通过WH_CBT类型的HOOK 和nIndex为GWL_WNDPROC的SetWindowLong实现进程保护。

实现的范例下载:

附件[SafeProcess.rar]：
http://blog.blogchina.com/upload/2004-12-20/20041220143803647829.rar

1. 通过Timer过程或其他方式查找Windows任务管理器窗口是否存在。
    ::FindWindow(NULL,  "Windows 任务管理器")
    如果存在，则进入第二步。

2. 设置一个WH_CBT类型的HOOK
    g_cbtHook = SetWindowsHookEx(WH_CBT, (HOOKPROC)CBTProc, g_hInstance, NULL);
   在 (HOOKPROC)CBTProc中处理HCBT_ACTIVATE和HCBT_DESTROYWND两类消息。

// The CBT hook Proc(Computer Based Training Hook)
LRESULT CALLBACK CBTProc(int nCode, WPARAM wParam, LPARAM lParam)
{
      CHAR szText[256];
      CHAR szWindowText[32];
      HWND hWnd;

      memset(szWindowText, NULL, sizeof(szWindowText));
      strcpy(szWindowText, "任务管理器警告");

      switch(nCode)
     {
            case HCBT_ACTIVATE:
                    hWnd = (HWND)wParam;
                    GetWindowText(hWnd,szText,256);
                    if(strcmp(szText, szWindowText) == 0)
                    {
                          if(!bSetWindowLong)
                          {
                                g_hWnd = Wnd;
                                g_orgProc=(WNDPROC)SetWindowLong(hWnd,GWL_WNDPROC,(LONG)NewWndProc);
                                bSetWindowLong = TRUE;
                          }
                    }
                    break;
            case HCBT_DESTROYWND:
                    hWnd = (HWND)wParam;
                    GetWindowText(hWnd,szText,256);
                    if(strcmp(szText, szWindowText) == 0)
                    {
                         SetWindowLong(g_hWnd,GWL_WNDPROC,(LONG)g_orgProc);
                         g_hWnd = NULL;
                         bSetWindowLong = false;
                    }
                    break;
     }
     return CallNextHookEx(NULL, nCode, wParam, lParam);
}//End of the hook procedure

3. NewWndProc中如果用户点击OK按钮，则可以加入自己的处理过程，使其无效。

LRESULT CALLBACK NewWndProc(HWND hWnd,UINT uMsg,WPARAM wParam,LPARAM lParam)
{
      switch(uMsg)
  &nbs