作为一个杀毒软件，必须扫描所有的驱动，才能检测到所有的驱动层病毒！
微软的.net framework4.0提供了关于驱动访问的类，
启动VS2010，
创建一个CLR工程如下
具体核心代码如下，详情见代码注释
#pragma once namespace yincheng { using namespace System; using namespace System::ComponentModel; using namespace System::Collections; using namespace System::Windows::Forms; using namespace System::Data; using namespace System::Drawing; /// <summary> /// Form1 摘要 /// /// 警告: 如果更改此类的名称，则需要更改 /// 与此类所依赖的所有 .resx 文件关联的托管资源编译器工具的 /// “资源文件名”属性。否则， /// 设计器将不能与此窗体的关联 /// 本地化资源正确交互。 /// </summary> public ref class Form1 : public System::Windows::Forms::Form { public: Form1(void) { InitializeComponent(); // //TODO: 在此处添加构造函数代码 // } protected: /// <summary> /// 清理所有正在使用的资源。 /// </summary> ~Form1() { if (components) { delete components; } } protected: private: System::ServiceProcess::ServiceController^ serviceController1; private: System::Windows::Forms::Button^ button1; private: System::Windows::Forms::Button^ button2; private: System::Windows::Forms::Button^ button3; private: System::Windows::Forms::Button^ button4; private: System::Windows::Forms::ListView^ listView1; private: System::Windows::Forms::ColumnHeader^ columnHeader1; private: System::Windows::Forms::ColumnHeader^ columnHeader2; private: System::Windows::Forms::ColumnHeader^ columnHeader3; private: /// <summary> /// 必需的设计器变量。 /// </summary> System::ComponentModel::Container ^components; #pragma region Windows Form Designer generated code /// <summary> /// 设计器支持所需的方法 - 不要 /// 使用代码编辑器修改此方法的内容。 /// </summary> void InitializeComponent(void) { this->serviceController1 = (gcnew System::ServiceProcess::ServiceController()); this->button1 = (gcnew System::Windows::Forms::Button()); this->button2 = (gcnew System::Windows::Forms::Button()); this->button3 = (gcnew System::Windows::Forms::Button()); this->button4 = (gcnew System::Windows::Forms::Button()); this->listView1 = (gcnew System::Windows::Forms::ListView()); this->columnHeader1 = (gcnew System::Windows::Forms::ColumnHeader()); this->columnHeader2 = (gcnew System::Windows::Forms::ColumnHeader()); this->columnHeader3 = (gcnew System::Windows::Forms::ColumnHeader()); this->SuspendLayout(); // // button1 // this->button1->Location = System::Drawing::Point(5, 2); this->button1->Name = L"button1"; this->button1->Size = System::Drawing::Size(93, 23); this->button1->TabIndex = 1; this->button1->Text = L"获取驱动程序"; this->button1->UseVisualStyleBackColor = true; this->button1->Click += gcnew System::EventHandler(this, &Form1::button1_Click); // // button2 // this->button2->Location = System::Drawing::Point(102, 2); this->button2->Name = L"button2"; this->button2->Size = System::Drawing::Size(93, 23); this->button2->TabIndex = 2; this->button2->Text = L"启动驱动程序"; this->button2->UseVisualStyleBackColor = true; this->button2->Click += gcnew System::EventHandler(this, &Form1::button2_Click); // // button3 // this->button3->Location = System::Drawing::Point(199, 2); this->button3->Name = L"button3"; this->button3->Size = System::Drawing::Size(93, 23); this->button3->TabIndex = 3; this->button3->Text = L"暂停驱动程序"; this->button3->UseVisualStyleBackColor = true; this->button3->Click += gcnew System::EventHandler(this, &Form1::button3_Click); // // button4 // this->button4->Location = System::Drawing::Point(296, 2); this->button4->Name = L"button4"; this->button4->Size = System::Drawing::Size(93, 23); this->button4->TabIndex = 4; this->button4->Text = L"停止驱动程序"; this->button4->UseVisualStyleBackColor = true; this->button4->Click += gcnew System::EventHandler(this, &Form1::button4_Click); // // listView1 // this->listView1->Anchor = static_cast<System::Windows::Forms::AnchorStyles>((((System::Windows::Forms::AnchorStyles::Top | System::Windows::Forms::AnchorStyles::Bottom) | System::Windows::Forms::AnchorStyles::Left) | System::Windows::Forms::AnchorStyles::Right)); this->listView1->Columns->AddRange(gcnew cli::array< System::Windows::Forms::ColumnHeader^ >(3) {this->columnHeader1, this->columnHeader2, this->columnHeader3}); this->listView1->FullRowSelect = true; this->listView1->GridLines = true; this->listView1->Location = System::Drawing::Point(5, 28); this->listView1->Name = L"listView1"; this->listView1->Size = System::Drawing::Size(1158, 319); this->listView1->TabIndex = 5; this->listView1->UseCompatibleStateImageBehavior = false; this->listView1->View = System::Windows::Forms::View::Details; // // columnHeader1 // this->columnHeader1->Text = L" 驱动程序名称"; this->columnHeader1->Width = 110; // // columnHeader2 // this->columnHeader2->Text = L" 驱动程序显示说明"; this->columnHeader2->Width = 140; // // columnHeader3 // this->columnHeader3->Text = L" 驱动程序状态"; this->columnHeader3->Width = 180; // // Form1 // this->AutoScaleDimensions = System::Drawing::SizeF(6, 12); this->AutoScaleMode = System::Windows::Forms::AutoScaleMode::Font; this->ClientSize = System::Drawing::Size(1166, 349); this->Controls->Add(this->listView1); this->Controls->Add(this->button4); this->Controls->Add(this->button3); this->Controls->Add(this->button2); this->Controls->Add(this->button1); this->Name = L"Form1"; this->StartPosition = System::Windows::Forms::FormStartPosition::CenterScreen; this->Text = L"演示windows7下启动停止系统驱动程序-CSDN著名技术专家尹成的杰作"; this->Load += gcnew System::EventHandler(this, &Form1::Form1_Load); this->ResumeLayout(false); } #pragma endregion //获取驱动程序 private: System::Void button1_Click(System::Object^ sender, System::EventArgs^ e) { array<System::ServiceProcess::ServiceController^>^ MyServices; int i; array<String^>^ MyItems=gcnew array<String^>(3); System::ServiceProcess::ServiceController^ MyService; this->listView1->Items->Clear(); MyServices=this->serviceController1->GetDevices(); for(i=0;i<MyServices->Length;i++) { MyItems[0]=MyServices[i]->ServiceName; MyItems[1]=MyServices[i]->DisplayName; switch(MyServices[i]->Status) { case System::ServiceProcess::ServiceControllerStatus::ContinuePending: MyItems[2]="服务即将继续"; break; case System::ServiceProcess::ServiceControllerStatus::Paused: MyItems[2]="服务已暂停"; break; case System::ServiceProcess::ServiceControllerStatus::PausePending: MyItems[2]="服务即将暂停"; break; case System::ServiceProcess::ServiceControllerStatus::Running: MyItems[2]="服务正在运行"; break; case System::ServiceProcess::ServiceControllerStatus::StartPending: MyItems[2]="服务正在启动"; break; case System::ServiceProcess::ServiceControllerStatus::Stopped: MyItems[2]="服务未运行"; break; case System::ServiceProcess::ServiceControllerStatus::StopPending: MyItems[2]="服务正在停止"; break; } this->listView1->Items->Add(gcnew ListViewItem(MyItems)); } } //启动驱动程序 private: System::Void button2_Click(System::Object^ sender, System::EventArgs^ e) { String^ MyName; System::ServiceProcess::ServiceController^ MyService; try { MyName=this->listView1->SelectedItems[0]->SubItems[0]->Text; MyService=gcnew System::ServiceProcess::ServiceController(MyName); if(MyService->Status==System::ServiceProcess::ServiceControllerStatus:: Stopped) { MyService->Start(); this->button1_Click(nullptr,nullptr); } else MessageBox::Show("该驱动程序不能被启动","信息提示",MessageBoxButtons::OK, MessageBoxIcon::Information); } catch(Exception^ MyEx) { MessageBox::Show(MyEx->Message,"信息提示",MessageBoxButtons::OK, MessageBoxIcon::Information); } } //暂停驱动程序 private: System::Void button3_Click(System::Object^ sender, System::EventArgs^ e) { String^ MyName; System::ServiceProcess::ServiceController^ MyService; try { MyName=this->listView1->SelectedItems[0]->SubItems[0]->Text; MyService=gcnew System::ServiceProcess::ServiceController(MyName); if(MyService->Status==System::ServiceProcess::ServiceControllerStatus:: Running) { MyService->Pause(); this->button1_Click(nullptr,nullptr); } else MessageBox::Show("该驱动程序不能被暂停","信息提示",MessageBoxButtons::OK, MessageBoxIcon::Information); } catch(Exception^ MyEx) { MessageBox::Show(MyEx->Message,"信息提示",MessageBoxButtons::OK, MessageBoxIcon::Information); } } //停止驱动程序 private: System::Void button4_Click(System::Object^ sender, System::EventArgs^ e) { String^ MyName; System::ServiceProcess::ServiceController^ MyService; try { MyName=this->listView1->SelectedItems[0]->SubItems[0]->Text; MyService=gcnew System::ServiceProcess::ServiceController(MyName); if(MyService->Status==System::ServiceProcess::ServiceControllerStatus:: Running) { MyService->Stop(); this->button1_Click(nullptr,nullptr); } else MessageBox::Show("该驱动程序不能被停止","信息提示",MessageBoxButtons::OK, MessageBoxIcon::Information); } catch(Exception^ MyEx) { MessageBox::Show(MyEx->Message,"信息提示",MessageBoxButtons::OK, MessageBoxIcon::Information); } } private: System::Void Form1_Load(System::Object^ sender, System::EventArgs^ e) { } }; }
具体运行效果如下
