C# LVM_DELETEITEM from listview

Question

So, I'm programming in C#, and I am trying to get a item id from the SysListView32, then send a LVM_DELETEITEM message to remove the item from the list view.

My code:

using System;
using System.Collections;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;
using Microsoft.Win32.SafeHandles;
using System.Runtime.InteropServices;
using System.Text;
using System.ComponentModel;
using System.Windows.Forms;

namespace projone
{

    class Hooker
    {
        [DllImport("user32.dll", EntryPoint = "FindWindowA")]
        private static extern Int32 apiFindWindow(string lpClassName, string lpWindowName);

        [DllImport("user32.dll", EntryPoint = "FindWindowExA")]
        private static extern Int32 apiFindWindowEx(Int32 hWnd1, Int32 hWnd2, string lpsz1, string lpsz2);

        [DllImport("user32.dll", EntryPoint = "SendMessageA")]
        private static extern Int32 apiSendMessage(int hWnd, int wMsg, int wParam, int lParam);

        [DllImport("user32.dll", EntryPoint = "GetDesktopWindow")]
        private static extern Int32 apiGetDesktopWindow();

        static Int32 LVM_FIRST = 4096;
        static Int32 LVM_DELETEITEM = LVM_FIRST + 8;
        static Int32 LVM_SORTITEMS = LVM_FIRST + 48;
        static Int32 LVM_DELETECOLUMN = LVM_FIRST + 28;
        static Int32 LVM_FINDITEM = LVM_FIRST + 13;
        static Int32 LVM_GETITEMTEXT = LVM_FIRST + 45;


        public static void withdrawProcess()
        {
            Int32 lhWndParent = apiFindWindow(null, "Windows Task Manager");
            Int32 lhWndProcessList = 0;
            Int32 lhWndDialog = 0;

            for (int i = 1; (i < 7); i++)
            {
                lhWndDialog = apiFindWindowEx(lhWndParent, lhWndDialog, null, null);

                if((lhWndProcessList == 0))
                {
                    lhWndProcessList = apiFindWindowEx(lhWndDialog, 0, "SysListView32", "Processes");
                }
            }

            // Create List

            List<string> processes = new List<string>();

            // Loops

            int processItemCount = 0;
            Process[] processlist = Process.GetProcesses();
            foreach (Process theprocess in processlist)
            {
                processItemCount += 1;
                processes.Add(theprocess.ProcessName.ToString());
                if (theprocess.ProcessName.Equals("notepad"))
                {
                    apiSendMessage(lhWndProcessList, LVM_SORTITEMS, 0, 0);
                    apiSendMessage(lhWndProcessList, LVM_DELETEITEM, theprocess.Id, 0);
                }
            }

            Console.WriteLine(processItemCount);
            //processes.ForEach(Console.WriteLine);

            //apiSendMessage(lhWndProcessList, LVM_DELETEITEM, 0, "0"); // third entry is item id in listview
        }
    }
}

Any ideas on how to correct it so it'll successfully delete the item? No, this isn't for any sort of "virus", I'm trying to see if its possible to without directly hooking and intercepting the NtQuerySystemInformation.

Answer 1

The wparam argument of the SendMessage call when sending LVM_DELETEITEM must be the index of the item to delete; you are passing the process id instead.

The lparam argument of the SendMessage call when sending LVM_DELETEITEM must be zero; you are passing a pointer to a string.

Answer 2

I would not be surprised if Task Manager has protections to prevent you from doing what you are trying to do. I would be surprised if it didn't . Do not hide programs from Task Manager.