#include  < stdio.h >
#include  < windows.h >
#include  " PSAPI.H "
#pragma  comment( lib, "PSAPI.LIB" )
int  TerminateProcessFromId(DWORD dwId); // 结束进程函数
BOOL EnablePriv(); // 提升进程权限


int  main( void )
... {
    printf("流氓软件ttdianying专杀工具         by:冷风袭人 ");
    DWORD processid[1024],needed,processcount,i;
    HANDLE hProcess;
    HMODULE hModule;
    char path[256] = "";
    char name[256] = "system32/drivers/svchost.exe";//流氓进程字符串
    BOOL ret=true;

    EnablePriv();//提升进程权限
    EnumProcesses(processid, sizeof(processid), &needed);
    processcount=needed/sizeof(DWORD);
    
    for (i=0;i<processcount;i++)
    ...{
            hProcess=OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,false,processid[i]);

            EnumProcessModules(hProcess, &hModule, sizeof(hModule), &needed);//枚举进程
            GetModuleFileNameEx(hProcess, hModule, path, sizeof(path));//得到进程路径

            if(strstr(path,name))//是否包含流氓进程字符串
            ...{
                printf("发现流氓进程... ");
                TerminateProcessFromId(processid[i]);//调用结束进程函数
                printf("正在删除文件... ");
                ::DeleteFile(path);
                printf("正清理注册表... ");
                HKEY key;
                LPCTSTR data="SOFTWARE/Microsoft/Windows/CurrentVersion/Run";
                ::RegOpenKeyEx(HKEY_LOCAL_MACHINE,data,0,KEY_WRITE,&key);
                ::RegDeleteValue(key,"svchost");
                ::RegCloseKey(key);
                printf("软件清理成功... ");
                ret=false;

            } 

    }
    
    if(ret)
    ...{
        printf("没有发现流氓软件... ");
    }
    CloseHandle(hProcess);
    CloseHandle(hModule);
    
    return 0;
}


int  TerminateProcessFromId(DWORD dwId)     // 结束进程函数
... {
    BOOL bRet=FALSE;

    HANDLE hProcess=::OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwId);
    if(hProcess!=NULL)
    ...{
        bRet=::TerminateProcess(hProcess,0);
    }

    ::CloseHandle(hProcess);

    if(bRet)
        printf("进程结束成功... ");
    else
        printf("进程结束失败... ");

    return 0;
}


BOOL EnablePriv() // 提升进程权限
... {

HANDLE hToken;
if ( OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken) )
...{
    TOKEN_PRIVILEGES tkp;
    
    LookupPrivilegeValue( NULL,SE_DEBUG_NAME,&tkp.Privileges[0].Luid );//修改进程权限
    tkp.PrivilegeCount=1;
    tkp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
    AdjustTokenPrivileges( hToken,FALSE,&tkp,sizeof tkp,NULL,NULL );//通知系统修改进程权限
    
    return( (GetLastError()==ERROR_SUCCESS) );

}
}