[新手上路]批处理新手入门导读[视频教程]批处理基础视频教程[视频教程]VBS基础视频教程[批处理精品]批处理版照片整理器
[批处理精品]纯批处理备份&还原驱动[批处理精品]CMD命令50条不能说的秘密[在线下载]第三方命令行工具[在线帮助]VBScript / JScript 在线参考
返回列表 发帖
batpro

Rank: 2

帖子
71 
积分
137 
技术
2  
捐助
0  
注册时间
2011-5-8 
1楼 跳转到 » 正序看帖
打印
tT
发表于 2011-5-24 22:01 | 只看该作者

[文本处理] 批处理版SREnglog智能分析工具(请帮忙找问题及精简)

  1. rem   版权代码部分开始于此处

  2. @echo off 

  3. rem 

  4. mode con cols=100 lines=12 &color 9f 

  5. cls

  6. set a=^set /p=■%b%^<nul^&ping/n 0 127.1.0^>nul^& 

  7. echo.

  8. echo         程序正在初始化. . .           

  9. echo       ┌──────────────────────────────────────┐

  10. set/p=        <nul&%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%

  11. echo 100%% 

  12. echo       └──────────────────────────────────────┘

  13. set b=

  14. set a=■

  15. set /a z=100

  16. :start

  17. cls

  18. set a=%a%■■

  19. set /a b+=5

  20. set /a z-=5

  21. echo.

  22. echo        程序正在启动，请稍候. . . 欢迎使用SREnglog智能分析助手       by 52kafan

  23. echo                                                                     from [url]http://bbs.kafan.cn/[/url]

  24. echo       ┌──────────────────────────────────────────┐

  25. echo        %a% %b%%%

  26. echo       └──────────────────────────────────────────┘

  27. ping /n 0 127.0 >nul

  28. if %b% geq 100 goto num2

  29. ping /n 0 127.0 >nul

  30. set /a sum =5

  31. goto start

  32. :_exit

  33. set /a sum-=1

  34. set/p=%sum% 秒后退出! <nul

  35. echo. 

  36. if %sum% EQU 0 exit

  37. ping /n 0 127.0 >nul

  38. goto _exit

  39. :num2

  40. rem   版权部分结束于此处

  41. rem ⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙

  42. rem ┌─────────────────────────────────────────────────────────────┐

  43. rem                                       软            件            架            构            部            分

  44. rem └─────────────────────────────────────────────────────────────┘

  45. rem   (1)穷举"N/A"写入到N-A.txt

  46. (echo 创建文本& echo.)>>tt.txt

  47. (echo 创建文本& echo.)>>N7.txt

  48. (echo 创建文本& echo.)>>old2.txt

  49. (echo 创建文本& echo.)>>ttt.txt

  50. findstr /li "N/" SREngLOG.log>>N-A.txt

  51. setlocal enabledelayedexpansion

  52. for /f "tokens=*" %%i in (N-A.txt) do (

  53. set var=%%i

  54. rem ┌──────────────────────────────────────────────────────────────┐

  55. rem                                       N/A           白            明            单            部            分

  56. rem └──────────────────────────────────────────────────────────────┘

  57. rem   (2)标记"N-A.txt"中正常的驱动项和相关服务项

  58. set "var=!var:drivers\360AntiArp.sys=%正常!"

  59. set "var=!var:Garena\safedrv.sys=%正常!"

  60. set "var=!var:system32\DRIVERS\ewusbmdm.sys=%正常的华为CDMA上网卡驱动!"            

  61. set "var=!var:system32\DRIVERS\ewusbdev.sys=%正常的华为出品无线网卡相关驱动!"            

  62. set "var=!var:system32\drivers\massfilter.sys=%正常的DVD/CD-ROM设备管理程序驱动!"          

  63. set "var=!var:system32\drivers\mpfilt.sys=%正常的安国U盘量产工具的驱动!"   

  64. set "var=!var:system32\DRIVERS\pcdrndisuio.sys=%正常的联想toolbox安装的驱动!"         

  65. set "var=!var:System32\Drivers\sptd.sys=%正常的虚拟光驱DAEMON Tools的驱动文件!"               

  66. set "var=!var:system32\NtDriver.sys=%正常的卡巴斯基木马扫描工具troyanfindinfo驱动!"         

  67. set "var=!var:system32\DRIVERS\tvtpktfilter.sys=%正常的联想thinkpad文件还原恢复程序的驱动!"      

  68. set "var=!var:system32\DRIVERS\UIUSYS.SYS=%正常的联想调制解调器驱动!"              

  69. set "var=!var:system32\DRIVERS\zgdccat.sys=%正常的CDMA人机接口驱动!"            

  70. set "var=!var:system32\DRIVERS\zgdccdiag.sys=%正常的USB调制解调器/串行设备驱动!"          

  71. set "var=!var:system32\DRIVERS\zgdccmdm.sys=%正常的CDMA联想USB调制解调器驱动!"            

  72. set "var=!var:system32\DRIVERS\zgdccvousb.sys=%正常的USB调制解调器/串行设备驱动!"          

  73. set "var=!var:AntiARPClientLoader.exe=%正常的!"   

  74. set "var=!var:System32\TPHDEXLG.exe=%正常的!"      

  75. set "var=!var:oracle\ora92=%正常的!"                                                                           

  76. set "var=!var:ipinip.sys=%正常!"

  77. set "var=!var:aliide.sys=%正常!"

  78. set "var=!var:viaudio.sys=%正常!

  79. set "var=!var:SKNFW.sys=%正常!"

  80. set "var=!var:RsNTGdi.sys=%正常!"

  81. set "var=!var:SkyNet\Firewall\SkyProcs.sys=%正常!"

  82. set "var=!var:snpstd3.sys=%正常!"

  83. set "var=!var:ggghost.sys=%正常!"

  84. set "var=!var:p2pfilter.sys=%正常!"

  85. set "var=!var:tcphoc.sys=%正常!"

  86. set "var=!var:usb2vcom.sys=%正常!"

  87. set "var=!var:SystemCleaner\krpr.sys=%正常!"

  88. set "var=!var:dtscsi.sys=%正常!"

  89. set "var=!var:DRIVERS\sr.sys=%正常!"

  90. set "var=!var:d347prt.sys=%正常!"

  91. set "var=!var:npkcusb.sys=%正常!"

  92. set "var=!var:Rfw\HookUrl.sys=%正常!"

  93. set "var=!var:Rfw\RsFwDrv.sys=%正常!"

  94. set "var=!var:scdriver\ScbkEx.sys=%正常!"

  95. set "var=!var:scdriver\ScCchMgr.sys=%正常!"

  96. set "var=!var:scdriver\ssfltpt.sys=%正常!"

  97. set "var=!var:Rfw\HookUrl.sys=%正常!"

  98. set "var=!var:Rfw\RsFwDrv.sys=%正常!"

  99. set "var=!var:3waregsm.sys=%正常!"

  100. set "var=!var:KLIF.SYS=%正常!"

