DWORD FindProcess(LPWSTR strProcessName)
{
DWORD aProcesses[1024], cbNeeded, cbMNeeded;
HMODULE hMods[1024];
HANDLE hProcess;
WCHAR w[255];
LPWSTR szProcessName=w;
if (EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) ) return 0;
for(int i=0; i< (int) (cbNeeded / sizeof(DWORD)); i++)
{
hProcess = OpenProcess( PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, aProcesses[i]);
EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbMNeeded);
GetModuleFileNameEx( hProcess, hMods[0], szProcessName,255);
if(wcsstr(szProcessName, strProcessName))
{
return(aProcesses[i]);
}
}
return 0;
}
注意是云杀掉,第一次杀毒病不会出问题,过几分钟在查杀就被杀了,所以是云杀毒
执行发现是EnumProcesses和EnumProcessModules调用被杀掉