主题:关于VB杀进程的问题
傻瓜911 [专家分:150] 发布于 2006-04-14 19:14:00
使用以下代码可以判断 系统里是否运行了某个进程, 可是 该用什么方法结束 指定的进程呢?
以下是判断进程的代码: (感谢凡尘大虾提供)
第 6 楼
Private Declare Function CreateToolhelp32Snapshot Lib "kernel32" _
(ByVal lFlags As Long, ByVal lProcessID As Long) As Long
Private Declare Function ProcessFirst Lib "kernel32" Alias _
"Process32First" (ByVal hSnapShot As Long, uProcess _
As PROCESSENTRY32) As Long
Private Declare Function ProcessNext Lib "kernel32" Alias _
"Process32Next" (ByVal hSnapShot As Long, uProcess _
As PROCESSENTRY32) As Long
Private Declare Sub CloseHandle Lib "kernel32" (ByVal hPass _
As Long)
Const TH32CS_SNAPPROCESS As Long = 2&
Const MAX_PATH As Integer = 260
Private Type PROCESSENTRY32
dwSize As Long
cntUsage As Long
th32ProcessID As Long
th32DefaultHeapID As Long
th32ModuleID As Long
cntThreads As Long
th32ParentProcessID As Long
pcPriClassBase As Long
dwFlags As Long
szExeFile As String * MAX_PATH
End Type
Private Sub Form_Click()
Call GetExeNames
End Sub
Private Sub GetExeNames()
Dim hSnapShot As Long, Result As Long
Dim aa As String, bb As String
Dim Process As PROCESSENTRY32
hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0&)
If hSnapShot = 0 Then Exit Sub
Process.dwSize = Len(Process)
Result = ProcessFirst(hSnapShot, Process)
Do While Result <> 0
aa = Process.szExeFile
aa = Left$(aa, InStr(aa, Chr$(0)) - 1)
If LCase(aa) = "notepad.exe" Then
MsgBox "发现 记事本 程序在运行"
End
End If
Result = ProcessNext(hSnapShot, Process)
Loop
Call CloseHandle(hSnapShot)
End Sub
Private Sub Form_Load()
Me.Show
Do
DoEvents
Call GetExeNames
Loop
End Sub
回复列表 (共26个回复)
11 楼
凡尘 [专家分:9680] 发布于 2006-05-17 09:17:00
Const WM_CLOSE = &H10
Private Declare Function PostMessage Lib "user32" Alias "PostMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long
Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As Long, ByVal lpWindowName As Long) As Long
Private Declare Function GetParent Lib "user32" (ByVal hwnd As Long) As Long
Private Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hwnd As Long, lpdwProcessId As Long) As Long
Private Declare Function GetWindow Lib "user32" (ByVal hwnd As Long, ByVal wCmd As Long) As Long
Function pDToWnd(ByVal target_pid As Long) As Long
Dim test_hwnd As Long, test_pid As Long, test_thread_id As Long
'Find the first window
test_hwnd = FindWindow(ByVal 0&, ByVal 0&)
Do While test_hwnd <> 0
'Check if the window isn't a child
If GetParent(test_hwnd) = 0 Then
'Get the window's thread
test_thread_id = GetWindowThreadProcessId(test_hwnd, test_pid)
If test_pid = target_pid Then
pDToWnd = test_hwnd
Exit Do
End If
End If
test_hwnd = GetWindow(test_hwnd, GW_HWNDNEXT)
Loop
End Function
'用:以下代码试试,我没有试过pid=*.th32ProcessID
PostMessage pDToWnd(pid), WM_CLOSE, 0&, 0&
12 楼
VB浪子 [专家分:7690] 发布于 2006-05-20 23:17:00
运行->ntsd -c q -p 进程PID 你想杀什么进程就可以
14 楼
帅哥阳伞 [专家分:16530] 发布于 2006-05-21 14:53:00
利用HIJACKTHIS软件旧可以杀木马,木马一般注册成服务的,所以杀前最好进安全模式.
15 楼
yong311408 [专家分:2720] 发布于 2006-05-21 15:25:00
好工具!!!
不知版主你有没有这个工具的其他功能的使用方法和实例!
16 楼
帅哥阳伞 [专家分:16530] 发布于 2006-05-21 22:04:00
HIJACKTHIS工具的使用方法,你只要在GOOGLE搜索灰鸽子病毒查杀就会有很多关于HIJACKTHIS的使用
17 楼
傻瓜911 [专家分:150] 发布于 2006-05-22 09:22:00
晕,我是想自己写一个清除服务的 程序啊! 不是说我不会杀!!??
18 楼
yong311408 [专家分:2720] 发布于 2006-05-22 22:05:00
傻瓜911 大姐!
你会用ntsd啊!
能详细说一下他的用法吗?
19 楼
傻瓜911 [专家分:150] 发布于 2006-05-22 22:59:00
还没有空实验犯尘大虾的代码,不过先奖励20分先!
20 楼
guoyong_cy [专家分:3050] 发布于 2006-06-12 00:18:00
[quote]好象这里的人一看到木马就怕死了,晕?[/quote]
看到木马都怕...
我遇到木马的方法基本上都是手动清除,又不是病毒,怕毛线
我来回复