中国DOS联盟

最近电脑老中毒
希望有VBS或批处理可以发现其他非系统进程并关闭

可以将指定进程以外的所有进程关闭终止并删除.

列一个包含主要进程的文件

然后for读取tasklist里的进程名在文件在查找,找不到就杀掉

Originally posted by zerocq at 2008-2-13 10:48 PM:
列一个包含主要进程的文件

然后for读取tasklist里的进程名在文件在查找,找不到就杀掉

这个好象有
但是我想把把系统
进程写入个文档
然后FOR查找文挡上没有的进程怎么把他结束并删除文件
怎么写?

小心用哦,指定进程一定要添加好哦,否则不要怪我.

@echo off
@echo System>1w.txt
@echo smss.exe>>1w.txt
@echo csrss.exe>>1w.txt
@echo winlogon.exe>>1w.txt
@echo services.exe>>1w.txt
@echo lsass.exe>>1w.txt
@echo svchost.exe>>1w.txt
@echo alg.exe>>1w.txt
@echo dllhost.exe>>1w.txt
@echo explorer.exe>>1w.txt
@echo ctfmon.exe>>1w.txt
@echo conime.exe>>1w.txt
@echo wmiprvse.exe>>1w.txt
@echo dllhost.exe>>1w.txt
@echo wuauclt.exe>>1w.txt
@echo notepad.exe>>1w.txt
@echo tasklist.exe>>1w.txt
@echo cmd.exe>>1w.txt
@echo ShadowTip.exe>>1w.txt
@echo ShadowService.exe>>1w.txt
::显示指定进程以外的进程
cd.>2w.txt
for /f %%i in (1w.txt) do SET %%i=A
for /f %%i in ('tasklist /NH') do if /I not defined %%i echo %%i>>2w.txt
::获取指定进程以外进程的PID号
tasklist /NH>3w.txt
cd.>4w.txt
for /f %%i in (2w.txt) do findstr /i /r /c:"\<%%i\>" 3w.txt>>4w.txt
cd.>55.txt
for /f "tokens=2 delims= " %%i in (4w.txt) do @echo %%i>>55.txt
del 1w.txt
del 2w.txt
del 3w.txt
del 4w.txt
::按PID号自动终止进程
for /f %%i in (55.txt) do (
ntsd -c q -p "%%i"
Attrib -r -h -a -s "%%i"
del /q /f /a "%%i"
)
del 55.txt

这样行不?只终止 没写删除
@echo off
for /f "tokens=1 delims=," %%i in ('tasklist /nh /FO CSV') do (
find /i %%i 系统进程文档
if errorlevel 1 taskkill /f /im %%i
)
pause

[ Last edited by terse on 2008-2-14 at 02:07 PM ]