  101. set "var=!var:tsusbhub.sys=%正常!"

  102. set "var=!var:Program Files=%正常!"

  103. set "var=!var:o2media.sys=%正常!"

  104. set "var=!var:o2sd.sysO2Micro=%正常!"

  105. set "var=!var:blueletaudio.sys=%正常!"

  106. set "var=!var:rdvgkmd.sys=%正常!"

  107. set "var=!var:btnetdrv.sys=%正常!"

  108. set "var=!var:vbtenum.sys=%正常!"

  109. set "var=!var:BTHidMgr.sys=%正常!"

  110. set "var=!var:npkcrypt.sys><N/A>=%npkcrypt.sys><N/A正常!"

  111. set "var=!var:xAntiArp.sys><N/A>=xAntiArp.sys><N/A>正常!"

  112. set "var=!var:<\??\C:\PROGRA~1\thunder network\thunder\XLDoctor\7.1.7.2244_2\Program\tcphoc.sys><N/A>=%<\??\C:\PROGRA~1\thunder network\thunder\XLDoctor\7.1.7.2244_2\Program\tcphoc.sys><N/A>正常!"

  113. set "var=!var:EagleXNt.sys=%正常!"

  114. set "var=!var:DRIVERS\epfwtdir.sys=%正常!"

  115. set "var=!var:零时空\ntio518xp.sys=%正常!"

  116. set "var=!var:DTL132\DTL132_x32.sys=%正常!"

  117. set "var=!var:360TimeProt.sys=%正常!"

  118. set "var=!var:synth3dvsc.sys=%正常!"

  119. set "var=!var:VcommMgr.sys=%正常!"

  120. set "var=!var:TDSMAPI.SYS=%正常!"

  121. set "var=!var:TPInput.sys=%正常!"

  122. set "var=!var:System32\drivers\Tppwrif.sys=%正常!"

  123. set "var=!var:ASIO.SYS=%正常!" 

  124. set "var=!var:system32\drivers\AsIO.sys=%正常!"

  125. set "var=!var:drivers\PnpWmkDrv.sys=%正常!"

  126. set "var=!var:system32\DRIVERS\pfc027.sys=%正常!"

  127. set "var=!var:hostnt.sys=%正常!"

  128. set "var=!var:nod32drv.sys=%正常!"

  129. set "var=!var:hostnt.sys=%正常!" 

  130. set "var=!var:mhdrv.sys=%正常!"

  131. set "var=!var:drivers\rcmhdog.sys=%正常!"

  132. set "var=!var:bdpredir.sys=%正常!"

  133. set "var=!var:LongRADrv.sys=%正常!"

  134. set "var=!var:gmsipci.sys=%正常!"

  135. set "var=!var:npf.sysCACE=%正常!" 

  136. set "var=!var:EagleNT.sys=%正常!"

  137. set "var=!var:npkycryp.sys=%正常!"

  138. set "var=!var:PCAMp50.sys=%正常!"

  139. set "var=!var:PCASp50.sys=%正常!" 

  140. set "var=!var:amd64\AODDriver2.sys=%正常!" 

  141. set "var=!var:AmgVP.sys=%正常!"

  142. set "var=!var:DRIVERS\motfilt.sys=%正常!"

  143. set "var=!var:Drivers\motoandroid.sys=%正常!"

  144. set "var=!var:DRIVERS\motccgp.sys=%正常!"

  145. set "var=!var:DRIVERS\motccgpfl.sys=%正常!"

  146. set "var=!var:DRIVERS\motodrv.sys=%正常!"

  147. set "var=!var:DRIVERS\motmodem.sys=%正常!"

  148. set "var=!var:DRIVERS\motswch.sys=%正常!"

  149. set "var=!var:DRIVERS\Motousbnet.sys=%正常!"

  150. set "var=!var:DRIVERS\motusbdevice.sys=%正常!"

  151. set "var=!var:DRIVERS\TurboB.sys=%正常!"

  152. set "var=!var:SuperFZ.sys=%正常!"

  153. set "var=!var:SucopDrv.sys=%正常!"

  154. set "var=!var:epfwtdir.sys=%正常!"

  155. set "var=!var:\??\=%ddd!"

  156. set "var=!var:-k netsvcs-->=%@!" 

  157. echo !var!>>N1.txt

  158. )

  159. rem   (3)生成可疑驱动.txt

  160. findstr /li "ddd" N1.txt >>可疑驱动.txt

  161. setlocal enabledelayedexpansion

  162. for /f "delims=" %%i in (N1.txt) do ( 

  163. if not defined %%i set %%i=A & echo %%i>>report.txt)

  164. rem ⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙

  165. rem ┌──────────────────────────────────────────────────────────┐

  166. rem                              软            件            报            告            部            分

  167. rem └──────────────────────────────────────────────────────────┘

  168. rem 

  169. rem ----------------------------------------------------------------------------------------------------------------------------

  170. findstr /li "system32\COMRes.dll" SREngLOG.log >>old.txt

  171. rem ----------------------------------------------------------------------------------------------------------------------------

  172. findstr /li "[," SREngLOG.log >>1001.txt

  173. findstr /li ".ocx" 1001.txt >>old.txt

  174. setlocal enabledelayedexpansion

  175. for /f "tokens=*" %%i in (old.txt) do (

  176. set var=%%i

  177. set "var=!var:System32=%system32!"

  178. set "var=!var:1=%!" 

  179. set "var=!var:0=%!" 

  180. echo !var!>>old2.txt

  181. )

  182. setlocal enabledelayedexpansion

  183. for /f "delims=" %%i in (old2.txt) do (findstr /c:"%%i" tt.txt>nul||echo %%i>>tt.txt)

  184. (echo 1、用替换工具替换以下文件：& echo.)>分析报告.txt

  185. findstr /li "system32\COMRes.dll" tt.txt >>分析报告.txt

  186. findstr /li "Infected" SREngLOG.log >>分析报告.txt

  187. (echo ———————————————————————————————————————& echo.)>>分析报告.txt

  188. (echo 2、用xdelbox删除以下文件 ：& echo.)>>分析报告.txt 

  189. findstr /li "[," report.txt >>要删除的文件.txt

  190. findstr /li "A," report.txt >>要删除的文件.txt

  191. findstr /li "<internat>" SREngLOG.log>>要删除的文件.txt

  192. findstr /li "updater.exe" SREngLOG.log>>要删除的文件.txt

  193. findstr /li ".ocx" tt.txt >>要删除的文件.txt

  194. findstr /li "菜单" SREngLOG.log>>要删除的文件.txt

  195. findstr /li "samservice.exe><>" SREnglog.log>>要删除的文件.txt

  196. findstr /li "@" N1.txt >>要删除的文件.txt

  197. findstr /li ".exe><N/" N1.txt >>要删除的文件.txt

  198. findstr /li ".dll><N/" N1.txt >>要删除的文件.txt

  199. findstr /li "tasks\SogouImeMgr.job" SREnglog.log>>要删除的文件.txt

  200. findstr /li "Tmp" SREngLOG.log >>Temp.txt

  201. findstr /li "[]" Temp.txt >>要删除的文件.txt

  202. findstr /li "LOCALS~1\Temp" SREngLOG.log >>要删除的文件.txt

  203. @findstr /v "PID" 要删除的文件.txt >>重复文件.txt 

  204. setlocal enabledelayedexpansion

  205. for /f "delims=" %%i in (重复文件.txt) do (findstr /c:"%%i" ttt.txt>nul||echo %%i>>ttt.txt)

