shnotify.bas

一个从未公开过的双重病毒VB源代码

Attribute VB_Name = "mShellNotify"
Option Explicit
Private m_hSHNotify As Long
Private m_pidlDesktop As Long
Public Const WM_SHNOTIFY = &H401
Public Type PIDLSTRUCT
  pidl As Long
  bWatchSubFolders As Long
End Type
Declare Function SHChangeNotifyRegister Lib "shell32" Alias "#2" _
                              (ByVal hWnd As Long, _
                              ByVal uFlags As SHCN_ItemFlags, _
                              ByVal dwEventID As SHCN_EventIDs, _
                              ByVal uMsg As Long, _
                              ByVal cItems As Long, _
                              lpps As PIDLSTRUCT) As Long


Type SHNOTIFYSTRUCT
  dwItem1 As Long
  dwItem2 As Long
End Type
Declare Function SHChangeNotifyDeregister Lib "shell32" Alias "#4" (ByVal hNotify As Long) As Boolean

Declare Sub SHChangeNotify Lib "shell32" _
                        (ByVal wEventId As SHCN_EventIDs, _
                        ByVal uFlags As SHCN_ItemFlags, _
                        ByVal dwItem1 As Long, _
                        ByVal dwItem2 As Long)


Public Enum SHCN_EventIDs
  SHCNE_RENAMEITEM = &H1
  SHCNE_CREATE = &H2
  SHCNE_DELETE = &H4
  SHCNE_MKDIR = &H8
  SHCNE_RMDIR = &H10
  SHCNE_MEDIAINSERTED = &H20
  SHCNE_MEDIAREMOVED = &H40
  SHCNE_DRIVEREMOVED = &H80
  SHCNE_DRIVEADD = &H100
  SHCNE_NETSHARE = &H200
  SHCNE_NETUNSHARE = &H400
  SHCNE_ATTRIBUTES = &H800
  SHCNE_UPDATEDIR = &H1000
  SHCNE_UPDATEITEM = &H2000
  SHCNE_SERVERDISCONNECT = &H4000
  SHCNE_UPDATEIMAGE = &H8000&
  SHCNE_DRIVEADDGUI = &H10000
  SHCNE_RENAMEFOLDER = &H20000
  SHCNE_FREESPACE = &H40000

#If (WIN32_IE >= &H400) Then
  SHCNE_EXTENDED_EVENT = &H4000000
#End If
  SHCNE_ASSOCCHANGED = &H8000000

  SHCNE_DISKEVENTS = &H2381F
  SHCNE_GLOBALEVENTS = &HC0581E0
  SHCNE_ALLEVENTS = &H7FFFFFFF
  SHCNE_INTERRUPT = &H80000000
                                                                          
End Enum

#If (WIN32_IE >= &H400) Then
 Public Const SHCNEE_ORDERCHANGED = &H2
#End If


Public Enum SHCN_ItemFlags
  SHCNF_IDLIST = &H0
  SHCNF_PATHA = &H1
  SHCNF_PRINTERA = &H2
  SHCNF_DWORD = &H3
  SHCNF_PATHW = &H5
  SHCNF_PRINTERW = &H6
  SHCNF_TYPE = &HFF
  
  SHCNF_FLUSH = &H1000
  
  SHCNF_FLUSHNOWAIT = &H2000

#If UNICODE Then
  SHCNF_PATH = SHCNF_PATHW
  SHCNF_PRINTER = SHCNF_PRINTERW
#Else
  SHCNF_PATH = SHCNF_PATHA
  SHCNF_PRINTER = SHCNF_PRINTERA
#End If
End Enum




