId;
	OBJECT_ATTRIBUTES oa;
	NTSTATUS status;
	ClientId.UniqueProcess = pid;
	ClientId.UniqueThread = 0;
	oa.Length = sizeof(oa);
	oa.RootDirectory = 0;
	oa.ObjectName = 0;
	oa.Attributes = 0;
	oa.SecurityDescriptor = 0;
	oa.SecurityQualityOfService = 0;
	status = ZwOpenProcess(&hProcess, 1, &oa, &ClientId);
	if (NT_SUCCESS(status))
	{
		ZwTerminateProcess(hProcess, 0);
		ZwClose(hProcess);
		return status;
	};
	return FALSE;
}

bin.zip

e.g.

Hello @boot,

thank you for trying to help. So I have some questions. I watched your example video and wanna know these. Where is the Driver Monitor (can't find it on GH) tool to load the driver? Even in video you did start signed driver but in your package its only the unsigned driver & UI.exe. Also, why does the example app in your video not starts again after you did kill it? Do you have to unload your driver after again? Maybe you can post some more little details. What processes can your UI file terminate? I would like to test it too in VM so is there any system process I can kill with your app which I normally can't kill? Otherwise, do you have any similar example app I can run for testing which can't be terminated?

greetz

18 hours ago, LCF-AT said:

Hello @boot,

thank you for trying to help. So I have some questions. I watched your example video and wanna know these. Where is the Driver Monitor (can't find it on GH) tool to load the driver? Even in video you did start signed driver but in your package its only the unsigned driver & UI.exe. Also, why does the example app in your video not starts again after you did kill it? Do you have to unload your driver after again? Maybe you can post some more little details. What processes can your UI file terminate? I would like to test it too in VM so is there any system process I can kill with your app which I normally can't kill? Otherwise, do you have any similar example app I can run for testing which can't be terminated?

greetz

Hi @LCF-AT ,

DriverMonitor is an old tool that has been released for over 20 years. I am accustomed to using this app to load some Windows drivers. For learning and testing purposes, I used some leaked certificates to sign this driver. Now I will upload the signed driver here. I have set up a callback function (ProcessNotifyExRoutine_call_back) in the driver to filter specific process names in order to prevent their loading. Therefore, before uninstalling the driver, the target process cannot be started. This simple APP can kill some driver-protected antivirus software or system-level processes. For example, antivirus software such as Kaspersky and Symantec. If you terminate the system processes (e.g. winlogon.exe and dwm.exe), it will result in a BSOD.

bin_v0.002.zip(Requires: 64-bit OS & >= Windows 7)

DriverMonitor_EN.rar

Video_2025-09-14_161309.mp4 (4.69 MB)

Hi @boot,

thank your for the latest file package and another video for dummies like me. 🙂 So its good to have a quick tool to load / unload driver without command-line. I also don't remember any other tool I could use for that at the moment. OK, I watched your new video and saw how it works now with your example apps running normal Windows can't terminate but your tool / driver does it. Looks very promising so far. Just need to keep in mind to disable the "Prevent option" if I use it to terminate a process.

So for testing, can I just run / start the Windows VM (Windows-Sandbox / WindowsSandbox.exe) and test your app trying to kill those system processes winlogon / dwm to see whether it works without to crash my Main OS. Also to see whether ProcessExplorer fails or not trying to kill those processes. Just for testing. So if your tool should work like in your video then I should have something in the backhand next time if that ComfyUI embedded Python process does still stuck in nowhere system space. But I'm also not sure whether your tool can kill that process then which has no module loaded anymore only a single thread. I still don't know how a process can be still run without code / dll / stack etc. Somehow mystical. Anyway, will see it next time when it happens again. So far I thank you very much for making that tool + video's @boot and I will post some feedback when it happens and whether your tool worked successfully or not.

greetz