  206. findstr /li "Tmp" ttt.txt >>分析报告.txt 

  207. @findstr /v "tmp" ttt.txt >>分析报告.txt 

  208. (echo ———————————————————————————————————————& echo.)>>分析报告.txt

  209. (echo 正在运行的程序:& echo.)>>分析报告.txt

  210. @findstr /v "特权" 要删除的文件.txt >8.txt 

  211. findstr /li "PID" 8.txt>>mm.txt

  212. findstr /li "svchost.exe" SREngLOG.log >>mm.txt

  213. findstr /li "smss.exe" SREngLOG.log >>mm.txt

  214. (echo 正在运行的程序:& echo.)>>正在运行的程序.txt

  215. setlocal enabledelayedexpansion

  216. for /f "tokens=*" %%i in (mm.txt) do (

  217. set var=%%i

  218. set "var=!var:.cn=%!"

  219. set "var=!var:/=%!"

  220. set "var=!var:System32\smss.exe=%!"

  221. set "var=!var:system32\svchost.exe=%!"

  222. echo !var!>>正在运行的程序.txt

  223. )

  224. findstr /li ".exe" 正在运行的程序.txt >>分析报告.txt

  225. findstr /li ".tmp" 正在运行的程序.txt >>分析报告.txt

  226. 

  227. (echo ———————————————————————————————————————& echo.)>>分析报告.txt

  228. (echo 3、打开SREng，选择【启动项目】-【注册表】，将以下项删除：& echo.)>>分析报告.txt

  229. findstr /li "><" SREngLOG.log >>N2.txt

  230. findstr /li "[]" N2.txt >>N3.txt

  231. findstr /li "missing]" SREngLOG.log >>N3.txt

  232. 

  233. @findstr /v "菜单" N3.txt >>分析报告.txt  

  234. setlocal enabledelayedexpansion

  235. for /f "tokens=*" %%i in (分析报告.txt) do (

  236. set var=%%i

  237. rem ┌──────────────────────────────────────────────────────────┐

  238. rem                                       report           白            明            单            部            分

  239. rem └──────────────────────────────────────────────────────────┘

  240. rem

  241. set "var=!var:[File is missing]=%<注册表残留项>!"

  242. set "var=!var:assembly\=%正常!"

  243. set "var=!var:奇虎网=%正常!"

  244. set "var=!var:CMBProtector.dat><N/A>=%CMBProtector.dat><N/A>正常!"

  245. set "var=!var:CertClient.dat><N/A>=%CertClient.dat>正常!"

  246. set "var=!var:system32\srvany.exe=%正常!"   

  247. set "var=!var:KMService.exe=%正常!" 

  248. set "var=!var:\jre\bin\=%正常!"

  249. set "var=!var:Garena\safedrv.sys=%正常!"

  250. set "var=!var:XLPPoEPCIoctl.dll=%正常!"

  251. set "var=!var:BYTEHERO\BSD=%正常!"

  252. set "var=!var:通讯簿=%正常!"

  253. set "var=!var:Smallfrogs=%正常!"

  254. set "var=!var:360\360SD=%这是正常程序!"

  255. set "var=!var:load=%正常!"

  256. set "var=!var:360Chrome\Chrome=%正常!"

  257. set "var=!var:WebCheck=%正常!"

  258. set "var=!var:@C:\WINDOWS\system32\=%!"

  259. set "var=!var:AppInit_DLLs=%正常!"

  260. set "var=!var:CPUMon\CPUMon.exe=%正常!"

  261. set "var=!var:kolscan\sqlite.dll=%kolscan\sqlite.dll (这是正常程序)!"

  262. set "var=!var:Thunder=%Thunder正常!"

  263. set "var=!var:msdmo.dll=%正常!"

  264. set "var=!var:kingsoft\=%正常!"

  265. set "var=!var:\Avira\AntiVir=%正常!"

  266. set "var=!var:Yuguo\=%Yuguo\正常的雨过天晴电脑保护系统!"

  267. set "var=!var:Software\Avast=%正常!"

  268. set "var=!var:KuGou\KuGou=%正常!"

  269. set "var=!var:(Signed)=%(Signed)正常!"

  270. set "var=!var:<load><>=%<load><>正常!" 

  271. set "var=!var:atitray=%正常!" 

  272. set "var=!var:Macrovision=%正常!"

  273. set "var=!var:Secdrv=%正常!"

  274. set "var=!var:VIA=%正常!" 

  275. set "var=!var:system32\COMRes.dll=%正常!" 

  276. set "var=!var:WDM=%正常!"

  277. set "var=!var:ChinaNet=%正常!"

  278. set "var=!var:VIAudio=%正常!"

  279. set "var=!var:KSM\sqlite.dll=%正常!" 

  280. set "var=!var:SKNFW=%正常!"

  281. set "var=!var:SkyProcs=%正常!"

  282. set "var=!var:SkyNet\Firewall\SkyProcs.sys=%正常!"

  283. set "var=!var:SNPSTD3=%正常!"

  284. set "var=!var:Camera=%正常!"

  285. set "var=!var:ZSMC=%正常!"

  286. set "var=!var:VM=%正常!"

  287. set "var=!var:ICBCEbankTools=%正常!"

  288. set "var=!var:SogouExplorer\=%正常!"

  289. set "var=!var:Unlocker=%正常!"

  290. set "var=!var:snapshot\Client=%正常!" 

  291. set "var=!var:Jollytime=%正常!" 

  292. set "var=!var:usb2vcom=%正常!"

  293. set "var=!var:MemTurbo\=%正常!"

  294. set "var=!var:sptd=%正常!" 

  295. set "var=!var:dtscsi=%正常!"

  296. set "var=!var:[Explorer]=%<Explorer>!"

  297. set "var=!var:Mozilla\Firefox=%正常!"

  298. set "var=!var:Manager\PowerUtl.dll=%正常!" 

  299. set "var=!var:firefox\mozjs.dll=%正常!" 

  300. set "var=!var:d347bus=%正常!" 

  301. set "var=!var:ufjdk\bin\java.exe=%正常!"    

  302. set "var=!var:d347prt=%正常!"

  303. set "var=!var:(Verified)Microsoft=%正常!" 

  304. set "var=!var:npkcrypt=%正常!" 

  305. set "var=!var:npkcusb=%正常!" 

  306. set "var=!var:SMPLSCSI=%正常!" 

  307. set "var=!var:CMBProtector=%正常!"

  308. set "var=!var:rfw\rfwproxy.exe=%正常!"

