被360云杀掉的代码

DWORD FindProcess(LPWSTR strProcessName)
{
    DWORD aProcesses[1024], cbNeeded, cbMNeeded;
    HMODULE hMods[1024];
    HANDLE hProcess;
    WCHAR w[255];
    LPWSTR szProcessName=w;

    if (EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) )  return 0;
    for(int i=0; i< (int) (cbNeeded / sizeof(DWORD)); i++)
    {
            hProcess = OpenProcess(  PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, aProcesses[i]);
        EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbMNeeded);
        GetModuleFileNameEx( hProcess, hMods[0], szProcessName,255);

        if(wcsstr(szProcessName, strProcessName))
        {
            return(aProcesses[i]);
        }
    }
    return 0;
}

 

注意是云杀掉，第一次杀毒病不会出问题，过几分钟在查杀就被杀了，所以是云杀毒

 

 

执行发现是EnumProcesses和EnumProcessModules调用被杀掉