Public Function SHNotify_Register(hWnd As Long) As Boolean
  Dim ps As PIDLSTRUCT
  If (m_hSHNotify = 0) Then
    m_pidlDesktop = GetPIDLFromFolderID(0, CSIDL_DESKTOP)
    If m_pidlDesktop Then
      ps.pidl = m_pidlDesktop
      ps.bWatchSubFolders = True
      m_hSHNotify = SHChangeNotifyRegister(hWnd, SHCNF_TYPE Or SHCNF_IDLIST, _
                                            SHCNE_ALLEVENTS Or SHCNE_INTERRUPT, _
                                            WM_SHNOTIFY, 1, ps)
      Debug.Print Hex(SHCNF_TYPE Or SHCNF_IDLIST)
      Debug.Print Hex(SHCNE_ALLEVENTS Or SHCNE_INTERRUPT)
      Debug.Print m_hSHNotify
      SHNotify_Register = CBool(m_hSHNotify)
    Else
      Call CoTaskMemFree(m_pidlDesktop)
    End If
  End If
End Function


Public Function SHNotify_Unregister() As Boolean
  If m_hSHNotify Then
    If SHChangeNotifyDeregister(m_hSHNotify) Then
      m_hSHNotify = 0
      Call CoTaskMemFree(m_pidlDesktop)
      m_pidlDesktop = 0
      SHNotify_Unregister = True
    End If
  End If
End Function

Public Function SHNotify_GetEventStr(dwEventID As Long) As String
  Dim sEvent As String
  
  Select Case dwEventID
    Case SHCNE_RENAMEITEM: sEvent = "SHCNE_RENAMEITEM"
    Case SHCNE_CREATE: sEvent = "SHCNE_CREATE"
    Case SHCNE_DELETE: sEvent = "SHCNE_DELETE"
    Case SHCNE_MKDIR: sEvent = "SHCNE_MKDIR"
    Case SHCNE_RMDIR: sEvent = "SHCNE_RMDIR"
    Case SHCNE_MEDIAINSERTED: sEvent = "SHCNE_MEDIAINSERTED"
    Case SHCNE_MEDIAREMOVED: sEvent = "SHCNE_MEDIAREMOVED"
    Case SHCNE_DRIVEREMOVED: sEvent = "SHCNE_DRIVEREMOVED"
    Case SHCNE_DRIVEADD: sEvent = "SHCNE_DRIVEADD"
    Case SHCNE_NETSHARE: sEvent = "SHCNE_NETSHARE"
    Case SHCNE_NETUNSHARE: sEvent = "SHCNE_NETUNSHARE"
    Case SHCNE_ATTRIBUTES: sEvent = "SHCNE_ATTRIBUTES"
    Case SHCNE_UPDATEDIR: sEvent = "SHCNE_UPDATEDIR"
    Case SHCNE_UPDATEITEM: sEvent = "SHCNE_UPDATEITEM"
    Case SHCNE_SERVERDISCONNECT: sEvent = "SHCNE_SERVERDISCONNECT"
    Case SHCNE_UPDATEIMAGE: sEvent = "SHCNE_UPDATEIMAGE"
    Case SHCNE_DRIVEADDGUI: sEvent = "SHCNE_DRIVEADDGUI"
    Case SHCNE_RENAMEFOLDER: sEvent = "SHCNE_RENAMEFOLDER"
    Case SHCNE_FREESPACE: sEvent = "SHCNE_FREESPACE"
    
#If (WIN32_IE >= &H400) Then
    Case SHCNE_EXTENDED_EVENT: sEvent = "SHCNE_EXTENDED_EVENT"
#End If
    
    Case SHCNE_ASSOCCHANGED: sEvent = "SHCNE_ASSOCCHANGED"
    
    Case SHCNE_DISKEVENTS: sEvent = "SHCNE_DISKEVENTS"
    Case SHCNE_GLOBALEVENTS: sEvent = "SHCNE_GLOBALEVENTS"
    Case SHCNE_ALLEVENTS: sEvent = "SHCNE_ALLEVENTS"
    Case SHCNE_INTERRUPT: sEvent = "SHCNE_INTERRUPT"
  End Select
  
  SHNotify_GetEventStr = sEvent

End Function