Depending on how it's closed maybe this would work: http://msdn.microsoft.com/en-us/library/windows/desktop/aa373347(v=vs.85).aspx Pay close attention to this:
The longer the wait time the better IMO. That's if it's not critical for the file to be running within even 5 minutes? You're right that my suggestion wouldn't work in your case. If the keygen was your own executable that was getting stopped then it would probably work but as it's not I think your current method would be the most efficient.
Well, You can use it to view if process it running and Kill it : Code: public bool ProcessFinderAndKiller(string process) { foreach (Process clsProcess in Process.GetProcesses()) { if (clsProcess.ProcessName.StartsWith(process)) { //kill process if it is running clsProcess.Kill(); //return true if process still running return true; } } //return false if process still not running return false; } Modding to find any: Code: public bool ProcessFinder(string process) { foreach (Process clsProcess in Process.GetProcesses()) { if (clsProcess.ProcessName.StartsWith(process)) { //return true if process still running return true; } } //return false if process still not running return false; } Bool functions, return true or false, you can use: Code: ProcessFinder("winamp"); [ aways without .exe ] ProcessFinderAndKiller("winamp"); [ aways without .exe ]
@codyqx4, so far i've not had any trouble at all using your microsoft toolkit that uses vbc.exe to run kms. it's not disappeared ever, and both microsoft security essentials and avast even though they detect it when it runs as malicious they never notify the user exactly what the file/process is only the pid. but if vbc.exe is put on the exceptions/exclusions lists it never even notifies that anything is wrong at all. i don't think there is any need for you to make anything other than what you have honestly. the original kmsemulator, and this new kms run through vbc are perfect how they are. and even if something new you develop uses roughly no memory at all, it's still better to have something run once at startup and then stop as opposed to having something running all the time in the background. it's like de-evolution in the process i think...