  309. set "var=!var:rfw\rfwsrv.exe=%正常!"

  310. set "var=!var:3WAREGSM=%正常!"

  311. set "var=!var:3WDRV=%正常!"

  312. set "var=!var:IObit\Advanced SystemCare=%正常!"

  313. set "var=!var:oreans32=%正常!"

  314. set "var=!var:EHttpSrv.exe=%正常!"

  315. set "var=!var:O2MDRDR=%正常!" 

  316. set "var=!var:ekrn.exe=%正常!" 

  317. set "var=!var:Numen\NumenAgentWin\=%正常!"

  318. set "var=!var:O2Micro=%正常!"

  319. set "var=!var:O2SDRDR=%正常!"

  320. set "var=!var:o2sd.sysO2Micro=%正常!"

  321. set "var=!var:Lenovo=%正常!"

  322. set "var=!var:fsp.exe=%正常!"

  323. set "var=!var:usblogon.exe=%正常!"

  324. set "var=!var:Bluetooth=%正常!" 

  325. set "var=!var:[   ]=%!" 

  326. set "var=!var:Google\Chrome\Application=%Google\Chrome\Application正常!"

  327. set "var=!var:_DLLs><>=%_DLLs><>正常!" 

  328. set "var=!var:Easy Display Manager\HookDllPS2.dll]=%Easy Display Manager\HookDllPS2.dll] 正常!"

  329. set "var=!var:System32\bcm1xsup.dll=%System32\bcm1xsup.dll (这是正常程序)!"

  330. set "var=!var:Mozilla Firefox\mozjs.dll]=%Mozilla Firefox\mozjs.dll] 正常!"

  331. set "var=!var:VMware Workstation\libxml2.dll]=%VMware Workstation\libxml2.dll] 正常 !" 

  332. set "var=!var:Program Files\WinRAR=%Program Files\WinRAR正常的WinRAR文件!"

  333. set "var=!var:json.dll]=%json.dll正常的金山在线杀毒模块]!"

  334. set "var=!var:network\tp=%network\tp(这是正常程序)!"

  335. set "var=!var:KWMUSIC\bin\=%KWMUSIC\bin\(这是正常程序)!"

  336. set "var=!var:Fetion=%Fetion(这是正常程序)!

  337. set "var=!var:\Holdfast\platform=%\Holdfast\platform(这是正常程序)!

  338. set "var=!var:<\??\C:\PROGRA~1\thunder network\thunder\XLDoctor\7.1.7.2244_2\Program\tcphoc.sys><N/A>=%<\??\C:\PROGRA~1\thunder network\thunder\XLDoctor\7.1.7.2244_2\Program\tcphoc.sys><N/A>正常!"

  339. set "var=!var:regsvr32.exe /s /n /i:/UserInstall=%regsvr32.exe /s /n /i:/UserInstall (这是正常程序)!"

  340. set "var=!var:\Outlook=%\Outlook (这是正常程序)!"

  341. set "var=!var:VMware\VMware=%VMware\VMware (这是正常程序)!"

  342. set "var=!var:Yuguo\shieldclnt.exe><N/A>=%Yuguo\shieldclnt.exe><N/A> (这是正常程序)!"

  343. set "var=!var:bcmwltry.exe><N/A>=%bcmwltry.exe><N/A> (这是正常程序)!"

  344. set "var=!var:System32\WLTRYSVC.EXE]=%System32\WLTRYSVC.EXE] (这是正常程序)!"

  345. set "var=!var:Adobe Systems, Inc.,=%Adobe Systems, Inc.,正常!"

  346. set "var=!var:Funshion Online=%Funshion Online (这是正常程序)!"

  347. set "var=!var:Maxthon=%正常!"

  348. set "var=!var:<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, >=%这是正常文件!"

  349. set "var=!var:webaClient.exe=%正常!"

  350. set "var=!var:NvCpl.dll=%正常!"

  351. set "var=!var:NvStartup=%正常!"

  352. set "var=!var:PCHealth=%正常!"

  353. set "var=!var:AcPrfMgrSvc=%正常!"

  354. set "var=!var:ThinkPad=%正常!"

  355. set "var=!var:AcSvc=%正常!"

  356. set "var=!var:Backup\QQPet=%正常!"

  357. set "var=!var:H3C\gmMgr_h3c.exe=%正常!" 

  358. set "var=!var:ConnectUtilities=%正常!"

  359. set "var=!var:AcSvc.exeLenovo=%正常!"

  360. set "var=!var:ThinkPad=%正常!"

  361. set "var=!var:Defender\mpsvc.dll=%正常!"

  362. set "var=!var:IBMPMSVC=%正常!"

  363. set "var=!var:Tencent\QQ=%正常!"

  364. set "var=!var:Intel\Wireless\Bin\=%正常!"

  365. set "var=!var:ibmpmsvc.exe=%正常!"

  366. set "var=!var:IBM=%正常!"

  367. set "var=!var:system32\TpKmpSVC.exe=%正常!"

  368. set "var=!var:system32\ati2sgag.exe=%正常!"

  369. set "var=!var:UfAutoLoadService=%正常!"

  370. set "var=!var:UfMsgGhost=%正常!"

  371. set "var=!var:MsgGhost.exe=%正常!"

  372. set "var=!var:U8AuthServer=%正常!"

  373. set "var=!var:UFNet=%正常!"

  374. set "var=!var:Outlook=%正常!"

  375. set "var=!var:shmgrate.exe=%正常!"

  376. set "var=!var:system32\ServerNT.exe=%正常!"

  377. set "var=!var:Simulator=%正常!" 

  378. set "var=!var:System32\PAStiSvc.exe=%正常!"

  379. set "var=!var:Cyberip=%正常!"

  380. set "var=!var:RichVideo.exe"=%正常!"

  381. set "var=!var:powershadow=%正常!"

  382. set "var=!var:ShadowSystemService=%正常!"

  383. set "var=!var:ShadowService.exe=%正常!"

  384. set "var=!var:O2Micro=%正常!"

  385. set "var=!var:system32\o2flash.exe=%正常!"

  386. set "var=!var:srservice=%正常!"  

  387. set "var=!var:srsvc.dll=%正常!"

  388. set "var=!var:MAPGIS=%正常!"

  389. set "var=!var:zdLccSvc=%正常!"

  390. set "var=!var:system32\ZDLCCSVC.EXE=%正常!"

  391. set "var=!var:ALi=%正常!" 

  392. set "var=!var:AliIde=%正常!"

  393. set "var=!var:Antimalware=%正常!"

  394. set "var=!var:NvMcTray.dll=%正常!"

  395. set "var=!var:WBEM=%疑似灰鸽子木马!"

  396. set "var=!var:PPPoEWin=%正常!"

  397. set "var=!var:TDSMAPI=%正常!" 

  398. set "var=!var:TPInput=%正常!"

  399. set "var=!var:RUNDLL2000.EXE=%危险!"

  400. set "var=!var:TPPWRIF=%正常!"

