My problem when i run my program.
And then run virus xmirg.exe my program not see xmirg.exe name !

But if i first run xmirg.exe virus and then run my program, then my program see name and terminate xmirg process. But name xmirg.exe stay (Process32First\Process32Next get me this name always) ! Why terminateprocess not destroy xmirg.exe name from process list ?

I use Process32First\Process32Next to get processes list of names.
My algorithm next:
1) Process32First
2) Process32Next if eax=1 do 2)
3) if eax=0 do 1)

The Process32First\Process32Next put always name to one place. To pName.

pName db 512 dup (0)

Then i check pName. And if pName=xmirg i do terminateprocess.

I fixed my problem.