中国DOS联盟

@echo off&setlocal EnableDelayedexpansion

::查询指定端口对应的模块


if exist C:\WINDOWS\system32\sysdll.dat goto getport
if exist sysdll.dat (
	copy "%cd%\sysdll.dat" c:\windows\system32 >nul 2>nul
) else (
	echo 丢失 sysdll.dat.
	pause
	exit
	)
pushd C:\WINDOWS\system32

:getport
cls
set port=
set /p port=请输入查询端口:
echo %port%|findstr "^[0-9]*$" >nul ||(echo 输入错误,任意键返回&pause>nul&goto getport)

set /a num1=0
echo.&echo 正在查询端口 !port! 对应所有模块...
set port=:%port%
for /f "delims= " %%i in ('netstat -abn ^| find /i /n "!port!"') do (
		set line=%%i
                for /l %%k in (1,1,6) do (
			if "!line:~%%k,1!"=="]" (call :linenum !num1!&goto processname) else (set /a num1+=1)
		 	)		
	)

echo.&echo [+e]查询结束.&pause>nul


:linenum
set line=!line:~1,%1!
goto :eof

:processname
for /f "delims= " %%j in ('netstat -abn ^| more +!line!') do (		
		if "%%j"=="UDP" tasklist /M /FI "IMAGENAME EQ !process!"&goto judge
		if "%%j"=="TCP" tasklist /M /FI "IMAGENAME EQ !process!"&goto judge		
		set process=%%j
		set process=!process:~1,-1!
)
echo.&echo 查询成功结束.
goto :eof


:judge
set /a num=0
set delfile=
set /p delfile=删除该进程挂载的可疑文件吗(Y/N):
if "%delfile%"=="" goto judge
if NOT "%delfile%"=="y" (
	if NOT "%delfile%"=="Y" goto exit0
		)
color 1F 
echo.
echo 结束该进程 : taskkill /f /IM !process!
echo 模拟删除可疑文件中(并不真正任何文件,但没在文件名库中的文件会被列出来)...

:compare1
set /a flagd=0
for /f "skip=3 tokens=1,2,3 delims=," %%M in ('tasklist /M /FI "IMAGENAME EQ !process!"') do (
	set /a flagn=0
	set /a flago=0
	if !num! EQU 0 (
		set tmp12=%%n
		set /a num+=1 
		) else (
		if "%%n"=="!tmp12!" (
			goto compare2
			) else (
				for /f "skip=1 delims= " %%k in (sysdll.dat) do (
				if /I "%%k"=="%%~nN" set /a flagn=1 
				if /I "%%k"=="%%~nO" set /a flago=1 
				)
				if !flagn! EQU 0 (
					echo 可疑文件%%N 
					set /a flagd=1
					)
				if !flago! EQU 0 (
					echo 可疑文件%%O
					set /a flagd=1
					)
				)
			)
		)

:compare2

for /f "skip=3 tokens=1,2,3 delims=, " %%M in ('tasklist /M /FI "IMAGENAME EQ !process!"') do (
	set /a flag=0
	for /f "skip=1 delims= " %%k in (sysdll.dat) do (				
				if /I "%%k"=="%%~nM" set /a flag=1 
					)
				echo %%~nM !flag!
				if !flag! EQU 0 (
					echo 可疑文件%%M 
					set /a flagd=1
					)
		)
if !flagd! EQU 0 (echo 没有删除任何文件，该程序可能是合法程序.) else (echo 已删除指定程序及相关可疑文件.)

pause>nul
goto :eof

:exit0
echo 按任意键退出.
pause>nul
goto :eof