  401. set "var=!var:System32\drivers\Tppwrif.sys=%正常!"

  402. set "var=!var:TSMAPIP=%正常!"

  403. set "var=!var:PnpWmkDrv=%正常!" 

  404. set "var=!var:SoC=%正常!" 

  405. set "var=!var:HOSTNT=%正常!"

  406. set "var=!var:MHDRV=%正常!" 

  407. set "var=!var:Rainbow=%正常!" 

  408. set "var=!var:aswFsBlk=%正常!"

  409. set "var=!var:bdfdll=%正常!"

  410. set "var=!var:BitDefender=%正常!"

  411. set "var=!var:\H3C\iNode=%正常!"

  412. set "var=!var:bdpredir=%正常!"

  413. set "var=!var:KSafe\json.dll=%正常!" 

  414. set "var=!var:Protector=%正常!" 

  415. set "var=!var:ProtectorA=%正常!" 

  416. set "var=!var:npf.sysCACE=%正常!" 

  417. set "var=!var:WinPcap=%正常!"

  418. set "var=!var:/Program=%正常!"

  419. set "var=!var:system32\PnkBstrA.exe=%正常!" 

  420. set "var=!var:punkbuster=%正常!" 

  421. set "var=!var:c20ukdrwsvr.exe=%正常!"

  422. set "var=!var:IcbcDaemon.exe=%正常!" 

  423. set "var=!var:WDelMgr20=%正常!" 

  424. set "var=!var:system32\nvshell.dll=%正常!" 

  425. set "var=!var:system32\pthreadvc.dll=%正常!" 

  426. set "var=!var:MacType.dll=%正常!" 

  427. set "var=!var:Ock.dll=%正常!"

  428. set "var=!var:VopClient.exe=%正常!"

  429. set "var=!var:bgswitch.exe=%正常!"

  430. set "var=!var:BigDogPathVM=%正常!"

  431. set "var=!var:X-Scan-v3.3=%正常!"

  432. set "var=!var:dumprep=%正常!" 

  433. set "var=!var:HookDll.dll=%正常!" 

  434. set "var=!var:dominodomino.exe=%正常!" 

  435. set "var=!var:VMSnapset=%正常!" 

  436. set "var=!var:Htpatch.exe=%正常!"

  437. set "var=!var:HTpatchhtpatch.exe=%正常!"

  438. set "var=!var:QQ\Bin=%正常!"

  439. set "var=!var:Notify\DfLogon=%正常!"

  440. set "var=!var:DfLogonLogonDll.dll=%正常!" 

  441. set "var=!var:Interface=%正常!" 

  442. set "var=!var:HidServ.dll=%正常!" 

  443. set "var=!var:helpsvc=%正常!"

  444. set "var=!var:><N>=%正常!"

  445. set "var=!var:System32\WLTRYSVC.EXE=%正常!"

  446. set "var=!var:rundll32.exe=%rundll32.exe 正常!"

  447. set "var=!var:updaterC=%C!"

  448. set "var=!var:WinRAR\rarext.dll=%WinRAR\rarext.dll正常的WinRAR文件!"

  449. echo !var!>>白名单.txt

  450. ) 

  451. setlocal enabledelayedexpansion

  452. for /f "tokens=*" %%i in (白名单.txt) do (

  453. set var=%%i

  454. set "var=!var:状=%正常!"

  455. echo !var!>>分析结果.txt

  456. ) 

  457. (echo ———————————————————————————————————————&echo.)>>分析结果.txt 

  458. (echo 4、用专杀或者修复工具修复以下磁碟机劫持: &echo.)>>分析结果.txt 

  459. 

  460. findstr /li "IFEO" SREngLOG.log >>IFEO.txt

  461. setlocal enabledelayedexpansion

  462. for /f "tokens=*" %%i in (IFEO.txt) do (

  463. set var=%%i

  464. set "var=!var:ntsd=%!" 

  465. set "var=!var:-d=%!"

  466. set "var=!var:IFEO=% [IFEO]    !"

  467. set "var=!var:<=%!"

  468. set "var=!var:>=%!"

  469. echo !var!>>分析结果.txt

  470. )

  471. (echo ———————————————————————————————————————&echo.)>>分析结果.txt 

  472. (echo 5、打开SREng，选择【启动项目】-【服务】-【Win32服务应用程序】，将以下项删除：&echo.)>>分析结果.txt 

  473. findstr /li "missing)" SREngLOG.log >>ff.txt

  474. findstr /li "samservice.exe><>" SREnglog.log>>ff.txt

  475. findstr /li ".dll" 白名单.txt >>ser.txt

  476. findstr /li ".EXE" 白名单.txt >>ser.txt

  477. @findstr /v ".dll" ser.txt >>servers.txt  

  478. @findstr /v ".exe" servers.txt >>N4.txt

  479. @findstr /v "菜单" N4.txt >>N5.txt 

  480. @findstr /v "特权" N5.txt >>ff.txt 

  481. setlocal enabledelayedexpansion

  482. for /f "tokens=*" %%i in (ff.txt) do (

  483. set var=%%i

  484. set "var=!var:Program Files/=%正常!"

  485. echo !var!>>N7.txt

  486. )

  487. @findstr /v "正常" N7.txt>>分析结果.txt 

  488. (echo 6、打开SREng，选择【启动项目】-【服务】-【驱动程序】，将以下项删除：& echo.)>>分析结果.txt

  489. 

  490. findstr /li ".sys" N1.txt>>分析结果.txt

  491. 

  492. findstr /li "tmp" 可疑驱动.txt>>分析结果.txt

  493. (echo ———————————————————————————————————————& echo.)>>分析结果.txt

  494. (echo 7、用“SREng”修复以下【Winsock 提供者】项：& echo.)>>分析结果.txt

  495. findstr /li "(, N/A)" SREngLOG.log >>分析结果.txt

  496. (echo ———————————————————————————————————————& echo.)>>分析结果.txt

  497. (echo 8、用U盘专杀工具查杀【Autorun.inf 】& echo.)>>分析结果.txt

  498. findstr /li "ntldr" SREngLOG.log >b.txt

  499. @more +6 b.txt >>分析结果.txt 

  500. (echo ———————————————————————————————————————& echo.)>>分析结果.txt

  501. (echo 9、用“SREng”修复以下 【hosts文件】项：& echo.)>>分析结果.txt

  502. findstr /li "127.1" SREngLOG.log >>分析结果.txt

  503. (echo ———————————————————————————————————————& echo.)>>分析结果.txt

  504. (echo 10、用“SREng”修复以下【文件关联】项：& echo.)>>分析结果.txt

  505. findstr /li "Error." SREngLOG.log >>分析结果.txt

  506. (echo ———————————————————————————————————————& echo.)>>分析结果.txt

  507. (echo 11、该项可能被修改,请参考系统默认值。& echo.)>>分析结果.txt

  508. findstr /li "<AppInit_DLLs>" SREngLOG.log>>分析结果.txt

  509. findstr /li "<load>" SREngLOG.log>>分析结果.txt

  510. findstr /li "<run>" SREngLOG.log>>分析结果.txt

  511. findstr /li "setup.exe>" SREngLOG.log >>分析结果.txt

  512. findstr /li "<shell>" SREngLOG.log>>分析结果.txt

  513. findstr /li "<Userinit>" SREngLOG.log>>分析结果.txt

  514. findstr /li "<UIHost>" SREngLOG.log>>分析结果.txt

  515. @findstr /v "正常" "分析结果.txt">分析报告.log

  516. (echo ———————————————————————————————————————& echo.)>>分析报告.log

  517. (echo 12、修复完成后，建议用Windows清理助手扫描清除恶意插件。& echo.)>>分析报告.log

  518. findstr /li "ASSIST" SREngLOG.log>>分析报告.log

  519. del /q *.txt

  520. setlocal enabledelayedexpansion

  521. for /f "tokens=*" %%i in (分析报告.log) do (

  522. set var=%%i

  523. set "var=!var:<AppInit_DLLs><>=%正常!"

