pediy.net网站里关于 rootkit教学的一个电子文档，看看吧

使用APIhook拦截CreateProcess函数实现拦截启动应用程序的目的。当运行一个程序的时候，会弹出提示信息“CreateProcess”。证明该应用程序已被拦截。

在WINDOWS2000下屏蔽Ctrl-Alt-Del例程源代码-in Windows2000 under shielding Ctrl-Alt-Del source code routines

用VB写的一个小游戏,可以用键盘玩.可以用来演示小游戏,等客户认可后再做产品-Using VB to write a small game, you can use the keyboard to play. Can be used to demonstrate a small game, such as customer acceptance before making a product

捕捉鼠标和键盘动作，捕捉结果可以保存为文本格式，可以编辑，可以回放。-Capture mouse and keyboard action, to capture results can be saved as text format, you can edit, you can playback.

api refence book.very helpful

用钩子实现记录用户键盘、鼠标操作并重现。-hook used to achieve record keystrokes, mouse and regain the operation.

防止进程终止

利用Hook在Explorer进程插入一个线程实例-use Explorer Hook in the process of inserting a threaded example

使用了系统record Hook可以记录所有鼠标和键盘动作，并可以回放出来，而且可以一步一步的回放-use of the system can record Hook records all keyboard and mouse movements, and can playback, and it can be one of the intervals

是一个好的VB程式,在家好好的看吧,是不一个好的-VB is a good program, good Look here at home, it is not a good Eastern