如何卸载其它进程中加载的指定DLL
比如,有木马插到了explorer里面,我想把他卸载该怎么做? 问题点数：100、回复次数：17Top
1 楼netsys2（来电！）回复于 2006-01-12 13:37:19 得分 0
这里图文并茂：
http://www.jiangmin.com/news/jiangmin/jmnews/chinajm/2005129101822.htmTop
2 楼constantine（飘遥的安吉儿）回复于 2006-01-12 13:46:31 得分 0
木马专杀软件一般就可以Top
3 楼lbg（lbg）回复于 2006-01-12 14:52:08 得分 0
BCB编程能实现吗?Top
4 楼cczlp（不惑）回复于 2006-01-12 16:28:33 得分 0
dwProcessID :目标进程
szDllName: 目标进程的DLL路径
DWORD dwHandle;
HANDLE hProcess = OpenProcess( PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,
FALSE, dwProcessID) ;
if (!hProcess)
{
return ;
}
HANDLE hThread = CreateRemoteThread( hProcess, NULL, 0,
(LPTHREAD_START_ROUTINE)GetModuleHandle,
(LPVOID)szDllName, 0, NULL);
if (hThread == NULL)
{
CloseHandle(hProcess);
return ;
}
// 等待GetModuleHandle运行完毕
WaitForSingleObject( hThread, INFINITE );
// 获得GetModuleHandle的返回值
GetExitCodeThread( hThread, &dwHandle );
CloseHandle(hThread);
// 使目标进程调用FreeLibrary，卸载DLL
hThread = CreateRemoteThread( hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)FreeLibrary,
(LPVOID)dwHandle, 0, NULL);
// 等待FreeLibrary卸载完毕
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
CloseHandle(hProcess);Top
5 楼cczlp（不惑）回复于 2006-01-12 16:30:30 得分 0
大致过程是这样的, 自己调试吧Top
6 楼ccrun（老妖)(www.ccrun.com）回复于 2006-01-12 16:33:37 得分 0
编程当然可以实现。
1. 通过枚举模块，先取得该dll的句柄
2. 用OpenProcess先打开目标进程
3. 用GetProcAddress取得FreeLibrary函数的地址，然后用CreateRemoteThread在目标进程中开辟一个线程，执行这个FreeLibrary(传入的参数就是第一步取得的句柄)，等待线程执行完毕就OK了。
4. 关闭所有打开的东东。Top
7 楼ccrun（老妖)(www.ccrun.com）回复于 2006-01-12 16:35:00 得分 0
晕。刚写了几句话，就有人贴代码了。Top
8 楼lbg（lbg）回复于 2006-01-13 09:25:26 得分 0
我的改写的代码:
void __fastcall UNIT_pro::UnLoadDll(String str_proce, String str_dllname)
{
AnsiString tmpstr="";
PROCESSENTRY32 pinfo;
pinfo.dwSize = sizeof(pinfo);
DWORD dw_pid=0;
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if(snapshot == NULL) return;
bool flag = Process32First(snapshot,&pinfo);
while(flag)
{
tmpstr=AnsiString(pinfo.szExeFile) ;
if((ExtractFileName(tmpstr)).UpperCase() ==str_proce.UpperCase())
{
dw_pid=pinfo.th32ProcessID ;
break;
}
flag = Process32Next(snapshot,&pinfo);
}
CloseHandle(snapshot);
DWORD dwHandle;
HANDLE hProcess1 = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,FALSE, dw_pid) ;
if (!hProcess1) return ;
HANDLE hThread = CreateRemoteThread( hProcess1, NULL, 0,(LPTHREAD_START_ROUTINE)GetModuleHandle,(LPVOID)str_dllname.c_str() , 0, NULL);
if (hThread == NULL)
{
CloseHandle(hProcess1);
return ;
}
// 等待GetModuleHandle运行完毕
WaitForSingleObject( hThread, INFINITE );
// 获得GetModuleHandle的返回值
GetExitCodeThread( hThread, &dwHandle );
CloseHandle(hThread);
// 使目标进程调用FreeLibrary，卸载DLL
hThread =CreateRemoteThread( hProcess1, NULL, 0, (LPTHREAD_START_ROUTINE)FreeLibrary,(LPVOID)dwHandle, 0, NULL);
// 等待FreeLibrary卸载完毕
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
CloseHandle(hProcess1);
}
调用UnLoadDll("explorer.exe","winlogokey.dll" );explorer.exe出错,卸载没有成功Top
