先说一下NT服务的特点：
1.随系统的启动而启动
2.隐蔽性比较好，一般的手动方式不能删除
3.只适用于NT内核的OS
WIN98下的请参考RegisterServiceProcess API,这个API函数将进程注册为一个服务模式的进程.
下面是我写好的class,你只要在这个程序中用这个包含这个.h文件就可以了。
======================
service.h
// Service.h: interface for the CService class.
//
//////////////////////////////////////////////////////////////////////
#if !defined(AFX_SERVICE_H__6ED74430_7123_484D_8CBD_A8E15381A869__INCLUDED_)
#define AFX_SERVICE_H__6ED74430_7123_484D_8CBD_A8E15381A869__INCLUDED_
#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000
#include "winsvc.h"
class CService
{
public:
void Init_Service_Table_Entry();
CService();
virtual ~CService();
void InstallService();
static void WINAPI ServiceMain(DWORD dwArgc, LPTSTR *lpszArgv);
static void WINAPI BeginSrv(DWORD Opcode);
//
//static SERVICE_STATUS_HANDLE hServiceStatus;
//static SC_HANDLE scm,svc;
//static SERVICE_STATUS serviceStatus;
};
#endif // !defined(AFX_SERVICE_H__6ED74430_7123_484D_8CBD_A8E15381A869__INCLUDED_)
////////////////////////////
Service.cpp
// Service.cpp: implementation of the CService class.
//
//////////////////////////////////////////////////////////////////////
#include "stdafx.h"
#include "Service.h"
#ifdef _DEBUG
#undef THIS_FILE
static char THIS_FILE[]=__FILE__;
#define new DEBUG_NEW
#endif
//////////////////////////////////////////////////////////////////////
// Construction/Destruction
//////////////////////////////////////////////////////////////////////
SERVICE_STATUS_HANDLE hServiceStatus;
SC_HANDLE scm,svc;
SERVICE_STATUS serviceStatus;
CService::CService()
{
}
CService::~CService()
{
}
void WINAPI CService::BeginSrv(DWORD Opcode)
{
switch(Opcode)
{
case SERVICE_CONTROL_STOP:
serviceStatus.dwCurrentState =SERVICE_STOPPED;
SetServiceStatus (hServiceStatus,&serviceStatus);
break;
case SERVICE_CONTROL_CONTINUE:
serviceStatus.dwCurrentState = SERVICE_RUNNING;
SetServiceStatus (hServiceStatus,&serviceStatus);
break;
case SERVICE_CONTROL_PAUSE:
serviceStatus.dwCurrentState = SERVICE_PAUSED;
SetServiceStatus (hServiceStatus,&serviceStatus);
break;
case SERVICE_CONTROL_INTERROGATE:
break;
}
SetServiceStatus (hServiceStatus,&serviceStatus);
}
void CService::Init_Service_Table_Entry()
{
SERVICE_TABLE_ENTRY ste[2];
ste[0].lpServiceName="VirusService";//Service Name
ste[0].lpServiceProc=ServiceMain; //service function Name
// the last one must be NULL
ste[1].lpServiceName=NULL;
ste[1].lpServiceProc=NULL;
StartServiceCtrlDispatcher(ste);
InstallService();
}
void WINAPI CService::ServiceMain(DWORD dwArgc, LPTSTR *lpszArgv)
{
serviceStatus.dwServiceType = SERVICE_WIN32;
serviceStatus.dwCurrentState = SERVICE_START_PENDING;
serviceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP|SERVICE_ACCEPT_PAUSE_CONTINUE;
serviceStatus.dwServiceSpecificExitCode = 0;
serviceStatus.dwWin32ExitCode = 0;
serviceStatus.dwCheckPoint = 0;
serviceStatus.dwWaitHint = 0;
RegisterServiceCtrlHandler("VirusService",BeginSrv);
serviceStatus.dwCurrentState = SERVICE_RUNNING;
serviceStatus.dwCheckPoint = 0;
serviceStatus.dwWaitHint = 0;
SetServiceStatus(hServiceStatus,&serviceStatus);
serviceStatus.dwCurrentState = SERVICE_RUNNING;
serviceStatus.dwCheckPoint = 0;
serviceStatus.dwWaitHint = 0;
SetServiceStatus(hServiceStatus,&serviceStatus); //set service status
}
void CService::InstallService()
{
//Get the modulefilename
char currentPath[128];
GetModuleFileName(NULL,currentPath,128);
char* p = strrchr(currentPath,'\\'); //检测最后是否以"\"结尾，如果是，删除。
if (*p) //返回当前文件的路径
*p = 0;
LPCTSTR lpsysfilename;
lpsysfilename=(LPCTSTR)lstrcat(currentPath,"\test.exe");
scm=OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);
if(scm!=NULL)
svc=CreateService(scm,"VirusService","VirusService",SERVICE_ALL_ACCESS,
SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS,SERVICE_AUTO_START,SERVICE_ERROR_IGNORE,lpsysfilename,NULL,NULL,NULL,NULL,NULL);
if(svc!=NULL)
svc=OpenService(scm,"VirusService",SERVICE_START);
if (svc!=NULL)
{
StartService(svc,0,NULL);
CloseServiceHandle(svc);
}
CloseServiceHandle(scm);
}
好了，这个服务程序到此就结束了，写个测试程序吧，然后用
CService ntservice;
ntservice.Init_Service_Table_Entry();
到你的控制面板，可以看到系统的服务中是否多了一个virusservice
本程序在winxp+vc6下测通过。
