VBScript之通过对比注册表查找隐藏的服务-巨人网络通讯

主页 > 知识库 > VBScript之通过对比注册表查找隐藏的服务

VBScript之通过对比注册表查找隐藏的服务

效果图：

代码（checksvr.vbs）：

复制代码代码如下:

'On Error Resume Next

Const HKEY_LOCAL_MACHINE = H80000002

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")

strKeyPath = "SYSTEM\CurrentControlSet\Services"
oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys

Wscript.Echo "Checking, please wait ..."
Wscript.Echo ""

For Each subkey In arrSubKeys
oReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath "\\" subkey, "ObjectName", strValue

If Not (strValue = "") Then
  '判断服务, 利用数组来比较不知道会不会快些？
  If Not (CheckSvr(subkey)) Then
   Wscript.Echo subkey FormatOutTab(subkey) strValue FormatOutTab(strValue) "[ Hidden ]"
  Else
   Wscript.Echo subkey FormatOutTab(subkey) strValue FormatOutTab(strValue) "[   OK   ]"
  End If

End If
Next
Wscript.Echo ""
Wscript.Echo "All done."
Wscript.Quit (0)

Function CheckSvr(strName)
Set oWMI = GetObject("winmgmts:" "{impersonationLevel=impersonate}!\\.\root\cimv2")
Set cService = oWMI.ExecQuery("Select * from Win32_Service WHERE Name='" strName "'")
If (cService.count > 0) Then
CheckSvr = True
Else
CheckSvr = False
End If
End Function

Function FormatOutTab(strName)
strLen = Len(strName)
Select Case True
  Case strLen 8
   FormatOutTab = vbTab vbTab vbTab vbTab vbTab

  Case strLen 16
   FormatOutTab = vbTab vbTab vbTab vbTab

  Case strLen 24
   FormatOutTab = vbTab vbTab vbTab

  Case strLen 32
   FormatOutTab = vbTab vbTab

  Case strLen 40
   FormatOutTab = vbTab

  Case Else
   FormatOutTab = vbTab
  End Select
End Function

利用字典，速度要快很多：

复制代码代码如下:

Dim oDic, oReg, oWmi, arrServices
Const HKEY_LOCAL_MACHINE = H80000002

Wscript.Echo "[*] Checking, please wait ..."
Wscript.Echo ""

Set oDic = CreateObject("Scripting.Dictionary")

Set oWmi = GetObject("winmgmts:" "{impersonationLevel=impersonate}!\\.\root\cimv2")
Set arrServices = oWmi.ExecQuery("Select * from Win32_Service")
For Each strService In arrServices
oDic.Add strService.Name, strService.Name
Next

Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
strKeyPath = "SYSTEM\CurrentControlSet\Services"
oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys

For Each subkey In arrSubKeys
oReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath "\\" subkey, "ObjectName", strValue
If Not (strValue = "") Then
  If oDic.Exists(subkey) Then
   Wscript.Echo subkey FormatOutTab(subkey) strValue FormatOutTab(strValue) "[   OK   ]"
  Else
   Wscript.Echo subkey FormatOutTab(subkey) strValue FormatOutTab(strValue) "[ Hidden ]"
  End If
End If
Next

oDic.RemoveAll

Wscript.Echo ""
Wscript.Echo "[*] All done."
Wscript.Quit (0)

Function FormatOutTab(strName)
strLen = Len(strName)
Select Case True
  Case strLen 8
   FormatOutTab = vbTab vbTab vbTab vbTab

  Case strLen 16
   FormatOutTab = vbTab vbTab vbTab

  Case strLen 24
   FormatOutTab = vbTab vbTab

Case strLen 32
FormatOutTab = vbTab

  Case Else
   FormatOutTab = vbTab
  End Select
End Function

来自： enun.net

标签：鹤壁四平铜川西安湖州文山邢台海口

巨人网络通讯声明：本文标题《VBScript之通过对比注册表查找隐藏的服务》，本文关键词 VBScript,之,通过,对比,注册表,；如发现本文内容存在版权问题，烦请提供相关信息告之我们，我们将及时沟通与处理。本站内容系统采集于网络，涉及言论、版权与本站无关。