自制控制进程和控制开机启动项批处理(ntsd强制结束版)

发布时间：2014-05-12 21:32:45作者：知识屋

自动结束强制智能结束.vbs

vbs主要起到运行bat的目地，传参

复制代码代码如下:

set wshshell=createobject("wscript.shell")
wshshell.run "针对性进程管理.bat"
wscript.sleep 2000

for x=1 to 30
wscript.sleep 1000
wshshell.sendkeys "{enter 3}"
next

针对性进程管理.bat

复制代码代码如下:

	
	@echo off&setlocal enabledelayedexpansion

	ping -n 3 127.0>nul

	if exist tem.txt del /f /q tem.txt

	echo.正在刷选进程.............

	echo>>tem.txt explorer.exe

	echo>>tem.txt System Idle Process

	echo>>tem.txt System

	echo>>tem.txt smss.exe

	echo>>tem.txt csrss.exe

	echo>>tem.txt winlogon.exe

	echo>>tem.txt services.exe

	echo>>tem.txt TheWorld.exe

	echo>>tem.txt lsass.exe

	echo>>tem.txt svchost.exe

	echo>>tem.txt spoolsv.exe

	echo>>tem.txt alg.exe

	echo>>tem.txt ctfmon.exe

	echo>>tem.txt ekrn.exe

	echo>>tem.txt wdfmgr.exe

	echo>>tem.txt 360tray.exe

	echo>>tem.txt egui.exe

	echo>>tem.txt wmiprvse.exe

	echo>>tem.txt QQ.exe

	echo>>tem.txt cmd.exe

	echo>>tem.txt IEXPLORE.EXE

	echo>>tem.txt TXPlatform.exe

	echo>>tem.txt tasklist.exe

	echo>>tem.txt conime.exe

	echo>>tem.txt safeboxTray.exe

	echo>>tem.txt wscript.exe

	for /f "eol= tokens=1,2 delims=," %%i in ('tasklist /nh /fo csv') do (

	findstr /i /x %%i tem.txt >nul

	if errorlevel 1 (

	echo =============================================================

	echo =============================================================

	echo %%i位于以下路径

	wmic process where processid=%%j get executablepath|findstr /v /i "executablepath"

	ntsd -c q -p %%j 1>nul 2>nul

	ping -n 1 127.0>nul 

	tasklist|findstr /i %%i >nul

	if errorlevel 1 (

	echo %%i已经完全成功结束

	) else (

	echo %%i未能完全结束，估计是个流氓程序

	)

	)

	)

	del tem.txt & echo 结束进程任务基本完成

	taskkill /f /im wscript.exe

	mshta vbscript:msgbox("我的任务完成了！请看详细信息",,"刷选进程")(window.close)

	taskkill /f /im cmd.exe