把自己的代码注入explorer.exe。详细参见源代码

#define UNICODE
#define _UNICODE 
#include 
#include 
#include 
typedef struct _remoteparameter
{
DWORD       rpfindfirstfile;
DWORD       rpdeletefile;
DWORD       rpfindclose;   


HANDLE      rpfilehandle;
WIN32_FIND_DATA rpfdata;
TCHAR       rptname[MAX_PATH];
}REMOTEPARAMETER, *PREMOTEPARAMETER;
DWORD GetProcessId(LPCTSTR str) 
{ 
    HANDLE         hProcessSnap = NULL; 
    PROCESSENTRY32 pe32      = {0}; 


    // Take a snapshot of all processes in the system.
    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hProcessSnap == (HANDLE)-1) 
        return -1; 


    // Fill in the size of the structure before using it.
    pe32.dwSize = sizeof(PROCESSENTRY32); 


    // Walk the snapshot of the processes, and for each process, 
    
    if (Process32First(hProcessSnap, &pe32)) 
    { 
        do
   {
    if(_tcsicmp(str,pe32.szExeFile)==0)
    {
     CloseHandle (hProcessSnap); 
     return pe32.th32ProcessID;
    }
   }
        while (Process32Next(hProcessSnap, &pe32)); 
    } 
    
    CloseHandle (hProcessSnap); 
    return -1; 
}
DWORD WINAPI remote(LPVOID pvparam)
{
PREMOTEPARAMETER erp=(PREMOTEPARAMETER)pvparam;
    typedef HANDLE (WINAPI *EFindFirstFile)(LPCTSTR, LPWIN32_FIND_DATA);
typedef BOOL   (WINAPI *EDeleteFile)(LPCTSTR);
typedef BOOL   (WINAPI *EFindClose)(HANDLE);
EFindFirstFile       tFindFirstFile;
EDeleteFile          tDeleteFile;
EFindClose           tFindClose;
tFindFirstFile=(EFindFirstFile)erp->rpfindfirstfile;
tDeleteFile=(EDeleteFile)erp->rpdeletefile;
tFindClose=(EFindClose)erp->rpfindclose;




erp->rpfilehandle=tFindFirstFile(erp->rptname,&erp->rpfdata);
if(erp->rpfilehandle!=INVALID_HANDLE_VALUE)
{
   if(!tDeleteFile(erp->rptname))
   {
    return -1;
   }
}
if(!tFindClose(erp->rpfilehandle))
{
   return -1;
}


return 0;
}
int main()
{
   // TODO: Place code here.
TCHAR name[20];
_tcscpy(name,_T("c:\\shenyue.txt"));
HANDLE            ethread;
DWORD remotepid;
int cb;
REMOTEPARAMETER   rp;
HINSTANCE         hkernel32;
LPVOID remotethr;
LPVOID remotepar;
remotepid=GetProcessId(_T("explorer.exe"));
if(remotepid==-1)
   return -1;
HANDLE rphandle=OpenProcess(PROCESS_CREATE_THREAD |     
                         PROCESS_VM_OPERATION |     
              PROCESS_VM_WRITE,           
           FALSE,remotepid);
cb=sizeof(TCHAR)*4*1024;
remotethr=(PTSTR)VirtualAllocEx(rphandle,NULL,cb,MEM_COMMIT,PAGE_EXECUTE_READWRITE); 
if(remotethr==NULL)
{
        CloseHandle(rphandle);       
   return -2;
}
    if(WriteProcessMemory(rphandle,remotethr,(LPVOID)remote,cb,NULL)==FALSE)
{
        CloseHandle(rphandle);
   return -2;
}
{
   memset(&rp,0,sizeof(rp));
   _tcscpy(rp.rptname,name);
   hkernel32=GetModuleHandle(_T("kernel32.dll"));
   rp.rpfindfirstfile=(DWORD)GetProcAddress(hkernel32,"FindFirstFileW");
   rp.rpdeletefile=(DWORD)GetProcAddress(hkernel32,"DeleteFileW");
   rp.rpfindclose=(DWORD)GetProcAddress(hkernel32,"FindClose");
}
cb=sizeof(TCHAR)*sizeof(rp);
remotepar=(PTSTR)VirtualAllocEx(rphandle,NULL,cb,MEM_COMMIT,PAGE_READWRITE);
if(remotepar==NULL)
{
   CloseHandle(rphandle);
   return -2;
}
if(WriteProcessMemory(rphandle,remotepar,(LPVOID)&rp,cb,NULL)==FALSE)
{
   CloseHandle(rphandle);
   return -2;
}
ethread=CreateRemoteThread(rphandle,NULL,0,(LPTHREAD_START_ROUTINE)remotethr,(LPVOID)remotepar,0,NULL);
if(ethread==NULL)
{
   CloseHandle(rphandle);
   return -3;
}
return 0;
}