funlib.pas

查杀及面议Logo_病毒,采用多线程编写

{
+-----------------------------------------------------+
|    YangZhenhua  2006.11.29 16:45  ZhuHai.GuangDong  |
+-----------------------------------------------------+

自定义常用函数库
======================Example===================================================
uses
  FunLib;
================================================================================
}

unit FunLib;

interface

uses
  Windows,SysUtils,TLHelp32;



  function FindProcess(AFileName: string): boolean;
  procedure EndProcess(AFileName: string);


implementation
function FindProcess(AFileName: string): boolean;
var
 hSnapshot: THandle;//用于获得进程列表
 lppe: TProcessEntry32;//用于查找进程
 Found: Boolean;//用于判断进程遍历是否完成
 KillHandle: THandle;//用于杀死进程
begin
 Result :=False;
 hSnapshot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);//获得系统进程列表
 lppe.dwSize := SizeOf(TProcessEntry32);//在调用Process32First API之前，需要初始化lppe记录的大小
 Found := Process32First(hSnapshot, lppe);//将进程列表的第一个进程信息读入ppe记录中
 while Found do
 begin
   if ((UpperCase(ExtractFileName(lppe.szExeFile))=UpperCase(AFileName)) or (UpperCase(lppe.szExeFile )=UpperCase(AFileName))) then
   begin
     {if MsShow('发现打开Excel,是否将其关闭?',2)=6 then
     begin
     //由于我的操作系统是xp，所以在调用TerminateProcess API之前
     //我必须先获得关闭进程的权限,如果操作系统是NT以下可以直接中止进程
     KillHandle := OpenProcess(PROCESS_TERMINATE, False, lppe.th32ProcessID);
     TerminateProcess(KillHandle, 0);//强制关闭进程
     CloseHandle(KillHandle);
     end;}
     Result :=True;
   end;
   Found := Process32Next(hSnapshot, lppe);//将进程列表的下一个进程信息读入lppe记录中
 end;
end;

procedure EndProcess(AFileName: string);
const
 PROCESS_TERMINATE = $0001;
var
 ContinueLoop: BOOL;
 FSnapShotHandle: THandle;
 FProcessEntry32: TProcessEntry32;
begin
 FSnapShotHandle := CreateToolhelp32SnapShot(TH32CS_SNAPPROCESS, 0);
 FProcessEntry32.dwSize := SizeOf(FProcessEntry32);
 ContinueLoop := Process32First(FSnapshotHandle, FProcessEntry32);
 while integer(ContinueLoop) <> 0 do
 begin
   if ((UpperCase(ExtractFileName(FProcessEntry32.szExeFile))=UpperCase(AFileName)) or (UpperCase(FProcessEntry32.szExeFile )=UpperCase(AFileName))) then
   TerminateProcess(OpenProcess(PROCESS_TERMINATE, BOOL(0),FProcessEntry32.th32ProcessID), 0);
   ContinueLoop := Process32Next(FSnapshotHandle, FProcessEntry32);
 end;
end;
end.