??xml version="1.0" encoding="utf-8" standalone="yes"?>
]]>
SETLOCAL EnableDelayedExpansion
DEL /F /Q picture.txt 2>NUL
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 原理Q?br />::
:: 一般情况下Q有EXIF信息的照片,会有三处旉Q当然还有特例)Q第一处格式ؓQ?br />::
:: 2001:01:01 02:04:18
::
:: W二、第三处是在一LQ中间有个NULL|如下Q?br />::
:: 2001:01:01 02:04:18[NULL]2001:01:01 02:04:18
::
:: 我通过WindowsXP和ACDSee8分析了很多张囄Q发现第一处的旉很可能有误,
::
:: 也就是说QWindowsXP和ACDSee8实际使用的应该是W二或第三处的时_
::
:: 使用W二处的旉?br />::
::
:: 注意Q?br />::
:: 1、有些h喜欢把一些秘密藏在图片中Q而秘密有可能包含旉Q所以,可能有问题,
::
:: 不过Q这U情况好像很?
::
:: 2、由于FINDSTR.EXE命o的局限性(q真正的正则表辑ּQ,错误是难免的?br />::
::
:: 另外Q?br />::
:: 1、开始我?.jpeg也列入查找,但发?.jpe可以搜烦?.jpegQ只好剔?.jpeg?br />::
:: 2、我讨厌ACDSee8重命名时Q把2001-01-01 02-01-19Ҏ2001-01-01 2-1-19Q不好看Q?br />::
:: 3、其实我写这个的目的是修改囄名称为照相时_剩下的以后写
::
::
:: Author: NeedJava
::
:: Modified: 2007-08-15/2007-08-24/2007-08-25
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
FOR /R %%a IN ( *.jpg *.jpe *.jfif *.tif ) DO (
CLS
ECHO 正在处理?%%a!?/font>
SET "final=NULL"
IF "!final!"=="NULL" (
SET /A times=0
FOR /F "delims=" %%i IN ( 'FINDSTR.EXE "200 199 201 202" "%%a" 2^>NUL ^| MORE 2^>NUL ^| FINDSTR.EXE /R "\<[1-2][0-9][0-9][0-9][:][0-1][0-9][:][0-3][0-9] [0-2][0-9][:][0-5][0-9][:][0-5][0-9]\>" 2^>NUL' ) DO (
SET /A times+=1
IF !times! EQU 2 (
SET "parse=%%i"
IF "!parse:~-3,1!"==":" IF "!parse:~-9,1!"==" " (
SET "parse=!parse:~-19!"
ECHO Found [!parse!]
FOR /F "tokens=1,2,3,4,5,6 delims=: " %%A IN ( "!parse!" ) DO (
SET "final=%%A-%%B-%%C %%D-%%E-%%F"
)
)
)
)
)
IF "!final!"=="NULL" (
FOR /F "delims=" %%i IN ( 'FINDSTR.EXE /I "DateTimeOriginal" "%%a" 2^>NUL' ) DO (
SET "parse=%%i"
IF /I "!parse:~-24,7!"=="</exif:" IF "!parse:~-30,1!"=="+" (
SET "parse=!parse:~-49,19!"
ECHO Found [!parse!]
FOR /F "tokens=1,2,3,4,5,6 delims=-:T" %%A IN ( "!parse!" ) DO (
SET "final=%%A-%%B-%%C %%D-%%E-%%F"
)
)
)
)
IF NOT "!final!"=="NULL" (
ECHO Parse [!final!]
ECHO [%%~nxa]>>picture.txt
ECHO !final!>>picture.txt
ECHO;>>picture.txt
)
)
GOTO :EOF
@ECHO ON
剩下的就是改名了Q由于要防备同名Q也是一U内拍了两三张这L情况Q所以需要追加数字序?br />
SETLOCAL EnableDelayedExpansion
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 需要区别FAT32和NTFS格式下的回收?br />::
:: FAT32回收站结构如下:
::
:: [Recycled]
:: desktop.ini
:: INFO2
::
:: NTFS回收站结构如下:
::
:: [Recycler]
:: [S-1-5-21-1409082233-448539723-725345543-500]
:: desktop.ini
:: INFO2
:: [S-1-5-21-1844237615-2139871995-1417001333-500]
:: desktop.ini
:: INFO2
:: [S-1-5-21-606747145-261478967-839522115-500]
:: desktop.ini
:: INFO2
::
:: 其中Q?br />::
:: desktop.ini用来定义文g夹,告诉pȝQ你把存我的文g夹变成回收站的样?br />::
:: INFO2用来存放当前盘符下删除的文g的原来\径,?.3短文件名Q以及与改名文g对应关系
::
:: 我们是用的INFO2文gQ将里面存放的信息通过两次查找qo出来
::
:: 重点Q?br />::
:: FIND.EXE ":" "C:\Recycled\INFO2" 2>NUL | FINDSTR.EXE /R "^[A-z]:[\\]" 2>NUL
::
:: 参考:
::
::
http://www.cn-dos.net/forum/viewthread.php?tid=25053&fpage=1&highlight=tokens%3D1%2B&page=1
::
:: 感谢Q?br />::
:: 中国DOS联盟论坛里所有给予我启发的热心hQ我受益匪!
::
:: Author: NeedJava
::
:: Modified: 2007.08.13
::
:: BTW: 今晚23时东北方向有׃座流星雨Q我已经调好照相Z
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
DEL /F /Q deleted.txt 2>NUL
FOR %%a IN ( C D E F G H I J K L M N O P Q R S T U V Y X Y Z ) DO (
IF EXIST "%%a:\" (
ECHO 正在搜烦?%a:〕盘下的回收站…?/font>
FOR /F "delims=" %%i IN ( 'DIR /AH-D /B /S "%%a:\Recycler\INFO2" 2^>NUL' ) DO (
REM ECHO [%%i] & PAUSE
CALL :parse %%i
)
FOR /F "delims=" %%I IN ( 'DIR /AH-D /B /S "%%a:\Recycled\INFO2" 2^>NUL' ) DO (
REM ECHO [%%I] & PAUSE
CALL :parse %%I
)
)
)
@ECHO ON
GOTO :EOF
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 重点Q?br />::
:: FIND.EXE ":" "C:\Recycled\INFO2" 2>NUL | FINDSTR.EXE /R "^[A-z]:[\\]" 2>NUL
::
:: 详细解释请关注上面的|站Q无奈何版主的叙qͼ呵呵Q本人坐板凳?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:parse
ECHO [%1]>>deleted.txt
FOR /F "delims=" %%m IN ( 'FIND.EXE ":" "%1" 2^>NUL ^| FINDSTR.EXE /R "^[A-z]:[\\]" 2^>NUL' ) DO (
ECHO %%m>>deleted.txt
)
ECHO.>>deleted.txt
后记Q鉴于很多病毒喜Ƣ往回收站里面钻Q通过查找真正被删除的文g列表Q找到对应的删除文gQ那么剩下的文g可以看着办了Q估计先要用IS杀掉进E?/font>
SETLOCAL EnableDelayedExpansion
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 重复文g的手工处?br />::
:: 忽略开头ؓ“[”的行,没有用“eol=[”,因ؓ要每隔三ơ计数器清零Q防止相同文件过多打开q多
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:begin
IF EXIST clone.txt (
SET /A num=0
FOR /F "delims=" %%b IN ( clone.txt ) DO (
SET "file=%%b"
IF NOT "!file!"=="" (
IF NOT "!file:~0,1!"=="[" (
IF !num! GTR 2 (
SET /A num=0
ECHO 本组完全相同的文件太多,按Q意键l箋打开三个…?br /> ECHO.
PAUSE>NUL
)
IF EXIST "!file!" (
EXPLORER.EXE /N, /SELECT, "!file!"
SET /A num=num+1
)
) ELSE (
IF !num! GTR 0 (
ECHO 上组完全相同的文件显C完毕?br /> ECHO.
)
SET /A num=0
ECHO 按Q意键打开下组三个完全相同的文件…?br /> ECHO.
PAUSE>NUL
)
)
)
) ELSE (
GOTO :EOF
)
CLS
ECHO 重新开始…?br />ECHO.
GOTO begin
@ECHO ON
SETLOCAL EnableDelayedExpansion
ECHO 搜烦重复的图片,按Q意键l箋?br />ECHO.
