g_hShellHook = SetWindowsHookEx( WH_SHELL,
                (HOOKPROC)ShellHook,
                g_hInstance,
                0);

 ShellHook 的实现如下:

static LRESULT CALLBACK ShellHook(UINT nCode, WPARAM wParam, LPARAM lParam)
{
    if(nCode < 0)
        goto CallOrg;
    
    if( HSHELL_WINDOWCREATED == nCode )
    {
        if( !isQQWnd( (HWND)wParam ) )
            goto CallOrg;
        
        EnumChildWindows( (HWND)wParam, EnumChildProc, (LPARAM)0 );
    }
    
CallOrg:
    return CallNextHookEx( g_hShellHook, nCode, wParam, lParam);
} 

在收到窗口创建后的消息时，就判断这个窗口是不是QQ的,这里用到了 GetWindowThreadProcessId ，它返回窗口相关的进程ID

BOOL isQQWnd(HWND hWnd)
{
    if( g_pContext == NULL )
        return FALSE;

    if( g_dwQQProcessID == 0 )
        g_dwQQProcessID = GetQQProcessID();
    
    DWORD dwWndProcessID;
    if( GetWindowThreadProcessId( hWnd, &dwWndProcessID ) == 0 )
        return FALSE;
    
    return dwWndProcessID == g_dwQQProcessID;

}

然后枚举它的子窗口，看它的子窗口有没有广告控件，有的话就给子控件发送个WM_CLOSE的消息.

BOOL CALLBACK EnumChildProc(HWND hwnd, LPARAM lParam  )
{
    DWORD dwID = GetDlgCtrlID( hwnd );
    if( dwID == 0x3e9 )
    {
        HWND hPrarent = GetParent( hwnd );
        PostMessage(hwnd, WM_CLOSE, 0, 0 );
        Sleep( 10 );
        PostMessage(hPrarent, WM_PAINT, 0, 0 );
    }
    else if( dwID == 0x643f )
    {
        PostMessage(hwnd, WM_CLOSE, 0, 0 );
    }

    return TRUE;
}

其中的两个硬编码是用 spy++ 分析出来的，可能因为版本的不同，会有差异。所以我不确定能不能关闭其它版本的QQ广告。我使用的版本是QQ2008贺岁版。

--------------------------------------------------------------------------

后记:
   尽管实现的技术很简单,但还是花了我大半天的时间. 写完之后觉得枚举子窗口的方式太低效, 或者还有其它高效点的方式。另外还有全局钩子,可能没有必要。如果下午周末持续无聊，我会尝试改进一下。

   QQ的聊天对话框很简单,不像MSN的对话框,铁板一块,用spy++啥都看不到.但是可以用 AccExplorer 分析.想在MSN的对话框上加点东西进去，实现起来很困难。对这方面有研究的同学不妨与我讨论一下实现，一起学习、进步。
      
   代码的行数没数，有效代码估计也就百把行吧，呵呵，我承认我是标题党。

附:   源代码 + bin

class CW32Server
{
 TCHAR  m_szServerName[MAX_PATH];
 SC_HANDLE   m_hService;
 SC_HANDLE   m_hScm;
 SERVICE_STATUS ServiceStatus;
 BYTE  m_cfgBuf[4096];
public:

 CW32Server(void);
 CW32Server(const TCHAR *strServerName); 
 BOOL    Open(const TCHAR *strServerName);  

 /**  返回状态:
  SERVICE_CONTINUE_PENDING The service continue is pending.
  SERVICE_PAUSE_PENDING The service pause is pending.
  SERVICE_PAUSED The service is paused.
  SERVICE_RUNNING The service is running.
  SERVICE_START_PENDING The service is starting.
  SERVICE_STOP_PENDING The service is stopping.
  SERVICE_STOPPED The service is not running.
 */
 DWORD GetState();     
 BOOL    SetState(DWORD state);
 BOOL    Start();
 BOOL    Stop();

 /**
  SERVICE_AUTO_START  A service started automatically by the service control manager during system startup.
  SERVICE_BOOT_START  A device driver started by the system loader. This value is valid only for driver services.
  SERVICE_DEMAND_START A service started by the service control manager when a process calls the StartService function.
  SERVICE_DISABLED  A service that cannot be started. Attempts to start the service result in the error code ERROR_SERVICE_DISABLED.
  SERVICE_SYSTEM_START
 */
 BOOL    GetConfig();   //如果返回真，配置状态填充在 m_config  中
 SC_HANDLE    GetHandle();  //需要禁用、启动服务，使用 ChangeServiceConfig(GetHandle(),...)   查看MSDN
 ~CW32Server(void);

 QUERY_SERVICE_CONFIG *m_config;
};

#endif


/**
W32Server.cpp
http://www.cppblog.com/lovelypig  橙子
*/
#include ".\w32server.h"
#include <assert.h>

CW32Server::CW32Server(void)
{
 memset((char*)&m_szServerName,0,sizeof(TCHAR)*MAX_PATH);
 memset((char*)&m_config,0,sizeof(m_config));
 m_hService = 0;
 m_hScm   = 0;
 m_config = (QUERY_SERVICE_CONFIG*)m_cfgBuf;
}

CW32Server::CW32Server(const TCHAR *strServerName)
{ 
 assert(strServerName);

 CW32Server();
 _tcscpy(m_szServerName,strServerName); 

 m_hScm=OpenSCManager(0,0,SC_MANAGER_CREATE_SERVICE);
 if(!m_hScm)
 {
  return ;
 }
 m_hService=OpenService(m_hScm,strServerName,SERVICE_ALL_ACCESS);
 if(!m_hService)
 {
  CloseServiceHandle(m_hScm);
  m_hScm = NULL;
    }
}
CW32Server::~CW32Server(void)
{
 if( m_hScm )
 {
  CloseServiceHandle(m_hScm);
  m_hScm = NULL;
 }
 if( m_hService )
 {
  CloseServiceHandle(m_hService);
  m_hService = NULL;
 }
}

BOOL   CW32Server:: Open(const TCHAR *strServerName)
{
 assert(strServerName);

 if( m_hScm )
 {
  CloseServiceHandle(m_hScm);
  m_hScm = NULL;
 }
 if( m_hService )
 {
  CloseServiceHandle(m_hService);
  m_hService = NULL;
 }

 _tcscpy(m_szServerName,strServerName); 
 m_hScm=OpenSCManager(0,0,SC_MANAGER_CREATE_SERVICE);
 if(!m_hScm)
 {
  return FALSE;
 }
 m_hService=OpenService(m_hScm,strServerName,SERVICE_ALL_ACCESS);
 if(!m_hService)
 {
  CloseServiceHandle(m_hScm);
  m_hScm = NULL;
  return FALSE;
 }
 return TRUE;
}

DWORD CW32Server::GetState()
{ 
 assert(m_hService);

    if(QueryServiceStatus(m_hService,&ServiceStatus))
 {
  return ServiceStatus.dwCurrentState;
 }
 else
 {
  return 0xffffffff;
 }
}

BOOL    CW32Server::SetState(DWORD state)
{
 assert(m_hService);

 return ControlService(m_hService,state,&ServiceStatus);
}

BOOL    CW32Server::Start()
{
 assert(m_hService);

 return StartService(m_hService,0,NULL);

}

BOOL    CW32Server::Stop()
{
 assert(m_hService);

 return ControlService(m_hService,SERVICE_CONTROL_STOP,&ServiceStatus);
}

BOOL    CW32Server::GetConfig()
{
 assert(m_hService);
 
 DWORD cbBufSize = 4096;
 DWORD pcbBytesNeeded = 4096;
 return QueryServiceConfig(m_hService,m_config,cbBufSize, &pcbBytesNeeded);
}

SC_HANDLE  CW32Server::GetHandle()
{
 assert(m_hService);
 return m_hService;
}

typedef int (CALLBACK* DHCPNOTIFYPROC)(LPWSTR, LPWSTR, BOOL, DWORD, DWORD, DWORD, int);

class CAdapter
{
 private:
  class ADAPTER_INFO
  {
    string strName;   // 适配器名称
    string strDriverDesc; // 适配器描述
    string strIP;   // IP地址
    string strSubnetMask;  // 子网掩码
    string strNetGate;  // 网关
    string strDNS;         //DNS
    string strMAC;
    ::MIB_IFROW IfRow;  //用于流量,状态显示

    BOOL   RegSetIP();
    BOOL   ChangeSysSet();
    
   public:
    void   SetInx(DWORD _dwpIndex) { IfRow.dwIndex  = _dwpIndex; }

    //取得IP信息
    string& GetName(){  return strName; }
    string& GetDriverDesc(){ return strDriverDesc; }
    string& GetIP(){ return strIP; }
    string& GetSubnetMask(){ return strSubnetMask; }
    string& GetNetGate(){ return strNetGate; }
    string& GetDNS(){ return strDNS; }
    string& GetMAC(){ return strMAC; }
    
    //取得状态,流量
    DWORD    GetState(){
     if(GetIfEntry(&IfRow) != NO_ERROR)
     {
      return 0;
     }
     /*
     #define MIB_IF_OPER_STATUS_NON_OPERATIONAL      0
     #define MIB_IF_OPER_STATUS_UNREACHABLE          1
     #define MIB_IF_OPER_STATUS_DISCONNECTED         2
     #define MIB_IF_OPER_STATUS_CONNECTING           3
     #define MIB_IF_OPER_STATUS_CONNECTED            4
     #define MIB_IF_OPER_STATUS_OPERATIONAL          5
     */
     return IfRow.dwOperStatus ;
    }
    
    DWORD    GetSendBytes(){
     if(GetIfEntry(&IfRow) != NO_ERROR)
     {
      return 0;
     }
     return IfRow.dwOutOctets;
    }
    DWORD    GetReceiveBytes(){
     if(GetIfEntry(&IfRow) != NO_ERROR)
     {
      return 0;
     }  
     return IfRow.dwInOctets;
    }
    DWORD   GetSpeed(){
     if(GetIfEntry(&IfRow) != NO_ERROR)
     {
      return 0;
     }
     return IfRow.dwSpeed;
    }

    DWORD   GetOutUcastPkts(){
     if(GetIfEntry(&IfRow) != NO_ERROR)
     {
      return 0;
     }
     return IfRow.dwOutUcastPkts;
    } 
    DWORD   GetOutNUcastPkts(){
     if(GetIfEntry(&IfRow) != NO_ERROR)
     {
      return 0;
     }
     return IfRow.dwOutNUcastPkts;
    } 
    DWORD   GetInUcastPkts(){
     if(GetIfEntry(&IfRow) != NO_ERROR)
     {
      return 0;
     }
     return IfRow.dwInUcastPkts;
    } 
    DWORD   GetInNUcastPkts(){
     if(GetIfEntry(&IfRow) != NO_ERROR)
     {
      return 0;
     }
     return IfRow.dwInNUcastPkts;
    } 
    //设置IP信息
    BOOL SetName(string _PstrName  ,BOOL bChange = 0)  { 
     strName = _PstrName ;
     if( bChange)
      return ChangeSysSet();
     return TRUE;
    }
    BOOL SetDriverDesc(string _PstrDriverDesc,BOOL bChange = 0){  
     strDriverDesc = _PstrDriverDesc;
     if( bChange)
      ChangeSysSet();
     return TRUE;
    }
    BOOL SetIP(string _PstrIP,BOOL bChange = 0){  
     strIP = _PstrIP ;
     if( bChange)
      ChangeSysSet();
     return TRUE;
    }
    BOOL SetSubnetMask(string _PstrSubnetMask,BOOL bChange = 0){  
     strSubnetMask = _PstrSubnetMask;
     if( bChange)
      ChangeSysSet();
     return TRUE;
    }
    BOOL SetNetGate(string _PstrNetGate,BOOL bChange = 0){ 
     strNetGate = _PstrNetGate;
     if( bChange)
      ChangeSysSet();
     return TRUE;
    }
    BOOL SetDNS(string strSetDNS = ""){
     if( !strSetDNS.length() )
     {
      HKEY hKey;
      DWORD dwType;
      char  szReadBuf[64];
      DWORD cbData = 64;
      string strKeyName ="SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\";
      strKeyName += this->strName;
      if(RegOpenKeyExA(HKEY_LOCAL_MACHINE,strKeyName.c_str(),0,
         KEY_READ,&hKey) != ERROR_SUCCESS)
      {
       return FALSE;
      }
      if( RegQueryValueExA(hKey,"NameServer",0,&dwType,(BYTE*)szReadBuf,&cbData) != ERROR_SUCCESS)
      {
       return FALSE;
      }
      RegCloseKey(hKey);
      strDNS = szReadBuf;
     }
     else
     {
      strDNS = strSetDNS;
      return ChangeSysSet();
     }
     return TRUE;
    }
    void SetMAC(BYTE *Address){ 
      char  buf[6];
      for(int i= 0;i< 6;i++)
      {
       sprintf( buf,"%02x",Address[i]);
       strMAC += string(buf);
      }
      /*
      sprintf(pAI->mac, "%02X%02X%02X%02X%02X%02X",
       int (pAdapterInfo->Address[0]),
       int (pAdapterInfo->Address[1]),
       int (pAdapterInfo->Address[2]),
       int (pAdapterInfo->Address[3]),
       int (pAdapterInfo->Address[4]),
       int (pAdapterInfo->Address[5]));
      */
    }
  };
 vector<ADAPTER_INFO> m_AdapterVec;
 public:
  CAdapter(void);
  ~CAdapter(void);

  size_t GetAdapterCount ()
  {
   return m_AdapterVec.size();
  }

  ADAPTER_INFO& operator[](DWORD iInx)
  {
   assert(iInx < m_AdapterVec.size());
   return m_AdapterVec[iInx];
  }
};

#endif


//－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
//Adapter_.cpp
#include ".\adapter_.h"

CAdapter::CAdapter(void)
{
 DWORD ulAdapterInfoSize = sizeof(IP_ADAPTER_INFO);
 IP_ADAPTER_INFO *pAdapterInfo = (IP_ADAPTER_INFO*)new char[ulAdapterInfoSize];
 if( GetAdaptersInfo(pAdapterInfo, &ulAdapterInfoSize) == ERROR_BUFFER_OVERFLOW ) // 缓冲区不够大
 {
  delete pAdapterInfo;
  pAdapterInfo = (IP_ADAPTER_INFO*)new char[ulAdapterInfoSize];
 }
 if( GetAdaptersInfo(pAdapterInfo, &ulAdapterInfoSize) == ERROR_SUCCESS )
 {
  do {
   if (pAdapterInfo->Type == MIB_IF_TYPE_ETHERNET)
   {
    ADAPTER_INFO *pAI = new ADAPTER_INFO;
    pAI->SetInx(pAdapterInfo->Index);
    pAI->SetName(pAdapterInfo->AdapterName);
    pAI->SetDriverDesc(pAdapterInfo->Description);
    pAI->SetMAC(pAdapterInfo->Address);
    pAI->SetIP(pAdapterInfo->IpAddressList.IpAddress.String);
    pAI->SetNetGate(pAdapterInfo->GatewayList.IpAddress.String);
    pAI->SetSubnetMask(pAdapterInfo->IpAddressList.IpMask.String);
    pAI->SetDNS();
    m_AdapterVec.push_back(*pAI);
   }
   pAdapterInfo = pAdapterInfo->Next;
  } while(pAdapterInfo);
 }
 delete pAdapterInfo;
}

CAdapter::~CAdapter(void)
{
 m_AdapterVec.clear();
}

BOOL CAdapter::ADAPTER_INFO::ChangeSysSet()
{
 //在注册表中修改信息
 if(!RegSetIP())
 {
  return FALSE;
 }

 HINSTANCE  hDhcpDll;
 DHCPNOTIFYPROC pDhcpNotifyProc;
 WCHAR wcAdapterName[256];
 MultiByteToWideChar(CP_ACP, 0, this->strName.c_str(), -1, wcAdapterName,256);

 if((hDhcpDll = LoadLibraryA("dhcpcsvc")) == NULL)
 {
  return FALSE;
 }

 if((pDhcpNotifyProc = (DHCPNOTIFYPROC)GetProcAddress(hDhcpDll, "DhcpNotifyConfigChange")) != NULL)
 {
  if((pDhcpNotifyProc)(NULL, wcAdapterName, TRUE,
   0,    //指明第几个IP地址，如果只有该接口只有一个IP地址则为0
   inet_addr(strIP.c_str()), //
   inet_addr(strSubnetMask.c_str()),
   0    //对DHCP的操作 0:不修改, 1:启用 DHCP，2:禁用 DHCP
   ) != ERROR_SUCCESS)
  {
   FreeLibrary(hDhcpDll);
   return FALSE;
  }
  FreeLibrary(hDhcpDll);
 }
 return TRUE;
}

BOOL CAdapter::ADAPTER_INFO::RegSetIP()
{
 HKEY hKey;
 string strKeyName ="SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\";
 strKeyName += strName;

 if(RegOpenKeyExA(HKEY_LOCAL_MACHINE,
  strKeyName.c_str(),
  0,
  KEY_WRITE,
  &hKey) != ERROR_SUCCESS)
 {
  return FALSE;
 }
 strIP.push_back('\0');
 strSubnetMask.push_back('\0');
 strNetGate.push_back('\0');

 RegSetValueExA(hKey, "IPAddress", 0, REG_MULTI_SZ, (unsigned char*)strIP.data(), (DWORD)strIP.length()+2);
 RegSetValueExA(hKey, "SubnetMask", 0, REG_MULTI_SZ, (unsigned char*)strSubnetMask.data(),(DWORD)strSubnetMask.length()+2 );
 RegSetValueExA(hKey, "DefaultGateway", 0, REG_MULTI_SZ, (unsigned char*)strNetGate.data(), (DWORD)strNetGate.length()+2);
 RegSetValueExA(hKey, "NameServer", 0, REG_SZ, (unsigned char*)strDNS.data(),(DWORD) strDNS.length());
 RegCloseKey(hKey);
 return TRUE;
}