  524. set "var=!var:<load><>=%正常!"

  525. set "var=!var:<shell><Explorer.exe>=%正常!"

  526. set "var=!var:<Userinit><C:\WINDOWS\system32\userinit.exe,>=%正常!"

  527. set "var=!var:<UIHost><logonui.exe>=%正常!"

  528. set "var=!var:><=%>  <!"

  529. set "var=!var:[NA, ]=%!"

  530. set "var=!var:[]=%!"

  531. set "var=!var:[   SYSTEM]=%!"

  532. set "var=!var:[   Administrator]=%!"

  533. set "var=!var:[N/A, ]=%!"

  534. set "var=!var:hidserv.dll><N/A>=%hidserv.dll><N/A>  <正常的系统服务项>!"

  535. set "var=!var:\SystemRoot\=%!"

  536. set "var=!var:ddd=%!"

  537. set "var=!var:<N/A>=%!"

  538. set "var=!var:<(File is missing)>=%   <服务残留项>!"

  539. set "var=!var:ExplorerC=%C!"

  540. set "var=!var:[ ]=%!"

  541. set "var=!var:ssMgr_ccb=%正常的建设银行U盾程序!" 

  542. set "var=!var:创建文本=%………………………………………………………………………………………………………!"

  543. echo !var!>>报告文件.txt

  544. ) 

  545. @findstr /v "正常" 报告文件.txt>>智能分析报告.txt 

  546. del /q 报告文件.txt

  547. del /q 分析报告.log

  548. start 智能分析报告.txt 

  549. exit
复制代码
收藏 分享

techon

Rank: 2

帖子
95 
积分
115 
技术
4  
捐助
0  
注册时间
2011-4-13 
4楼
发表于 2011-5-24 22:55 | 只看该作者
代码很难简了，大多都是定义黑白名单的代码。。。 可以考虑把可信任文件单独放到一个配置文件里

感觉如果会用Sreng，这个P就是个鸡肋
Sreng有自动将可疑文件复制到一个目录的功能
解释执行的脚本语言与编译语言还是有很大差别的。。。

TOP

batpro

Rank: 2

帖子
71 
积分
137 
技术
2  
捐助
0  
注册时间
2011-5-8 
3楼
发表于 2011-5-24 22:07 | 只看该作者
本帖最后由 batpro 于 2011-5-24 22:09 编辑

提供测试文本文件,测试时请复制到SREnglog.log中，并与bat文件放于同一文件夹中
  1. 2009-04-09,23:02:06

  2. System Repair Engineer 2.7.0.1210

  3. Smallfrogs ([url=http://www.kztechs.com/][color=#0000ff]http://www.KZTechs.com[/color][/url])

  4. Windows XP Professional Service Pack 3 (Build 2600) - 管理权限用户 - 完整功能

  5. 以下内容被选中：

  6.     所有的启动项目（包括注册表、启动文件夹、服务等）

  7.     浏览器加载项

  8.     正在运行的进程（包括进程模块信息）

  9.     文件关联

  10.     Winsock 提供者

  11.     Autorun.inf

  12.     HOSTS 文件

  13.     进程特权扫描

  14.     计划任务

  15.     API HOOK

  16.     隐藏进程

  17. 

  18. 启动项目

  19. 注册表

  20. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

  21.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Infected) Microsoft Corporation]

  22. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

  23.     <load><>  [N/A]

  24. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

  25.     <VMware Tools><C:\Program Files\VMware\VMware Tools\VMwareTray.exe>  [VMware, Inc.]

  26.     <VMware User Process><C:\Program Files\VMware\VMware Tools\VMwareUser.exe>  [VMware, Inc.]

  27.     <EQSysSecure><E:\Program Files\EQSecurePro\EQSysSecure.exe /background>  [EQSecure]

  28.     <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Component Publisher]

  29.     <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Component Publisher]

  30.     <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Component Publisher]

  31. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]

  32.     <config.exe><C:\WINDOWS\khdk0.exe>  []

  33. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

  34.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]

  35.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Component Publisher]

  36. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

  37.     <AppInit_DLLs><>  [N/A]

  38. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

  39.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Component Publisher]

  40. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

  41.     <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [(Verified)Microsoft Windows Component Publisher]

  42. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

  43.     <PostBootReminder><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Windows Component Publisher]

  44.     <CDBurn><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Windows Component Publisher]

  45.     <WebCheck><%SystemRoot%\system32\webcheck.dll>  [(Verified)Microsoft Windows Component Publisher]

  46.     <SysTray><C:\WINDOWS\system32\stobject.dll>  [(Verified)Microsoft Windows Component Publisher]

  47. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]

  48.     <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Windows Component Publisher]

  49. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]

  50.     <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Windows Component Publisher]

  51. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]

  52.     <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Windows Component Publisher]

  53. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy]

  54.     <WinlogonNotify: dimsntfy><%SystemRoot%\System32\dimsntfy.dll>  [(Verified)Microsoft Windows Component Publisher]

  55. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]

  56.     <WinlogonNotify: ScCertProp><wlnotify.dll>  [(Verified)Microsoft Windows Component Publisher]

  57. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]

  58.     <WinlogonNotify: Schedule><wlnotify.dll>  [(Verified)Microsoft Windows Component Publisher]

  59. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]

  60.     <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Windows Component Publisher]

  61. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]

  62.     <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Windows Component Publisher]

  63. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]

  64.     <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Windows Component Publisher]

  65. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]

  66.     <WinlogonNotify: wlballoon><wlnotify.dll>  [(Verified)Microsoft Windows Component Publisher]

  67. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

  68.     <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]

  69.     <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]

  70. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

  71.     <Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP>  [(Verified)Microsoft Windows Component Publisher]

  72. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]

  73.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [File is missing]

  74. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]

  75.     <浏览器自定义组件><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP>  [(Verified)Microsoft Windows Component Publisher]

  76. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]

  77.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [File is missing]

  78. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]

  79.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]

  80. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]

  81.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]

  82. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]

  83.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Component Publisher]

  84. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]

