系統(tǒng)服務(wù)有可能被 rootkit 隱藏，但有些時候我們?nèi)钥梢詮淖员碇姓业较嚓P(guān)的信息。建議以管理員權(quán)限運(yùn)行，否則有些服務(wù)列舉不出來或出現(xiàn)錯誤的提示

效果圖：

代碼（checksvr.vbs）：

代碼如下:

'On Error Resume Next

Const HKEY_LOCAL_MACHINE = &H80000002

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")

strKeyPath = "SYSTEM\CurrentControlSet\Services"

oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys

Wscript.Echo "Checking, please wait ..."

Wscript.Echo ""

For Each subkey In arrSubKeys

oReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & "\\" & subkey, "ObjectName", strValue

If Not (strValue = "") Then

'判斷服務(wù), 利用數(shù)組來比較不知道會不會快些？

If Not (CheckSvr(subkey)) Then

Wscript.Echo subkey & FormatOutTab(subkey) & strValue & FormatOutTab(strValue) & "[ Hidden ]"

Else

Wscript.Echo subkey & FormatOutTab(subkey) & strValue & FormatOutTab(strValue) & "[ OK ]"

End If

End If

Next

Wscript.Echo ""

Wscript.Echo "All done."

Wscript.Quit (0)

Function CheckSvr(strName)

Set oWMI = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")

Set cService = oWMI.ExecQuery("Select * from Win32_Service WHERE Name='" & strName & "'")

If (cService.count <> 0) Then

CheckSvr = True

Else

CheckSvr = False

End If

End Function

Function FormatOutTab(strName)

strLen = Len(strName)

Select Case True

Case strLen < 8

FormatOutTab = vbTab & vbTab & vbTab & vbTab & vbTab

Case strLen < 16

FormatOutTab = vbTab & vbTab & vbTab & vbTab

Case strLen < 24

FormatOutTab = vbTab & vbTab & vbTab

Case strLen < 32

FormatOutTab = vbTab & vbTab

Case strLen < 40

FormatOutTab = vbTab

Case Else

FormatOutTab = vbTab

End Select

End Function

利用字典，速度要快很多：

復(fù)制代碼 代碼如下:

Dim oDic, oReg, oWmi, arrServices

Const HKEY_LOCAL_MACHINE = &H80000002

Wscript.Echo "[*] Checking, please wait ..."

Wscript.Echo ""

Set oDic = CreateObject("Scripting.Dictionary")

Set oWmi = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")

Set arrServices = oWmi.ExecQuery("Select * from Win32_Service")

For Each strService In arrServices

oDic.Add strService.Name, strService.Name

Next

Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")

strKeyPath = "SYSTEM\CurrentControlSet\Services"

oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys

For Each subkey In arrSubKeys

oReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & "\\" & subkey, "ObjectName", strValue

If Not (strValue = "") Then

If oDic.Exists(subkey) Then

Wscript.Echo subkey & FormatOutTab(subkey) & strValue & FormatOutTab(strValue) & "[ OK ]"

Else

Wscript.Echo subkey & FormatOutTab(subkey) & strValue & FormatOutTab(strValue) & "[ Hidden ]"

End If

End If

Next

oDic.RemoveAll

Wscript.Echo ""

Wscript.Echo "[*] All done."

Wscript.Quit (0)

Function FormatOutTab(strName)

strLen = Len(strName)

Select Case True

Case strLen < 8

FormatOutTab = vbTab & vbTab & vbTab & vbTab

Case strLen < 16

FormatOutTab = vbTab & vbTab & vbTab

Case strLen < 24

FormatOutTab = vbTab & vbTab

Case strLen < 32

FormatOutTab = vbTab

Case Else

FormatOutTab = vbTab

End Select

End Function

更多信息請查看IT技術(shù)專欄