黑客技巧之用VB实现木马式隐形运行程序

Public Declare Function GetCurrentProcessId Lib “kernel32” () As 
Long 
  ’获得当前进程ID函数的声明 
  Public Declare Function RegisterServiceProcess Lib “kernel32” (ByVal ProcessId As 
Long, ByVal ServiceFlags As   Lo ng) As Long 
  ’在系统中注册当前进程ID函数的声明

form1.Visible=False
  form1.ShowInTaskBar=False
  在代码窗口添加如下代码：

Private Declare Function GetDriveType Lib “kernel32” Alias “GetDriveTypeA” (ByVal 
nDrive As String) As Long 
’获得当前驱动器类型函数的声明 
Private Declare Function GetVolumeInformation Lib “kernel32” Alias 
“GetVolumeInformationA” (ByVal lpRootPathName As String, ByVal lpVolumeNameBuffer As 
String, ByVal nVolumeNameSize As Long, lpVolumeSerialNumber As Long, 
lpMaximumComponentLength As Long, lpFileSystemFlags As Long, ByVal lpFileSystemNameBuffer 
As String, ByVal nFileSystemNameSize As Long) As Long 
’获得当前驱动器信息函数的声明 
Private Sub Form_Load() 
Dim drive_no As Long, drive_flag As Long 
Dim drive_chr As String, drive_disk As String 
Dim serial_no As Long, kkk As Long 
Dim stemp3 As String, dflag As Boolean 
Dim strlabel As String, strtype As String，strc As Long 
RegisterServiceProcess GetCurrentProcessId, 1 ’ 从系统中取消当前进程 
strlabel = String(255, Chr(0)) 
strtype = String(255, Chr(0)) 
stemp3 = “172498135” ’这是作者C盘的序列号（十进制）,读者可根据自己情况更改。 
dflag = False 
For drive_no = 0 To 25 
　drive_disk = Chr(drive_no + 67) 
　drive_chr = drive_disk & “:\” 
　drive_flag = GetDriveType(drive_chr) 
　If drive_flag = 3 Then 
 kkk = GetVolumeInformation(drive_chr, strlabel, Len(strlabel), serial_no, 0, 0, 
strtype, Len(strtype)) ’通过GetVolumeInformation获得磁盘序列号 
　Select Case drive_no 
 Case 0 
 strc = serial_no 
　End Select 
　If serial_no = stemp3 Then 
 dflag = True 
 Exit For 
　End If 
End If 
Next drive_no 
If drive_no = 26 And dflag = False Then ’非法用户 
　GoTo err: 
End If 
MsgBox (“HI，合法用户！”) 
Exit Sub 
err: 
　MsgBox (“错误!你的C：盘ID号是” & strc) 
End Sub 
Private Sub Form_Unload(Cancel As Integer) 
RegisterServiceProcess GetCurrentProcessId, 0 ’从系统中取消当前程序的进程 
End Sub