9 楼CityHost（市长）回复于 2006-01-13 10:02:16 得分 0
又涨了见识了Top
10 楼lbg（lbg）回复于 2006-01-13 10:11:36 得分 0
我的电脑里面explorer.exe被插了两个很奇怪的dll,我怀疑是木马,这两个文件是:
winlogokey.dll 和 winlogo_hook.dll,但是在网上搜索不到关于这两个文件的说明,所以想自己卸, 另外,我发现很多进程都被这两个dll给插了,真变态Top
11 楼icwin（www.cat898.com.cn）回复于 2006-01-13 13:01:00 得分 0
upTop
12 楼lbg（lbg）回复于 2006-01-13 14:37:25 得分 0
有人试过吗?Top
13 楼cczlp（不惑）回复于 2006-01-13 16:58:39 得分 100
//那个是随手写的,实际不能直接传文件名,用这个
#include <tlhelp32.h>
void __fastcall UnLoadDll(String str_proce, String str_dllname)
{
AnsiString tmpstr="";
PROCESSENTRY32 pinfo;
pinfo.dwSize = sizeof(pinfo);
DWORD dw_pid=0;
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if(snapshot == NULL)
return;
bool flag = Process32First(snapshot,&pinfo);
while(flag)
{
tmpstr=AnsiString(pinfo.szExeFile) ;
if((ExtractFileName(tmpstr)).UpperCase()==str_proce.UpperCase() )
{
dw_pid=pinfo.th32ProcessID ;
break;
}
flag = Process32Next(snapshot,&pinfo);
}
CloseHandle(snapshot);
if (dw_pid == NULL)
{
::MessageBox(NULL, "Process not found", "", 0);
return;
}
DWORD dwHandle = 0;
HANDLE hProcess1 = OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,FALSE, dw_pid) ;
if (!hProcess1)
return ;
// 向目标进程地址空间写入DLL名称
DWORD dwSize, dwWritten;
dwSize = str_dllname.Length() + 1;
LPVOID lpBuf = VirtualAllocEx( hProcess1, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE );
if ( !WriteProcessMemory( hProcess1, lpBuf, (LPVOID)str_dllname.c_str(), dwSize, &dwWritten ) )
{
VirtualFreeEx( hProcess1, lpBuf, dwSize, MEM_DECOMMIT );
CloseHandle( hProcess1 );
return;
}
LPVOID pFun = GetProcAddress(GetModuleHandle("Kernel32"), "GetModuleHandleA");//GetModuleHandleA;
HANDLE hThread = CreateRemoteThread( hProcess1, NULL, 0,(LPTHREAD_START_ROUTINE)pFun,
lpBuf , 0, NULL);
if (hThread == NULL)
{
CloseHandle(hProcess1);
return ;
}
// 等待GetModuleHandle运行完毕
WaitForSingleObject( hThread, INFINITE );
// 获得GetModuleHandle的返回值
GetExitCodeThread( hThread, &dwHandle );
// 释放目标进程中申请的空间
VirtualFreeEx( hProcess1, lpBuf, dwSize, MEM_DECOMMIT );
CloseHandle(hThread);
// 使目标进程调用FreeLibrary，卸载DLL
pFun = GetProcAddress(GetModuleHandle("Kernel32"), "FreeLibrary");
hThread =CreateRemoteThread( hProcess1, NULL, 0, (LPTHREAD_START_ROUTINE)pFun,(LPVOID)dwHandle, 0, NULL);
// 等待FreeLibrary卸载完毕
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
CloseHandle(hProcess1);
}
//
void __fastcall TForm1::Button1Click(TObject *Sender)
{
UnLoadDll("iexplore.exe", "C:\SOFTFI~1\IS\BhoPlugin.dll");
}
Top
14 楼alloutoflove（andrew）回复于 2006-01-13 18:00:28 得分 0
学习ing..Top
15 楼lbg（lbg）回复于 2006-01-14 11:44:40 得分 0
cczlp(不惑) :按照你的代码,还是出错,卸载一些别的DLL,没有出错,但是,看进程的模块的时候,那个DLL还在,不知道什么原因Top
16 楼cczlp（不惑）回复于 2006-01-19 09:24:53 得分 0
代码没用问题, 可能调用的参数错误.
我的系统安装了Acrobat 7.0, 卸载它在explorer.exe中的一个DLL:
UnLoadDll("explorer.exe", "PDFShell.dll");
卸载后,如果原来的进程还需要这个DLL, 可能出现问题.
Top
17 楼haiqian119（海嵌）回复于 2006-01-19 09:26:16 得分 0
markTop