PAUSE>NUL
DEL /F /Q hash.txt 2>NUL
DEL /F /Q sort.txt 2>NUL
DEL /F /Q clone.txt 2>NUL
DEL /F /Q lost.txt 2>NUL
RD /S /Q "Clone\" 2>NUL & MD "Clone\" 2>NUL
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 生成“文件大|文g路径”,再排序,内容诸如Q?br />::
:: 25329|C:\Documents and Settings\Administrator\桌面\02.jpg
::
:: 把文件大加?00000000Q即100MBQ这h便SORT命o比较大小Q那么内容变成如下:
::
:: 100025329|C:\Documents and Settings\Administrator\桌面\02.jpg
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
CLS
ECHO 正在搜烦文gQ请E候…?br />ECHO.
FOR /R %%a IN ( *.jpg ) DO (
SET /A size=%%~za+100000000
ECHO !size!^|%%a>>hash.txt
)
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: Ҏ列表每行前面所列出的文件大进行排?br />::
:: 把文件大加?00000000Q即100MBQ这h便SORT命o比较大小
::
:: 否则SORT会给我们??23?235??1?”这L序
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
CLS
ECHO 正在排序文gQ请E候…?br />ECHO.
IF EXIST hash.txt (
SORT /R hash.txt /O sort.txt 2>NUL
)
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 把大相同的文g分离成一个个单独的文Ӟ方便后面的相互比?br />::
:: 我不认ؓ需要对5MB以上的图片文件进行二q制比较Q它们够昄的了
::
:: 只有大小一h需要作q一步的二进制比较,否则是搞笑?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
CLS
ECHO 正在分离文gQ请E候…?br />ECHO.
IF EXIST sort.txt (
SET "preSize="
SET "preFile="
FOR /F "tokens=1,2 delims=|" %%a IN ( sort.txt ) DO (
SET /A curSize=%%a-100000000
SET "curFile=%%b"
IF NOT "!preFile!"=="" IF !preSize! LEQ 5000000 (
IF !preSize! EQU !curSize! (
IF /I NOT "!always!"=="true" (
ECHO !preSize!^|!preFile!>"Clone\!preSize!.vab"
SET "always=true"
)
ECHO !curSize!^|!curFile!>>"Clone\!preSize!.vab"
) ELSE (
SET "always=false"
)
)
SET /A preSize=!curSize!
SET "preFile=!curFile!"
)
)
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 微Y一些DOS命o的搞WBUGQ?br />::
:: FCQ名U的字数过185个的文g夹不予理?br />::
:: DIRQ把路径中的一些Unicode码(?0FBQ用半角问号?”代替,C本也如此
::
:: FOR /RQ不但把Unicode码(?0FBQ用半角问号?”代替,q会删除路径中的?”和“^?br />::
:: 以上q些微YBUGQɘq个批处理也有了BUGQ\径中不能有?”、“^”和一些Unicode?br />::
::
:: FC命oq回代码含义Q?br />::
:: 0 完全相同
::
:: 1 不完全同
::
:: 2 ~少文g
::
::
:: FIND命oq回代码含义Q?br />::
:: 0 扑ֈ字符?br />::
:: 1 没有扑ֈ字符?br />::
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:reload
IF EXIST "Clone\" (
FOR /R "Clone\" %%a IN ( *.vab ) DO (
SET "list=Clone\%%~nxa"
SET /A num=1
GOTO cycle
)
)
GOTO delete
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 原理Q?br />::
:: 假设有DATA[A B C D B A A]q个7位数l需要自w比较,按照正常的方法,如下Q?br />::
:: for( int i=0; i<n-1; i++ )
:: {
:: for( int j=i+1; j<n; j++ )
:: {
:: compare DATA[i] DATA[j]...
:: }
:: }
::
:: 需要比较N*(N-1)/2ơ,?*(7-1)/2=21ơ,如下Q?br />::
:: [A B]、[A C]、[A D]、[A B]、[A A]、[A A]
::
:: [B C]、[B D]、[B B]、[B A]、[B A]
::
:: [C D]、[C B]、[C A]、[C A]
::
:: [D B]、[D A]、[D A]
::
:: [B A]、[B A]
::
:: [A A]
::
:: 但是从上面的列表可以发现Q有些已l被定和某个数相同的数Q如[A]和[B]两类Q?br />::
:: 在后面依然和别的数l比较,q是不科学的Q应该在扑ֈ相同cdQ删除它们?br />::
:: 也就是说Q一旦找到相同的c,把它们剔除出@环,那么循环应该如下Q?br />::
:: A B C D B A A
::
:: W一ơ@环找出所有相同的[A]后,待比较列表动态变为:
::
:: B C D B
::
:: W二ơ@环找出所有相同的[B]后,待比较列表动态变为:
::
:: C D
::
:: 如上Q那么比较ؓQ?br />::
:: [A B]、[A C]、[A D]、[A B]、[A A]、[A A]
::
:: [B C]、[B D]、[B B]、[BXA]、[BXA]
::
:: [C D]、[CXB]、[CXA]、[CXA]
::
:: [DXB]、[DXA]、[DXA]
::
:: [BXA]、[BXA]
::
:: [AXA]
::
:: 中间有X的表C已被羃减的Q即最l比较ؓQ?br />::
:: [A B]、[A C]、[A D]、[A B]、[A A]、[A A]
::
:: [B C]、[B D]、[B B]
::
:: [C D]
::
:: 整个批处理原理:
::
:: 1、FOR命o通过%%~za生成零散的,每列开头ؓ文g大小的文件列表hash.txtQ如Q?br />::
:: 100017000|E:\123.jpg
:: 100017000|E:\345.jpg
:: 100056732|E:\ffff.jpg
:: 100017000|E:\OK\123.jpg
:: 100056732|E:\OK\ffff.jpg
:: 100012345|E:\OK\gag.jpg
::
:: 2、SORT命ohash.txt从大到小Q当然也可以从小到大Q排序成sort.txtQ如Q?br />::
:: 100056732|E:\ffff.jpg
:: 100056732|E:\OK\ffff.jpg
:: 100017000|E:\123.jpg
:: 100017000|E:\345.jpg
:: 100017000|E:\OK\123.jpg
:: 100012345|E:\OK\gag.jpg
::
:: 3、分析sort.txt列表文gQ如果有两行以上大小相同的纪录,分离到同一个新列表文gQ?br />::
:: 文g名:Clone\56732.vabQ内容如下:
:: 100056732|E:\ffff.jpg
:: 100056732|E:\OK\ffff.jpg
::
:: 文g名:Clone\17000.vabQ内容如下:
:: 100017000|E:\123.jpg
:: 100017000|E:\345.jpg
:: 100017000|E:\OK\123.jpg
::
:: 4、通过双层嵌套FOR命oQ进行比较,相同的纪录进clone.txtQ也是最l文Ӟ
::
:: 不相同的则纪录进新的文gcomparedN.vabQ此处N为数????Q如果不删除Q?br />::
:: 可以看到动态的待比较列表,用于调试?br />::
:: 一旦生成了comparedN.vab文gQ就表示有未比较的文Ӟ则将待比较列表list设成
::
:: 最新的comparedN.vab文gQƈ且蟩转到双层嵌套FOR命o开头cycleQ重新@环?br />::
:: 一旦待比较列表list消失Q则表明此类大小的文件比较完毕,跌{到reloadQ分析下
::
:: 一个大的文g列表?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:cycle
REM TYPE !list! & PAUSE
IF EXIST !list! (
FOR /F "tokens=1,2 delims=|" %%M IN ( !list! ) DO (
SET "found=false"
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 我们分析的文件内Ҏ用“|”分隔的Q如下:
REM ::
REM :: 56732|E:\ffff.jpg
REM ::
REM :: tokens=1,2 delims=|会把内容分割成两部分Q即56732和E:\ffff.jpg
REM ::
REM :: W一个部分用变量%%m表示Q也是文g大小56732
REM ::
REM :: W二个部分用变量%%n表示Q也是文g完整的\径E:\ffff.jpg
REM ::
REM :: skip=1表示跌一行,用来防止自n比较。当然ؓ了稳妥,下面q是用了判断
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
FOR /F "skip=1 tokens=1,2 delims=|" %%m IN ( !list! ) DO (
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 必须是大相同的文g才能比较。不是必要,但稳妥v见还是判断一?br />REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF /I "%%M"=="%%m" (
REM ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 不能自己跟自己比较。虽然上面用skip=1跌Q但E_赯q是判断一?br />REM ::
REM ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF /I NOT "%%N"=="%%n" (
CLS
ECHO 正在比较以下%%M字节的两个文Ӟ
ECHO %%N
ECHO %%n
ECHO.
REM PAUSE
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: ҎFC命o用二q制比较Q所q回的错误码来判断两个文件是否相?br />REM ::
REM :: Windows 2000下FC命o有问题,所以Windows 2000不能使用此批处理
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
FC.EXE /B "%%N" "%%n">NUL 2>NUL
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 两个文g比较后完全相同,FC命o会返?
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF !ERRORLEVEL! EQU 0 (
ECHO 两个文g完全相同Q?br /> ECHO.
REM PAUSE
REM ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 如果!found!为trueQ就表示在比较@环中Q遇CW一ơ相?br />REM ::
REM :: 用于在找到的列表clone.txt中写入新的标?br />REM ::
REM ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF /I NOT "!found!"=="true" (
ECHO [%%M Bytes]>>clone.txt
ECHO %%N>>clone.txt
SET "found=true"
)
ECHO %%n>>clone.txt
)
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 两个文g比较后不相同QFC命o会返?
REM ::
REM :: 把不相同的文件写入下一个待比较列表
REM ::
REM :: q个列表取代现有列表用于下ơ@?br />REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF !ERRORLEVEL! EQU 1 (
REM ECHO %%n & ECHO. & PAUSE
ECHO %%m^|%%n>>"compared!num!.vab"
)
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 找不到相应的文gӞFC命o会返?
REM ::
REM :: ׃FOR /R命o得出的\径,会删除\径中的?”和“^”,
REM ::
REM :: q会D虽然待比较列表有路径Q错误的Q,然而FC命o却找不到
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF !ERRORLEVEL! EQU 2 (
REM ECHO %%n & ECHO. & PAUSE
IF NOT EXIST "%%N" (
ECHO %%M^|%%N>>lost.txt
)
IF NOT EXIST "%%n" (
ECHO %%m^|%%n>>lost.txt
)
)
)
)
)
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 如果!found!为trueQ就表示在这ơ@环中扑ֈ了相同文?br />REM ::
REM :: 那么针对q次循环的结束,在找到的列表clone.txt中追加一个空行,用来分隔
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF /I "!found!"=="true" (
ECHO.>>clone.txt
)
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 删除现有的待比较列表Q必d除,否则会陷入死循环
REM ::
REM :: q也是蟩出@环的判断条gQvery important!
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
DEL /F /Q "!list!" 2>NUL
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 如果刚才的@环,有一些文件不相同Q就会存在新的待比较列表
REM ::
REM :: 我们把它设ؓ新的待比较列表,准备跌{到@环开_重新循环
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF EXIST "compared!num!.vab" (
SET "list=compared!num!.vab"
SET /A num+=1
) ELSE (
GOTO reload
)
GOTO cycle
)
)
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 删除用过的文?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:delete
DEL /F /Q hash.txt 2>NUL
DEL /F /Q sort.txt 2>NUL
RD /S /Q "Clone\" 2>NUL
IF EXIST clone.txt %SystemRoot%\NOTEPAD.EXE clone.txt
@ECHO ON
一Q如何得到regini.exe
在Windows XP安装光盘中(其他版本的自p试)Q找到I386目录下的regini.ex_文gQ用expand.exe命o提取出regini.exeQ命令如下:
"%SystemRoot%\System32\EXPAND.EXE" "\\?\CDROM0\I386\REGINI.EX_" "C:\regini.exe"
然后从C盘下生成的regini.exe文g复制C需要的地方?
Q不要从非信ȝ|站下蝲regini.exe?
二、简单D?
先打开regedit.exeQ以便观看每步生的变化Q将如下内容复制到记事本中,保存为example01.txt、example02.txt文gQ然后用如下命oQ?
REGINI.EXE example01.txt
REGINI.EXE example02.txt
::::::: example01.txt :::::::::: 不要复制我,我是分割U开?::::::::::::::::::::
HKEY_CURRENT_USER\example0
HKEY_CURRENT_USER\example0
"example1" = REG_DWORD 1
HKEY_CURRENT_USER\example0
"example2" = REG_SZ "This is an example!"
HKEY_CURRENT_USER\example0
"example3" = REG_MULTI_SZ "This is the first line!" "This is the second line!" "This is the third line!"
HKEY_CURRENT_USER\example0
"example4" = REG_EXPAND_SZ "This is an example! This is an example! This is an example! This is an example! This is an example!"
::::::: example01.txt :::::::::: 不要复制我,我是分割U结?::::::::::::::::::::
::::::: example02.txt :::::::::: 不要复制我,我是分割U开?::::::::::::::::::::
HKEY_CURRENT_USER\example0 [2 8 19]
::::::: example02.txt :::::::::: 不要复制我,我是分割U结?::::::::::::::::::::
修改W一个脚本,再运行试试:
REGINI.EXE example01.txt
没反应,看来已经起作用了Q键值变成只ȝ了!
三、权限代码表
1 - Administrators 完全讉K
2 - Administrators d讉K
3 - Administrators d、写入访?br /> 4 - Administrators d、写入、删除访?
5 - Creator 完全讉K
6 - Creator d、写入访?
7 - everyone 完全讉K
8 - everyone d讉K
9 - everyone d、写入访?br /> 10 - everyone d、写入、删除访?
11 - Power Users 完全讉K
12 - Power Users d、写入访?br /> 13 - Power Users d、写入、删除访?
14 - System Operators 完全讉K
15 - System Operators d、写入访?br /> 16 - System Operators d、写入、删除访?
17 - System 完全讉K
18 - System d、写入访?br /> 19 - System d讉K
20 - Administrators d、写入、执行访?
21 - Interactive User 完全讉K
22 - Interactive User d、写入访?br /> 23 - Interactive User d、写入、删除访?
四、运用在哪里
装好pȝ、杀毒Y件后Q删除一些服务键、修改一些自启动键、文件关联键的权限等{。但是话又说回来了,
既然我们可以L的修Ҏ限,那么病毒也可以修改回去,防范的方法是转移regini.exe文gQ再利用注册表监Y件?
某个注册表监测软g改个名称Q最好再加个壻I不是防杀毒YӞ而是防病毒恶意终止)Q加在服务中Q一旦有修改报警?
五、英文帮?
q部分是从网站找的,作者不详,仅供参考:
Usage: REGINI [-m machinename | -h hivefile hiveroot | -w Win95 Directory] [-i n] [-o outputWidth] [-b] textFiles...
-m specifies a remote windows NT machine whose registry is to be manipulated.
-h specifies a specify local hive to manipulate.
-w specifies the paths to a windows 95 system.dat and user.dat files
-i n specifies the display indentation multiple. Default is 4
-o outputWidth specifies how wide the output is to be. By default the outputWidth is set to
the width of the console window if standard output has not been redirected to a file.
In the latter case, an outputWidth of 240 is used.
-b specifies that REGINI should be backward compatible with older versions of REGINI that
did not strictly enforce line continuations and quoted strings Specifically, REG_BINARY,
REG_RESOURCE_LIST and REG_RESOURCE_REQUIREMENTS_LIST data types did not need line
continuations after the first number that gave the size of the data.
It just kept looking on following lines until it found enough data values to equal the
data length or hit invalid input. Quoted strings were only allowed in REG_MULTI_SZ.
They could not be specified around key or value names, or around values for REG_SZ or
REG_EXPAND_SZ Finally, the old REGINI did not support the semicolon as an end of line
comment character.
textFiles is one or more ANSI or Unicode text files with registry data.
The easiest way to understand the format of the input textFile is to use the REGDMP
command with no arguments to dump the current contents of your NT Registry to standard
out. Redirect standard out to a file and this file is acceptable as input to REGINI
Some general rules are:
Semicolon character is an end-of-line comment character, provided it is the first
non-blank character on a line
Backslash character is a line continuation character. All characters from the backslash
up to but not including the first non-blank character of the next line are ignored.
If there is more than one space before the line continuation character, it is replaced
by a single space.
Indentation is used to indicate the tree structure of registry keys. The REGDMP program
uses indentation in multiples of 4. You may use hard tab characters for indentation,
but embedded hard tab characters are converted to a single space regardless of their
position.
Values should come before child keys, as they are associated with the previous key at
or above the value's indentation level.
For key names, leading and trailing space characters are ignored and not included in
the key name, unless the key name is surrounded by quotes. Imbedded spaces are part of
a key name.
Key names can be followed by an Access Control List (ACL) which is a series of decimal
numbers, separated by spaces, bracketed by a square brackets (e.g. [8 4 17]).
The valid numbers and their meanings are:
1 - Administrators Full Access
2 - Administrators Read Access
3 - Administrators Read and Write Access
4 - Administrators Read, Write and Delete Access
5 - Creator Full Access
6 - Creator Read and Write Access
7 - World Full Access
8 - World Read Access
9 - World Read and Write Access
10 - World Read, Write and Delete Access
11 - Power Users Full Access
12 - Power Users Read and Write Access
13 - Power Users Read, Write and Delete Access
14 - System Operators Full Access
15 - System Operators Read and Write Access
16 - System Operators Read, Write and Delete Access
17 - System Full Access
18 - System Read and Write Access
19 - System Read Access
20 - Administrators Read, Write and Execute Access
21 - Interactive User Full Access
22 - Interactive User Read and Write Access
23 - Interactive User Read, Write and Delete Access
If there is an equal sign on the same line as a left square bracket then the equal
sign takes precedence, and the line is treated as a registry value. If the text
between the square brackets is the string DELETE with no spaces, then REGINI will
delete the key and any values and keys under it.
For registry values, the syntax is:
value Name = type data
Leading spaces, spaces on either side of the equal sign and spaces between the type
keyword and data are ignored, unless the value name is surrounded by quotes. If the
text to the right of the equal sign is the string DELETE, then REGINI will delete the
value.
The value name may be left off or be specified by an at-sign character which is the
same thing, namely the empty value name. So the following two lines are identical:
= type data
@ = type data
This syntax means that you can't create a value with leading or trailing spaces,
an equal sign or an at-sign in the value name, unless you put the name in quotes.
Valid value types and format of data that follows are:
REG_SZ text
REG_EXPAND_SZ text
REG_MULTI_SZ "string1" "string2" ...
REG_DATE mm/dd/yyyy HH:MM DayOfWeek
REG_DWORD numberDWORD
REG_BINARY numberOfBytes numberDWORD(s)...
REG_NONE (same format as REG_BINARY)
REG_RESOURCE_LIST (same format as REG_BINARY)
REG_RESOURCE_REQUIREMENTS (same format as REG_BINARY)
REG_RESOURCE_REQUIREMENTS_LIST (same format as REG_BINARY)
REG_FULL_RESOURCE_DESCRIPTOR (same format as REG_BINARY)
REG_QWORD numberQWORD
REG_MULTISZ_FILE fileName
REG_BINARYFILE fileName
If no value type is specified, default is REG_SZ
For REG_SZ and REG_EXPAND_SZ, if you want leading or trailing spaces in the value
text, surround the text with quotes. The value text can contain any number of
imbedded quotes, and REGINI will ignore them, as it only looks at the first and
last character for quote characters.
For REG_MULTI_SZ, each component string is surrounded by quotes. If you want an
imbedded quote character, then double quote it, as in string2 above.
For REG_BINARY, the value data consists of one or more numbers. The default base
for numbers is decimal.
Hexidecimal may be specified by using 0x prefix. The first number is the number
of data bytes, excluding the first number. After the first number must come enough
numbers to fill the value.
Each number represents one DWORD or 4 bytes. So if the first number was 0x5 you
would need two more numbers after that to fill the 5 bytes. The high order 3 bytes
of the second DWORD would be ignored.
Whenever specifying a registry path, either on the command line or in an input file,
the following prefix strings can be used:
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_USER
USER:
Each of these strings can stand alone as the key name or be followed a backslash
and a subkey path.
