主题:关于VB杀进程的问题
傻瓜911 [专家分:150] 发布于 2006-04-14 19:14:00
使用以下代码可以判断 系统里是否运行了某个进程, 可是 该用什么方法结束 指定的进程呢?
以下是判断进程的代码: (感谢凡尘大虾提供)
第 6 楼
Private Declare Function CreateToolhelp32Snapshot Lib "kernel32" _
(ByVal lFlags As Long, ByVal lProcessID As Long) As Long
Private Declare Function ProcessFirst Lib "kernel32" Alias _
"Process32First" (ByVal hSnapShot As Long, uProcess _
As PROCESSENTRY32) As Long
Private Declare Function ProcessNext Lib "kernel32" Alias _
"Process32Next" (ByVal hSnapShot As Long, uProcess _
As PROCESSENTRY32) As Long
Private Declare Sub CloseHandle Lib "kernel32" (ByVal hPass _
As Long)
Const TH32CS_SNAPPROCESS As Long = 2&
Const MAX_PATH As Integer = 260
Private Type PROCESSENTRY32
dwSize As Long
cntUsage As Long
th32ProcessID As Long
th32DefaultHeapID As Long
th32ModuleID As Long
cntThreads As Long
th32ParentProcessID As Long
pcPriClassBase As Long
dwFlags As Long
szExeFile As String * MAX_PATH
End Type
Private Sub Form_Click()
Call GetExeNames
End Sub
Private Sub GetExeNames()
Dim hSnapShot As Long, Result As Long
Dim aa As String, bb As String
Dim Process As PROCESSENTRY32
hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0&)
If hSnapShot = 0 Then Exit Sub
Process.dwSize = Len(Process)
Result = ProcessFirst(hSnapShot, Process)
Do While Result <> 0
aa = Process.szExeFile
aa = Left$(aa, InStr(aa, Chr$(0)) - 1)
If LCase(aa) = "notepad.exe" Then
MsgBox "发现 记事本 程序在运行"
End
End If
Result = ProcessNext(hSnapShot, Process)
Loop
Call CloseHandle(hSnapShot)
End Sub
Private Sub Form_Load()
Me.Show
Do
DoEvents
Call GetExeNames
Loop
End Sub
回复列表 (共26个回复)
沙发
loveyouvb [专家分:1600] 发布于 2006-04-14 21:14:00
方法有挺多
我觉得最简单的方法是判断标题获得它的句柄,然后用CLOSE把它关闭。
之前好象见过一个KILLLIST控件吧,也挺好用的
板凳
帅哥阳伞 [专家分:16530] 发布于 2006-04-14 22:53:00
Private Declare Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Const PROCESS_TERMINATE = &H1
Private Sub Command2_Click()
Dim hand As Long
hand = OpenProcess(PROCESS_TERMINATE, True, Process.th32ProcessID) '获取进程句柄
TerminateProcess hand, 0 '关闭进程
End Sub
3 楼
傻瓜911 [专家分:150] 发布于 2006-04-15 15:52:00
2 楼的方法好象不可以结束比自己级别高的进程哦!??是吧?
4 楼
帅哥阳伞 [专家分:16530] 发布于 2006-04-15 20:30:00
恩,要终止比自己级别高的程序进程要提升自己的级别
在2000以上系统终止一些进程需要提升自身的权限,否则是无法结束一些系统或服务进程的.现在的病毒或木马都是以系统服务存再的 所以
下面一段代码是提升权限的VB代码.
