VB中98/ME&2000/XP如何知道什么程序调用了那个DLL，然后再将该程序进程杀掉！

[qiuyan81]

VB中98/ME&2000/XP如何知道什么程序调用了那个DLL，然后再将该程序进程杀掉！
我看了网上的源码 但是都是VC++ 或者是DELPHI的 不怎么看得懂~
请各位指点一下，谢谢了！

[qiuyan81]

有些函数在VB的API数据库那里找不到的

[Hotus]

我有 [e-mail]

[IORI915189]

Option Explicit
'获取系统进程API
Public Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal lFlags As Long, ByVal lProcessID As Long) As Long
Public Declare Function Process32First Lib "kernel32" (ByVal hSnapShot As Long, uProcess As PROCESSENTRY32) As Long
Public Declare Function Process32Next Lib "kernel32" (ByVal hSnapShot As Long, uProcess As PROCESSENTRY32) As Long
Public Declare Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

Public Declare Function Module32First Lib "kernel32" (ByVal hSnapShot As Long, lppe As MODULEENTRY32) As Long
Public Declare Function Module32Next Lib "kernel32" (ByVal hSnapShot As Long, lppe As MODULEENTRY32) As Long

Public Type PROCESSENTRY32
dwSize As Long
cntUsage As Long
th32ProcessID As Long
th32DefaultHeapID As Long
th32ModuleID As Long
cntThreads As Long
th32ParentProcessID As Long
pcPriClassBase As Long
dwFlags As Long
szExeFile As String * 260
End Type

Public Type MODULEENTRY32
dwSize As Long
th32ModuleID As Long
th32ProcessID As Long
GlblcntUsage As Long
ProccntUsage As Long
modBaseAddr As Byte
modBaseSize As Long
hModule As Long
szModule As String * 256
szExePath As String * 1024
End Type


Public Const LB_SETHORIZONTALEXTENT = &H194
Public Const TH32CS_SNAPheaplist = &H1
Public Const TH32CS_SNAPPROCESS = &H2
Public Const TH32CS_SNAPthread = &H4
Public Const TH32CS_SNAPmodule = &H8
Public Const TH32CS_INHERIT = &H80000000
Public Const TH32CS_SNAPall = (TH32CS_SNAPheaplist Or TH32CS_SNAPPROCESS Or TH32CS_SNAPthread Or TH32CS_SNAPmodule)

Private Const MAX_PATH As Integer = 260

Public Const PROCESS_ALL_ACCESS = 0
Public Const PROCESS_TERMINATE = &H1
Public Const PROCESS_VM_READ = 16
Public Const PROCESS_QUERY_INFORMATION = 1024
Public Const PROCESS_SET_INFORMATION = 612

'保存进程ID数组
Public ProcessID() As PROCESSENTRY32
'获取进程
Dim i As Integer
Dim theloop As Long, snap As Long
Dim Proc As PROCESSENTRY32
List1.Clear '清空内容
snap = CreateToolhelp32Snapshot(TH32CS_SNAPall, 0) '获得进程"快照"的句柄
Proc.dwSize = Len(Proc)
theloop = Process32First(snap, Proc) '获取第一个进程,并得到其返回值
While theloop <> 0 '当返回值非零时继续获取下一个进程
List1.AddItem Proc.szExeFile'把进程加到LISTBOX控件
ReDim Preserve ProcessID(i)
ProcessID(i).th32ProcessID = Proc.th32ProcessID'保存进程ID到数组
i = i + 1
theloop = Process32Next(snap, Proc)
Wend
CloseHandle snap '关闭进程"快照"句柄
End Function

Public Function KProcess(PID As Long) As Long '强行结束进程
Dim i As Long
Dim hand As Long
hand = OpenProcess(1, True, PID) '获取进程句柄
KProcess = TerminateProcess(hand, 1) '结束进程
End Function
'获取模块
Dim my As PROCESSENTRY32
Dim l As Long, lm As Long
Dim mm As MODULEENTRY32
If 进程ID <> 0 Then
lm = CreateToolhelp32Snapshot(TH32CS_SNAPmodule, 进程ID)
If lm > 0 Then
mm.dwSize = Len(mm)
If Module32First(lm, mm) Then
Do
If 进程ID = mm.th32ProcessID Then List1.AddItem mm.szExePath'该进程调用的文件
Loop Until (Module32Next(lm, mm) < 1)
End If
CloseHandle (lm)
End If
End If

[acmilan1984]

2000 & xp 下:
ntsd -adllName -p [PID]
就可以看进程所有调用的DLL
98,me可以用优化大师看!!~!呵呵