关于键盘钩子问题?? 被杀毒软件判为病毒删除?

Question

如何能使自己的钩子不被杀毒软件判为病毒而被删除??

Answer 1

你用什么方法加载钩子的？如果只是用SetWindowsHookEx应该不会，可能你的方法和某种病毒有相同的特征码。

Answer 2

很简单的..
#include <windows.h>
#include <windowsx.h>
#include <tchar.h>HINSTANCE g_hinstDll = NULL;#pragma data_seg(".drectve")
static char szLinkDirectiveShared[] = "-section:Shared,rws";
#pragma data_seg()
#pragma data_seg("Shared")HHOOK g_hhook      = NULL;
HWND  g_hwndPost   = NULL;
UINT  g_uMsgNotify = WM_USER;#pragma data_seg()static LRESULT WINAPI KeyboardHook_HookProc (
   int nCode,
   WPARAM wParam, 
   LPARAM lParam) 
{   LRESULT lResult = CallNextHookEx(g_hhook, nCode, wParam, lParam);   if (nCode == HC_ACTION) 
   {
      PostMessage(g_hwndPost, g_uMsgNotify, wParam, lParam);
   }
   return(lResult);
}BOOL WINAPI SetKeyboardHook (HWND hWndPost, UINT Msg) 
{
   HHOOK hhook;   if (g_hhook != NULL) return(FALSE);   g_hwndPost   = hWndPost;
   g_uMsgNotify = Msg;
   Sleep(0);   hhook = SetWindowsHookEx(WH_KEYBOARD, KeyboardHook_HookProc, g_hinstDll, 0);
   InterlockedExchange((PLONG) &g_hhook, (LONG) hhook);
   return(g_hhook != NULL);
}BOOL WINAPI ReleaseKeyboardHook() 
{
   BOOL fOK = TRUE;   if (g_hhook != NULL) 
   {
      fOK = UnhookWindowsHookEx(g_hhook);
      g_hhook = NULL;
   }
   return(fOK);
}BOOL WINAPI DllMain (HINSTANCE hinstDll, DWORD fdwReason, LPVOID lpvReserved) 
{
   switch (fdwReason) 
   {
      case DLL_PROCESS_ATTACH:
         g_hinstDll = hinstDll;
         break;
   }
   return(TRUE);
}