Const STANDARD_RIGHTS_REQUIRED = &HF0000
Const TOKEN_ASSIGN_PRIMARY = &H1
Const TOKEN_DUPLICATE = (&H2)
Const TOKEN_IMPERSONATE = (&H4)
Const TOKEN_QUERY = (&H8)
Const TOKEN_QUERY_SOURCE = (&H10)
Const TOKEN_ADJUST_PRIVILEGES = (&H20)
Const TOKEN_ADJUST_GROUPS = (&H40)
Const TOKEN_ADJUST_DEFAULT = (&H80)
Const TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED Or TOKEN_ASSIGN_PRIMARY Or _
TOKEN_DUPLICATE Or TOKEN_IMPERSONATE Or TOKEN_QUERY Or TOKEN_QUERY_SOURCE Or _
TOKEN_ADJUST_PRIVILEGES Or TOKEN_ADJUST_GROUPS Or TOKEN_ADJUST_DEFAULT)
Const SE_PRIVILEGE_ENABLED = &H2
Const ANYSIZE_ARRAY = 1
Private Type LUID
lowpart As Long
highpart As Long
End Type
Private Type LUID_AND_ATTRIBUTES
pLuid As LUID
Attributes As Long
End Type
Private Type TOKEN_PRIVILEGES
PrivilegeCount As Long
Privileges(ANYSIZE_ARRAY) As LUID_AND_ATTRIBUTES
End Type
Private Declare Function GetCurrentProcess Lib "kernel32" () As Long
Private Declare Function LookupPrivilegeValue Lib "advapi32.dll" Alias "LookupPrivilegeValueA" (ByVal lpSystemName As String, ByVal lpName As String, lpLuid As LUID) As Long
Private Declare Function AdjustTokenPrivileges Lib "advapi32.dll" (ByVal TokenHandle As Long, ByVal DisableAllPrivileges As Long, NewState As TOKEN_PRIVILEGES, ByVal BufferLength As Long, PreviousState As TOKEN_PRIVILEGES, ReturnLength As Long) As Long
Private Declare Function OpenProcessToken Lib "advapi32.dll" (ByVal ProcessHandle As Long, ByVal DesiredAccess As Long, TokenHandle As Long) As Long
public Sub AdjustTokenPrivileges2000()'把这个过程放再窗体LOAD事件中即可
Dim hdlProcessHandle As Long
Dim hdlTokenHandle As Long
Dim tmpLuid As LUID
Dim tkp As TOKEN_PRIVILEGES
Dim tkpNewButIgnored As TOKEN_PRIVILEGES
Dim lBufferNeeded As Long
Dim lp As Long
hdlProcessHandle = GetCurrentProcess()
lp = OpenProcessToken(hdlProcessHandle, TOKEN_ALL_ACCESS, hdlTokenHandle)
lp = LookupPrivilegeValue("", "SeDebugPrivilege", tmpLuid)
tkp.PrivilegeCount = 1
tkp.Privileges(0).pLuid = tmpLuid
tkp.Privileges(0).Attributes = SE_PRIVILEGE_ENABLED
lp = AdjustTokenPrivileges(hdlTokenHandle, False, tkp, Len(tkpNewButIgnored), tkpNewButIgnored, lBufferNeeded)
End Sub
该方法2000下可以,其他不行的
6 楼
傻瓜911 [专家分:150] 发布于 2006-05-09 09:28:00
我的系统里有一个进程,估计是中了木马,进程名为“Internet Explorer.exe”显示的用户是 “system” 在进程管理器里可以看到也可以结束, 我使用凡程大虾 判断进程存在 以及 “帅哥阳伞” 的结束进程的 方法来结束 它,但是发现无效,估计是因为 “Internet Explorer.exe” 进程的级别比我的程序级别高, 请问要想结束掉“Internet Explorer.exe” 这个进程应该怎么办? “帅哥阳伞” 的提升级别的办法好象只在 2000下有效,局限性太大!
我已经把该木马服务端 传上空间,[url=http://2008.3126.net/88.rar ]点此[/url]可以下载该木马。大虾可以测试一下,但是小心一点是木马的!运行以后会 启动本机的服务服务名称是“Remote Cortrol King”,我现在还没有搞清楚是什么木马 只知道运行以后会在C:\WINDOWS 下产生Internet Explorer.exe的文件(要打开系统文件和隐藏文件才可以看得到),并且会启动一个服务, 这个东西把我害惨了,我想写个卸载程序卸载它。
然后还要用到清除服务的代码 (清除Remote Cortrol King 的 服务),不知道哪位高手知道如何清除系统里的服务!请把代码贴出来
7 楼
老大徒伤悲 [专家分:29120] 发布于 2006-05-09 12:59:00
“Internet Explorer.exe”不会是木马吧?
8 楼
seawaycao [专家分:3910] 发布于 2006-05-09 18:12:00
极有可能是木马或病毒!!……
楼主注意装强一点的杀毒软件啊!!
9 楼
傻瓜911 [专家分:150] 发布于 2006-05-09 19:56:00
是木马,我知道是木马啊!杀毒软件也可以查出是后门程序啊,我都运行过了,才分析出来的,所以现在我就是想写一个卸载程序啊,看到木马就怕,好象算不上的大虾哦!
10 楼
傻瓜911 [专家分:150] 发布于 2006-05-17 07:19:00
好象这里的人一看到木马就怕死了,晕?
我来回复