  85.     <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Component Publisher]

  86. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

  87.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]

  88. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]

  89.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]

  90. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]

  91.     <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll>  [(Verified)Microsoft Windows Component Publisher]

  92. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]

  93.     <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe>  [(Verified)Microsoft Windows Component Publisher]

  94. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe]

  95.     <IFEO[360rpt.exe]><C:\WINDOWS\system32\svchost.exe>  [(Verified)Microsoft Windows Component Publisher]

  96. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe]

  97.     <IFEO[360Safe.exe]><C:\WINDOWS\system32\svchost.exe>  [(Verified)Microsoft Windows Component Publisher]

  98. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe]

  99.     <IFEO[360tray.exe]><C:\WINDOWS\system32\svchost.exe>  [(Verified)Microsoft Windows Component Publisher]

  100. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrRtp.exe]

  101.     <IFEO[DrRtp.exe]><C:\WINDOWS\system32\svchost.exe>  [(Verified)Microsoft Windows Component Publisher]

  102. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe]

  103.     <IFEO[QQDoctor.exe]><C:\WINDOWS\system32\svchost.exe>  [(Verified)Microsoft Windows Component Publisher]

  104. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RStray.exe]

  105.     <IFEO[RStray.exe]><C:\WINDOWS\system32\svchost.exe>  [(Verified)Microsoft Windows Component Publisher]

  106. [HKEY_CURRENT_USER\Control Panel\Desktop]

  107.     <SCRNSAVE.EXE><C:\WINDOWS\System32\logon.scr>  [(Verified)Microsoft Windows Component Publisher]

  108. ==================================

  109. 启动文件夹

  110. N/A

  111. ==================================

  112. 服务

  113. [EQService / EQService][Stopped/Auto Start]

  114.   <E:\Program Files\EQSecurePro\EQService.exe><EQSecure>

  115. [Human Interface Device Access / HidServ][Stopped/Disabled]

  116.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>

  117. [VMware Tools Service / VMTools][Running/Auto Start]

  118.   <"C:\Program Files\VMware\VMware Tools\VMwareService.exe"><VMware, Inc.>

  119. ==================================

  120. 驱动程序

  121. [EQSysSecure / EQSysSecure][Running/System Start]

  122.   <\??\C:\WINDOWS\system32\drivers\EQSysSecure.sys><EQSecure>

  123. [Creative AudioPCI (ES1371,ES1373) (WDM) / es1371][Running/Manual Start]

  124.   <system32\drivers\es1371mp.sys><Creative Technology Ltd.>

  125. [hgfs / hgfs][Running/Auto Start]

  126.   <System32\DRIVERS\hgfs.sys><VMware, Inc.>

  127. [AMD PCNET Compatable Adapter Driver / PCnet][Stopped/Manual Start]

  128.   <system32\DRIVERS\pcntpci5.sys><AMD Inc.>

  129. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]

  130.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>

  131. [Secdrv / Secdrv][Stopped/Manual Start]

  132.   <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>

  133. [VMware Pointing Device / vmmouse][Running/Manual Start]

  134.   <system32\DRIVERS\vmmouse.sys><VMware, Inc.>

  135. [vmscsi / vmscsi][Running/Boot Start]

  136.   <\SystemRoot\system32\DRIVERS\vmscsi.sys><VMware, Inc.>

  137. [VMware Ethernet Adapter Driver / vmxnet][Running/Manual Start]

  138.   <system32\DRIVERS\vmxnet.sys><VMware, Inc.>

  139. [vmx_svga / vmx_svga][Running/Manual Start]

  140.   <system32\DRIVERS\vmx_svga.sys><VMware, Inc.>

  141. [zg / zg][Running/Manual Start]

  142.   <2 - 系统找不到指定的文件。

  143. ><N/A>

  144. ==================================

  145. 浏览器加载项

  146. []

  147.   {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, (Signed) N/A>

  148. [Messenger]

  149.   {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, (Signed) Microsoft Corporation>

  150. [9Box Agent Object]

  151.   {49484D63-60FB-4E4E-A400-9092F418CB61} <C:\PROGRA~1\Shutter\9BOX-S~1\NINEBO~1.DLL, (Signed) N/A>

  152. [Shockwave Flash Object]

  153.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, (Signed) Macromedia, Inc.>

  154. []

  155.   {E2E2DD38-D088-4134-82B7-F2BA38496583} <, >

  156. []

  157.   {FB5F1910-F110-11D2-BB9E-00C04F795683} <, >

  158. ==================================

  159. 正在运行的进程

  160. [PID: 364][\SystemRoot\System32\smss.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

  161. [PID: 600][\??\C:\WINDOWS\system32\csrss.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

  162. [PID: 632][\??\C:\WINDOWS\system32\winlogon.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]

  163.     [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]

  164. [PID: 676][C:\WINDOWS\system32\services.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

  165. [PID: 688][C:\WINDOWS\system32\lsass.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]

  166. [PID: 844][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

  167.     [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]

  168. [PID: 928][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

  169.     [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]

  170. [PID: 1032][C:\WINDOWS\System32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

  171.     [C:\WINDOWS\System32\COMRes.dll]  [N/A, ]

  172. [PID: 1152][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

  173. [PID: 1216][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

  174.     [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]

  175. [PID: 1392][C:\WINDOWS\Explorer.EXE]  [(Verified) Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]

  176.     [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]

  177.     [C:\Program Files\VMware\VMware Tools\hook.dll]  [N/A, ]

  178.     [C:\WINDOWS\System32\hgfs.dll]  [N/A, ]

  179.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]

  180.     [C:\DOCUME~1\gz\LOCALS~1\Temp\xunxianqq.dll]  [N/A, ]

  181.     [C:\DOCUME~1\gz\LOCALS~1\Temp\msdfjsadfjd.dat]  [N/A, ]

  182.     [C:\WINDOWS\fonts\ComRes.dll]  [N/A, ]

  183.     [C:\WINDOWS\fonts\gth77327.ttf]  [N/A, ]

  184.     [C:\DOCUME~1\gz\LOCALS~1\Temp\jxinit.dat]  [N/A, ]

  185. [PID: 1884][C:\Program Files\VMware\VMware Tools\VMwareService.exe]  [VMware, Inc., 5.5.2 build-29772]

  186.     [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

  187. [PID: 228][C:\WINDOWS\System32\alg.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]

  188.     [C:\WINDOWS\System32\COMRes.dll]  [N/A, ]

  189. [PID: 432][C:\Program Files\VMware\VMware Tools\VMwareTray.exe]  [VMware, Inc., 5.5.2 build-29772]

  190.     [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

  191.     [C:\Program Files\VMware\VMware Tools\VMControlPanel.cpl]  [VMware, Inc., 5.5.2 build-29772]

  192.     [C:\DOCUME~1\gz\LOCALS~1\Temp\xunxianqq.dll]  [N/A, ]

  193.     [C:\DOCUME~1\gz\LOCALS~1\Temp\msdfjsadfjd.dat]  [N/A, ]

