Given the office installation problem too annoying, so going to kill it thoroughly, in addition to speak with Open lock in front of the msi. DLL method, and better way,
Open, although simple, but it will prohibit msi file, so find a new does not interfere with other programs,
Method is to hook the current process of ZwOpenFile (NtOpenFile), discovery is msi. DLL can be skipped,
The code is as follows:
'the form
Option Explicit
Private Sub Form_Load ()
Me. Move (Screen. Width - Me. Width) \ 2, (Screen. Height - Me. Height) \ 2
Me. Show
End Sub
Private Sub Form_QueryUnload (Cancel the As an Integer, UnloadMode As Integer)
Unhook
End Sub
'module
Option Explicit
Private Declare Function GetCurrentProcess Lib "kernel32 () As" Long
Private Declare Function ZwOpenFile Lib "NTDLL. DLL" (ByRef Filehandle As Long, _
ByVal DesiredAccess As Long, _
ByRef ObjectAttributes As OBJECT_ATTRIBUTES, _
ByRef IoStatusBlock As IO_STATUS_BLOCK, _
ByVal ShareAccess As Long, _
ByVal OpenOptions As Long As Long)
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (pSrc pDest As Any, As Any, ByVal ByteLen As Long)
Private Const STATUS_OBJECT_NAME_NOT_FOUND=& amp; HC0000034
Private Type IO_STATUS_BLOCK
The Status As Long
Information As Long
End Type
Private Type OBJECT_ATTRIBUTES
Length As Long
RootDirectory As Long
The ObjectName As Long
The Attributes As Long
SecurityDescriptor As Long
SecurityQualityOfService As Long
End Type
Private MyHook As cls_HookApi 'custom hook
Sub Main ()
App. TaskVisible=False
The Set MyHook=New cls_HookApi
MyHook. HookApi "NTDLL. DLL", "ZwOpenFile GetFunAddr (AddressOf ZwOpenFileCallback), GetCurrentProcess
The Load frm_Main
End Sub
'NtOpenFile callback
Public Function ZwOpenFileCallback (Filehandle As Long, ByVal DesiredAccess, As Long As ObjectAttributes OBJECT_ATTRIBUTES, IoStatusBlock As IO_STATUS_BLOCK, ByVal ShareAccess As Long, ByVal OpenOptions As Long) As Long
Dim lRetVal As Long
MyHook. HookStatus False
'the Debug. Print ObjectAttrToName (ObjectAttributes)
If LCase (ObjectAttrToName (ObjectAttributes)) Like LCase (" * msi. DLL ") Then
LRetVal=STATUS_OBJECT_NAME_NOT_FOUND 'return value to the object does not exist
The Else
LRetVal=ZwOpenFile (Filehandle, DesiredAccess, ObjectAttributes IoStatusBlock, ShareAccess, OpenOptions)
End the If
MyHook. HookStatus True
ZwOpenFileCallback=lRetVal
End the Function
'get the file name
Private Function ObjectAttrToName (ObjectAttr As OBJECT_ATTRIBUTES) As String
Dim bytCode () As Byte
Dim dwName As Long
Dim dwLength As Integer
CopyMemory dwLength, ByVal ObjectAttr. ObjectName, 2
If dwLength & gt; 0 Then
CopyMemory dwName, ByVal ObjectAttr. ObjectName + 4, 4
ReDim bytCode (dwLength - 1)
CopyMemory bytCode (0), ByVal dwName, dwLength
ObjectAttrToName=StrConv (StrConv (bytCode, vbUnicode), vbFromUnicode)
ObjectAttrToName=Replace (ObjectAttrToName, \ "?? \ ", "")
End the If
Erase bytCode
End the Function
The Public Function GetFunAddr (lngFunAddr As Long As Long
GetFunAddr=lngFunAddr
End the Function
Sub Unhook ()
The Set MyHook=Nothing
End Sub
'
Option Explicit
Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Long
Private Declare Function GetProcAddress call Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Private Declare Function GetCurrentProcess Lib "kernel32 () As" Long
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any Source, As Any, ByVal length As Long)
Private Const PROCESS_ALL_ACCESS As Long=& amp; H1F0FFF
Private mbytOldCode (5) As Byte
Private mbytNewCode (5) As Byte
Private mlngFunAddr As Long
Private mhProcess As Long
The Public Function HookApi (ByVal strDllName As String, ByVal strFunName As String, ByVal lngFunAddr As Long, ByVal hProcess As Long) As Boolean
Dim hModule As Long, dwJmpAddr As Long
MhProcess=GetCurrentProcess
HModule=LoadLibrary (strDllName)
If hModule=0 Then HookApi=False: Exit Function
MlngFunAddr=GetProcAddress call (hModule, strFunName)
If mlngFunAddr=0 Then HookApi=False: Exit Function
CopyMemory mbytOldCode (0), ByVal mlngFunAddr, 6
MbytNewCode (0)=& amp; HE9
DwJmpAddr=lngFunAddr - mlngFunAddr - 5
CopyMemory mbytNewCode (1), dwJmpAddr, 4
HookStatus True
HookApi=True
nullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnull