一次抓“小偷”的经过（找出偷走当前活动窗口的小偷）

最近在使用Windows的过程中经常发现当前活动窗口被莫名其妙切换走需要按AltTab键或用鼠标左键单击恢复很烦人。于是写了一个每隔0.5秒获取当前窗口对应的进程PID窗口标题和对应进程全路径名有变化时记录到日志文件中的小程序FocusMonitor源代码如下#pragma warning(disable:4996) #pragma comment(lib,user32) #pragma comment(lib,psapi) #include io.h #include stdio.h #include string.h #include windows.h #include psapi.h //Log{ #define MAXLOGSIZE 20000000 #define MAXLINSIZE 16000 #include time.h #include sys/timeb.h #include stdarg.h char logfilename1[]FocusMonitor1.log; char logfilename2[]FocusMonitor2.log; static char logstr[MAXLINSIZE1]; char datestr[16]; char timestr[16]; char mss[4]; CRITICAL_SECTION cs_log; FILE *flog; char pathfilename[_MAX_FNAME]; char path[_MAX_FNAME]; char filename[_MAX_FNAME]; char tt[2]; void Lock(CRITICAL_SECTION *l) { EnterCriticalSection(l); } void Unlock(CRITICAL_SECTION *l) { LeaveCriticalSection(l); } void LogV(const char *pszFmt,va_list argp) { struct tm *now; struct timeb tb; if (NULLpszFmt||0pszFmt[0]) return; _vsnprintf(logstr,MAXLINSIZE,pszFmt,argp); ftime(tb); nowlocaltime(tb.time); sprintf(datestr,%04d-%02d-%02d,now-tm_year1900,now-tm_mon1,now-tm_mday); sprintf(timestr,%02d:%02d:%02d,now-tm_hour ,now-tm_min ,now-tm_sec ); sprintf(mss,%03d,tb.millitm); // printf(%s %s.%s %s,datestr,timestr,mss,logstr); flogfopen(logfilename1,a); if (NULL!flog) { fprintf(flog,%s %s.%s %s,datestr,timestr,mss,logstr); if (ftell(flog)MAXLOGSIZE) { fclose(flog); if (rename(logfilename1,logfilename2)) { remove(logfilename2); rename(logfilename1,logfilename2); } } else { fclose(flog); } } } void Log(const char *pszFmt,...) { va_list argp; Lock(cs_log); va_start(argp,pszFmt); LogV(pszFmt,argp); va_end(argp); Unlock(cs_log); } //Log} void GetPathByProcessId(DWORD dwPid, char *fullpath) { HANDLE hProcess OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwPid); if (hProcess NULL) return; fullpath[0]0; GetModuleFileNameEx(hProcess,NULL,fullpath,MAX_PATH); } INT WINAPI WinMain(HINSTANCE hInstance, HINSTANCE, PSTR, INT iCmdShow) { remove(noloop.txt); InitializeCriticalSection(cs_log); Log(FocusMonitor.exe Begin...\n); //防止该进程重入 HANDLE hMutex; hMutex CreateMutex(NULL, FALSE, FocusMonitor.exe ); if ( WaitForSingleObject(hMutex, 1000) WAIT_TIMEOUT ) { Log(FocusMonitor.exe already running\n); Log( ...End\n); DeleteCriticalSection(cs_log); return 1; } if ( GetLastError() ERROR_ALREADY_EXISTS ) { ReleaseMutex(hMutex); Log(FocusMonitor.exe already running\n); Log( ...End\n); DeleteCriticalSection(cs_log); return 2; } char str1[2*MAX_PATH]; char str2[2*MAX_PATH]; str2[0]0; while (1) { if (_access(noloop.txt,0) 0) break;// Sleep(500); HWND hWndGetForegroundWindow(); char title[10241]; if (0GetWindowText(hWnd, title, 1024)) title[0]0; DWORD pid; GetWindowThreadProcessId(hWnd,pid); char fullpath[MAX_PATH]; GetPathByProcessId(pid,fullpath); sprintf(str1,PID:%5ld, TITLE:%-100s, FULLPATH:%s\n,pid,title,fullpath); if (strcmp(str2,str1)){ strcpy(str2,str1); Log(str2); } } remove(noloop.txt); Log(Create a file noloop.txt or kill process FocusMonitor.exe to exit\n); Log(...End\n); DeleteCriticalSection(cs_log); return 0; }使用这个工具果然让我抓到了“小偷”2026-07-17 15:50:12.784 PID: 9527, TITLE:mphelper, FULLPATH:C:\Users\zhao4zhong1\AppData\Roaming\mphelper\2.0.21.1\mphelper.exe然后我就祭出我的“手铐”资源管理器中将文件夹C:\Users\zhao4zhong1\AppData\Roaming\mphelper的属性、安全、编辑、组或用户名、删除把这个“小偷”送进了“监狱”。