效果图：
代码（checksvr.vbs）：
复制代码 代码如下:
'On Error Resume Next
Const HKEY_LOCAL_MACHINE = &H80000002
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
strKeyPath = "SYSTEM\CurrentControlSet\Services"
oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys
Wscript.Echo "Checking, please wait ..."
Wscript.Echo ""
For Each subkey In arrSubKeys
oReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & "\\" & subkey, "ObjectName", strValue
If Not (strValue = "") Then
'判断服务, 利用数组来比较不知道会不会快些？
If Not (CheckSvr(subkey)) Then
Wscript.Echo subkey & FormatOutTab(subkey) & strValue & FormatOutTab(strValue) & "[ Hidden ]"
Else
Wscript.Echo subkey & FormatOutTab(subkey) & strValue & FormatOutTab(strValue) & "[ OK ]"
End If
End If
Next
Wscript.Echo ""
Wscript.Echo "All done."
Wscript.Quit (0)
Function CheckSvr(strName)
Set oWMI = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
Set cService = oWMI.ExecQuery("Select * from Win32_Service WHERE Name='" & strName & "'")
If (cService.count <> 0) Then
CheckSvr = True
Else
CheckSvr = False
End If
End Function
Function FormatOutTab(strName)
strLen = Len(strName)
Select Case True
Case strLen < 8
FormatOutTab = vbTab & vbTab & vbTab & vbTab & vbTab
Case strLen < 16
FormatOutTab = vbTab & vbTab & vbTab & vbTab
Case strLen < 24
FormatOutTab = vbTab & vbTab & vbTab
Case strLen < 32
FormatOutTab = vbTab & vbTab
Case strLen < 40
FormatOutTab = vbTab
Case Else
FormatOutTab = vbTab
End Select
End Function
利用字典，速度要快很多：
复制代码 代码如下:
Dim oDic, oReg, oWmi, arrServices
Const HKEY_LOCAL_MACHINE = &H80000002
Wscript.Echo "[*] Checking, please wait ..."
Wscript.Echo ""
Set oDic = CreateObject("Scripting.Dictionary")
Set oWmi = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\root\cimv2")
Set arrServices = oWmi.ExecQuery("Select * from Win32_Service")
For Each strService In arrServices
oDic.Add strService.Name, strService.Name
Next
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
strKeyPath = "SYSTEM\CurrentControlSet\Services"
oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys
For Each subkey In arrSubKeys
oReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & "\\" & subkey, "ObjectName", strValue
If Not (strValue = "") Then
If oDic.Exists(subkey) Then
Wscript.Echo subkey & FormatOutTab(subkey) & strValue & FormatOutTab(strValue) & "[ OK ]"
Else
Wscript.Echo subkey & FormatOutTab(subkey) & strValue & FormatOutTab(strValue) & "[ Hidden ]"
End If
End If
Next
oDic.RemoveAll
Wscript.Echo ""
Wscript.Echo "[*] All done."
Wscript.Quit (0)
Function FormatOutTab(strName)
strLen = Len(strName)
Select Case True
Case strLen < 8
FormatOutTab = vbTab & vbTab & vbTab & vbTab
Case strLen < 16
FormatOutTab = vbTab & vbTab & vbTab
Case strLen < 24
FormatOutTab = vbTab & vbTab
Case strLen < 32
FormatOutTab = vbTab
Case Else
FormatOutTab = vbTab
End Select
End Function
来自： enun.net
本文由 华域联盟 原创撰写：华域联盟 » VBScript之通过对比注册表查找隐藏的服务
转载请保留出处和原文链接：https://www.cnhackhy.com/16484.htm
