zlg258369 发表于 2011-2-8 11:42:44

检查U盘自动删除当前打开U盘内cad病毒

在论坛上看到查杀cad病毒的程序多为手动查杀，现写了个自动删除的！！



    Private Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hwnd As IntPtr, ByVal lpString As String, ByVal cch As Integer) As Integer
    Private Declare Function GetWindowTextLength Lib "user32" Alias "GetWindowTextLengthA" (ByVal hwnd As IntPtr) As Integer
    Private Declare Function GetForegroundWindow Lib "user32" () As Integer

    Public Const WM_DEVICECHANGE = &H219
    Public Const DBT_DEVICEARRIVAL = &H8000
    Public Const DBT_DEVICEREMOVECOMPLETE = &H8004
    Dim DriveLetter As String

    Protected Overrides Sub WndProc(ByRef m As System.Windows.Forms.Message)
      If m.Msg = WM_DEVICECHANGE Then
            Select Case m.WParam
                Case DBT_DEVICEARRIVAL
                  Dim s() As DriveInfo = DriveInfo.GetDrives
                  For Each drive As DriveInfo In s
                        If drive.DriveType = DriveType.Removable Then
                            DriveLetter = drive.Name.ToString()
                            Timer1.Enabled = True
                        End If
                  Next
                Case DBT_DEVICEREMOVECOMPLETE
                  Dim s() As DriveInfo = DriveInfo.GetDrives
                  For Each drive As DriveInfo In s
                        If drive.ToString = DriveLetter Then Exit Sub
                  Next
                  Timer1.Enabled = False
            End Select
      End If
      MyBase.WndProc(m)
    End Sub

    Private Sub Timer1_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer1.Tick
      Dim hdl As New IntPtr(GetForegroundWindow)
      Dim strTitle As String = Space(GetWindowTextLength(hdl) + 1)
      GetWindowText(hdl, strTitle, strTitle.Length)
      If Left(strTitle, 3) = DriveLetter Then
            File.Delete(strTitle& "\ACAD.LSP")
      End If
    End Sub



上面是一个简单的例子，可以根据需要自己修改，我觉得用做成服务最好。

AMTONNY 发表于 2011-2-8 21:02:29

多谢楼主分享
页: [1]
查看完整版本: 检查U盘自动删除当前打开U盘内cad病毒