中国DOS联盟

思路是先用TASKLIST /M列出所有进程调用的DLL，接着，用命令获取DLL的详细路径，并赋予给%%A

希望各位帮忙写出来，本人能力有限。

我希望能用系统自带命令实现，不依靠外部工具，希望各位帮忙实现！

收集自网络。保存为 .vbs 文件。

' FileName: ProcessMagnifier.vbs 

' Function: Capture information about the running processes in detail 

' code by somebody 

' QQ: 240460440 

' LastModified:2007-11-16 18:25 

' 仅供学习 

Const HKEY_CURRENT_USER = &H80000001 

Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv") 

strKeyPath = "Console\%SystemRoot%_system32_cmd.exe" 

oReg.CreateKey HKEY_CURRENT_USER, strKeyPath

strValueName1 = "CodePage" 

dwValue1 = 936 

strValueName2 = "ScreenBufferSize" 

dwValue2 = 98304200 

strValueName3 = "WindowSize" 

dwValue3 = 2818173 

strValueName4 = "HistoryNoDup" 

dwValue4 = 0 

strValueName5 = "WindowPosition" 

dwValue5 = 131068 

strValueName6 = "QuickEdit" 

dwValue6 = 2048 

oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName1, dwValue1

oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName2, dwValue2 

oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName3, dwValue3 

oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName4, dwValue4 

oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName5, dwValue5 

oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName6, dwValue6 



Dim objWSH, FinalPath 

Set objWSH = WScript.CreateObject("WScript.Shell") 

If (LCase(Right(WScript.Fullname, 11)) = "wscript.exe") Then 

FinalPath = "'" & WScript.ScriptFullName & "'" 

objWSH.Run("cmd.exe /k cscript //nologo " & Replace(FinalPath, "'", """")) 

WScript.Quit() 

End If 

oReg.DeleteKey HKEY_CURRENT_USER, strKeyPath 

Set oReg = Nothing 

WScript.Echo() 

WScript.Sleep(1000) 

WScript.Echo("当前正在运行的进程简要信息列表如下:") 

WScript.Echo(vbCrLf) 

WScript.Sleep(2000) 

Dim MyOBJProcessName 

Set OBJWMIProcess = GetObject("winmgmts:\\.\root\cimv2").ExecQuery("Select * From Win32_Process") 

WScript.Echo "Name: Priority: PID: Owner:" &vbTab&vbTab&"ExecutablePath: " 

WScript.Echo("---------------------------------------------------------------------------------------") 

For Each OBJProcess In OBJWMIProcess 

MyOBJProcessName=OBJProcess.Name&" " 

colProperties = OBJProcess.GetOwner(strNameOfUser, strUserDomain) 

WScript.Echo Mid(MyOBJProcessName,1,20) &vbTab& OBJProcess.Priority &vbTab& OBJProcess.ProcessID &vbTab& strNameOfUser &vbTab&vbTab& OBJProcess.ExecutablePath 

Next 

WScript.Sleep(5000) 

WScript.Echo(vbCrLf) 

WScript.Echo("当前正在运行的进程以及其加载的模块详细信息树状结构如下:") 

WScript.Echo(vbCrLf) 

WScript.Sleep(3000) 

WScript.Echo vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab& vbTab&"创建时间 文件制造商" 

Set OBJWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2") 

Set OBJRefresher = CreateObject("WbemScripting.SWbemRefresher") 

Set colItems = OBJRefresher.AddEnum(OBJWMIService, "Win32_PerfFormattedData_PerfProc_FullImage_Costly").ObjectSet 

OBJRefresher.Refresh() 

For Each OBJItem In colItems 

Dim originalPath, ModulePath, WMIPathMode, FileManufacturer, LCaseModulePath 

Dim FileExtension, mark, MyLCaseModulePath, FinalModulePath 

originalPath = OBJItem.Name 

ModulePath = Split(originalPath, "/") 

WMIPathMode = Replace(ModulePath(1), "\", "\\") 

Set OBJWMI = GetObject("winmgmts:\\.\root\CIMV2") 

Set colManufacturer = OBJWMI.ExecQuery("SELECT * FROM CIM_DataFile Where Name='" & WMIPathMode & "'") 

For Each OBJManufacturer In colManufacturer 

FileManufacturer = Trim(OBJManufacturer.Manufacturer) 

LCaseModulePath = LCase(Trim(OBJManufacturer.Name)) 

FileExtension = Right(LCaseModulePath, 3) 

MyLCaseModulePath = LCaseModulePath & " " 

Set FSO = CreateObject("Scripting.FileSystemObject").GetFile(LCaseModulePath) 

If FileExtension = "exe" Then 

mark = "├—" 

FinalModulePath = Mid(MyLCaseModulePath, 1, 118) 

WScript.Echo("│") 

WScript.Echo("│") 

Else 

mark = "│  ├─" 

FinalModulePath = Mid(MyLCaseModulePath, 1, 116) 

End If 

WScript.Echo mark & FinalModulePath & FSO.DateCreated &vbTab& FileManufacturer 

Next 

Next 

呵呵，感谢兄弟，用的WMIC哈，呵呵，学习了！感谢分享！~

期待有P处理调用WMIC实现的版本出现。

Originally posted by luckboy45 at 2009-10-17 18:10:
呵呵，感谢兄弟，用的WMIC哈，呵呵，学习了！感谢分享！~

期待有P处理调用WMIC实现的版本出现。

试试wmic path Win32_PerfFormattedData_PerfProc_FullImage_Costly 或 wmic class Win32_PerfFormattedData_PerfProc_FullImage_Costly能得到什么结果。
我这里装的GHOST版的XP没用，包括以前用vbs写的都执行错误。