  194. [PID: 440][C:\Program Files\VMware\VMware Tools\VMwareUser.exe]  [VMware, Inc., 5.5.2 build-29772]

  195.     [C:\Program Files\VMware\VMware Tools\hook.dll]  [N/A, ]

  196.     [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

  197.     [C:\DOCUME~1\gz\LOCALS~1\Temp\xunxianqq.dll]  [N/A, ]

  198.     [C:\DOCUME~1\gz\LOCALS~1\Temp\msdfjsadfjd.dat]  [N/A, ]

  199. [PID: 536][C:\WINDOWS\system32\ctfmon.exe]  [(Infected) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]

  200.     [C:\DOCUME~1\gz\LOCALS~1\Temp\xunxianqq.dll]  [N/A, ]

  201.     [C:\DOCUME~1\gz\LOCALS~1\Temp\msdfjsadfjd.dat]  [N/A, ]

  202.     [C:\DOCUME~1\gz\LOCALS~1\Temp\jxinit.dat]  [N/A, ]

  203.     [C:\WINDOWS\system32\704C3595.dll]  [N/A, ]

  204. [PID: 1560][C:\WINDOWS\system32\gr.exe]  [N/A, ]

  205.     [C:\DOCUME~1\gz\LOCALS~1\Temp\xunxianqq.dll]  [N/A, ]

  206.     [C:\DOCUME~1\gz\LOCALS~1\Temp\msdfjsadfjd.dat]  [N/A, ]

  207.     [C:\DOCUME~1\gz\LOCALS~1\Temp\jxinit.dat]  [N/A, ]

  208. [PID: 1580][C:\Program Files\Microsoft Office\SYSTEM\sysbar.exe]  [N/A, ]

  209.     [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]

  210.     [C:\DOCUME~1\gz\LOCALS~1\Temp\xunxianqq.dll]  [N/A, ]

  211.     [C:\DOCUME~1\gz\LOCALS~1\Temp\msdfjsadfjd.dat]  [N/A, ]

  212.     [C:\DOCUME~1\gz\LOCALS~1\Temp\jxinit.dat]  [N/A, ]

  213. [PID: 1668][C:\WINDOWS\khdk0.exe]  [N/A, ]

  214.     [C:\DOCUME~1\gz\LOCALS~1\Temp\xunxianqq.dll]  [N/A, ]

  215.     [C:\Program Files\VMware\VMware Tools\hook.dll]  [N/A, ]

  216.     [C:\DOCUME~1\gz\LOCALS~1\Temp\msdfjsadfjd.dat]  [N/A, ]

  217. [PID: 1824][C:\program files\internet explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]

  218.     [C:\WINDOWS\system32\COMRes.dll]  [N/A, ]

  219.     [C:\DOCUME~1\gz\LOCALS~1\Temp\xunxianqq.dll]  [N/A, ]

  220.     [C:\DOCUME~1\gz\LOCALS~1\Temp\msdfjsadfjd.dat]  [N/A, ]

  221.     [C:\DOCUME~1\gz\LOCALS~1\Temp\jxinit.dat]  [N/A, ]

  222.     [C:\WINDOWS\system32\704C3595.dll]  [N/A, ]

  223. [PID: 2036][E:\Tools\sreng2\SREngLdr.EXE]  [Smallfrogs Studio, 2.7.0.1210]

  224. [PID: 2044][E:\Tools\sreng2\SRE7677f6e6.EXE]  [Smallfrogs Studio, 2.7.0.1210]

  225.     [C:\DOCUME~1\gz\LOCALS~1\Temp\xunxianqq.dll]  [N/A, ]

  226.     [C:\Program Files\VMware\VMware Tools\hook.dll]  [N/A, ]

  227.     [E:\Tools\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

  228.     [C:\DOCUME~1\gz\LOCALS~1\Temp\msdfjsadfjd.dat]  [N/A, ]

  229.     [C:\WINDOWS\fonts\ComRes.dll]  [N/A, ]

  230.     [C:\WINDOWS\fonts\gth77327.ttf]  [N/A, ]

  231.     [C:\DOCUME~1\gz\LOCALS~1\Temp\jxinit.dat]  [N/A, ]

  232.     [C:\WINDOWS\system32\704C3595.dll]  [N/A, ]

  233. ==================================

  234. 文件关联

  235. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]

  236. .EXE  OK. ["%1" %*]

  237. .COM  OK. ["%1" %*]

  238. .PIF  OK. ["%1" %*]

  239. .REG  OK. [regedit.exe "%1"]

  240. .BAT  OK. ["%1" %*]

  241. .SCR  OK. ["%1" /S]

  242. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]

  243. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]

  244. .INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

  245. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

  246. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

  247. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

  248. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]

  249. ==================================

  250. Winsock 提供者

  251. N/A

  252. ==================================

  253. Autorun.inf

  254. N/A

  255. ==================================

  256. HOSTS 文件

  257. 127.0.0.1       localhost

  258. ==================================

  259. 进程特权扫描

  260. 特殊特权被允许： SeLoadDriverPrivilege [PID = 432, C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\VMWARETRAY.EXE]

  261. 特殊特权被允许： SeLoadDriverPrivilege [PID = 440, C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\VMWAREUSER.EXE]

  262. 特殊特权被允许： SeLoadDriverPrivilege [PID = 536, C:\WINDOWS\SYSTEM32\CTFMON.EXE]

  263. 特殊特权被允许： SeDebugPrivilege [PID = 1560, C:\WINDOWS\SYSTEM32\GR.EXE]

  264. 特殊特权被允许： SeLoadDriverPrivilege [PID = 1560, C:\WINDOWS\SYSTEM32\GR.EXE]

  265. 特殊特权被允许： SeLoadDriverPrivilege [PID = 1580, C:\PROGRAM FILES\MICROSOFT OFFICE\SYSTEM\SYSBAR.EXE]

  266. 特殊特权被允许： SeDebugPrivilege [PID = 1668, C:\WINDOWS\KHDK0.EXE]

  267. 特殊特权被允许： SeLoadDriverPrivilege [PID = 1668, C:\WINDOWS\KHDK0.EXE]

  268. 特殊特权被允许： SeLoadDriverPrivilege [PID = 2036, E:\TOOLS\SRENG2\SRENGLDR.EXE]

  269. ==================================

  270. 计划任务

  271. N/A

  272. ==================================

  273. API HOOK

  274. N/A

  275. ==================================

  276. 隐藏进程

  277. N/A

  278. ==================================
复制代码

TOP

batpro

Rank: 2

帖子
71 
积分
137 
技术
2  
捐助
0  
注册时间
2011-5-8 
2楼
发表于 2011-5-24 22:05 | 只看该作者
本帖最后由 batpro 于 2011-5-24 22:10 编辑

1# batpro


请求专家帮忙找问题，文本处理我不太懂，复制代码后请修改为.bat文件

能不能精简代码，但不精简功能
原创首次发表于 http://bbs.kafan.cn/thread-973790-1-1.html

TOP

返回列表