VBS脚本结束可疑进程及短路径与长路径转换等实用函数

powerbat

如需转载请注明出处：http://www.bathome.net/thread-15778-1-1.html

1. 
   
2. 'VBS脚本结束可疑进程及短路径与长路径转换、Replace加强等实用函数
   
3. 'powerbat @ www.bathome.net 批处理之家
   
4. Set fso = CreateObject("Scripting.FileSystemObject")
   
5. Set sh = CreateObject("Shell.Application")
   
6. Set ws = CreateObject("WScript.Shell")
   
7. 
   
8. strComputer = "."
   
9. Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\" _
   
10.     & strComputer & "\root\cimv2")
    
11. 
    
12. strTempPath = GetLongPath( fso.GetSpecialFolder(2) )
    
13. 
    
14. set colProcs = objWMIService.ExecQuery(_
    
15.     "SELECT * FROM Win32_Process Where ProcessID>4")
    
16. for each objProc in colProcs
    
17.   FilePath = objProc.ExecutablePath
    
18.   if not IsNull(FilePath) then
    
19.     FilePath = GetLongPath(FilePath)
    
20.     if ReplaceEx( replace(FilePath,strTempPath,"",1,1,1), _
    
21.         "/^\\[0-9]{3}\\[^\\]+$/i", "") = "" then
    
22.       'WScript.Echo FilePath
    
23.       objProc.Terminate()
    
24.       ws.Environment("process").Item("#") = FilePath
    
25.       ws.Run "cmd.exe /d /q /c echo y|cacls ""%#%"" /e /d everyone", 0
    
26.     end if
    
27.   end if
    
28. next
    
29. 
    
30. 
    
31. Function GetLongPath(strPath)
    
32.   GetLongPath = ""
    
33.   strPath = fso.GetAbsolutePathName(strPath) 'in case of "C:\boot.ini\.."
    
34.   if fso.FileExists(strPath) then
    
35.     GetLongPath = sh.NameSpace( fso.GetParentFolderName(strPath) _
    
36.         ).ParseName( fso.GetFileName(strPath) ).Path
    
37.   elseif fso.FolderExists(strPath) then
    
38.     GetLongPath = sh.NameSpace(strPath).Self.Path
    
39.   end if
    
40. End Function
    
41. 
    
42. Function GetShortPath(strPath)
    
43.   GetShortPath = ""
    
44.   'strPath = fso.GetAbsolutePathName(strPath) 'unnecessary
    
45.   if fso.FileExists(strPath) then
    
46.     GetShortPath = fso.GetFile(strPath).ShortPath
    
47.   elseif fso.FolderExists(strPath) then
    
48.     GetShortPath = fso.GetFolder(strPath).ShortPath
    
49.   end if
    
50. End Function
    
51. 
    
52. function ReplaceEx(sSource, sPattern, sReplace)
    
53. rem function ReplaceEx uses regular expression.
    
54. rem Arg.2(sPattern) should be like in JavaScript, eg: "/hello/gim"
    
55.   dim RegEx, Match, Mode, LastSlash
    
56.   LastSlash = InStrRev(sPattern, "/")
    
57.   Match = Mid(sPattern, 2, LastSlash-2)
    
58.   Mode = Mid(sPattern, LastSlash+1)
    
59.   Set RegEx = new RegExp
    
60.   RegEx.Pattern = Match
    
61.   if InStr(1,Mode,"g",1) then RegEx.Global = True
    
62.   if InStr(1,Mode,"i",1) then RegEx.IgnoreCase = True
    
63.   if InStr(1,Mode,"m",1) then RegEx.Multiline = True
    
64. ReplaceEx = RegEx.Replace(sSource, sReplace)
    
65. end function

复制代码

其实，这个“可疑进程”是针对具体案例而言，并非通用。