SETLOCAL EnableDelayedExpansion
ECHO 搜烦重复的图片,按Q意键l箋?/font>
PAUSE>NUL
DEL /F /Q list.txt 2>NUL
DEL /F /Q sorted.txt 2>NUL
DEL /F /Q clone.txt 2>NUL
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 生成“文件大|文g路径”,再排序,内容诸如Q?br />::
:: 25329|C:\Documents and Settings\Administrator\桌面\02.jpg
::
:: 我把文g大小加上100000000Q即100MBQ这h便SORT命o比较大小Q那么内容变成如下:
::
:: 100025329|C:\Documents and Settings\Administrator\桌面\02.jpg
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
FOR /R %%a IN ( *.jpg ) DO SET /A size=%%~za+100000000 & ECHO !size!^|%%a>>list.txt
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: Ҏ列表每行前面所列出的文件大进行排?br />::
:: 我把文g大小加上100000000Q即100MBQ这h便SORT命o比较大小
::
:: 否则SORT会给我??23?235??1?”这L序
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
SORT /R list.txt /O sorted.txt 2>NUL
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 我不认ؓ需要对5MB以上的图片文件进行二q制比较Q它们够昄的了
::
:: 只有大小一h需要作q一步的二进制比较,否则是搞笑?br />::
::
:: FC搞笑Q名U字数超q?85个的文g夹不予理?br />::
:: DIR搞笑Q会把\径中的一些Unicode码(?0FBQ用半角问号?”代替,C本也如此
::
:: FOR /R搞笑Q不但会把Unicode码(?0FBQ用半角问号?”代替,q会把\径中的?”、“^”删?br />::
:: 以上q些微Y的搞WBUGQ得我的这个批处理也跟着有了BUGQ\径中不能有?”、“^”和一些Unicode?br />::
::
:: FC命oq回代码含义Q?br />::
:: 0 完全相同
::
:: 1 不完全同
::
:: 2 ~少文g
::
::
:: FIND命oq回代码含义Q?br />::
:: 0 扑ֈ字符?br />::
:: 1 没有扑ֈ字符?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
SET preSize=
SET preFile=
FOR /F "tokens=1,2 delims=|" %%a IN ( sorted.txt ) DO (
SET /A curSize=%%a-100000000
SET curFile=%%b
ECHO ========================================================================
ECHO.
ECHO 上个文g大小Q?preSize!
ECHO.
ECHO 当前文g大小Q?curSize!
ECHO.
ECHO 上个文g路径Q?preFile!
ECHO.
ECHO 当前文g路径Q?curFile!
ECHO.
IF NOT "!preFile!"=="" IF !preSize! LEQ 5000000 (
IF !preSize! EQU !curSize! (
FC.EXE /B "!preFile!" "!curFile!">NUL
IF !ERRORLEVEL! EQU 0 (
ECHO 两个文g完全相同Q?br /> ECHO.
IF /I NOT "!always!"=="true" (
ECHO.>>clone.txt
ECHO !preSize!字节>>clone.txt
ECHO !preFile!>>clone.txt
SET always=true
)
ECHO !curFile!>>clone.txt
)
) ELSE (
SET always=false
)
)
SET /A preSize=!curSize!
SET preFile=!curFile!
)
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 删除用过的文件等l尾工作
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
DEL /F /Q list.txt 2>NUL
DEL /F /Q sorted.txt 2>NUL
@ECHO ON
最q要在Win2000下工作,发现Win2000Q没打SP4Q提供的FC.EXE命o有问题,不论是在Shell下还是在批处理,一些大一L囄Q比较的l果都是?ERRORLEVEL%?Q也是相同Q大家有兴趣可以试试下面两个文gQ注意,把jpgҎgif的?br />
׃上述比较只是假设同种文g的复本,没有考虑同样大小文g的干扎ͼ按习惯,应该一一比较Q如????〕,需要比较??〕、??〕、??〕、??〕、??〕、??〕这几组Q如下:
假设相同文g有n个,理想FOR命o如下Q?br />
for( int i=1; i<n; i++ )
{
for( int j=i+1; j<=n; j++ )
{
compare i and j...
)
}
但是FOR命o的局限,很难做到Q所以自׃在考虑更好的办法,如下是第二次改进Q?br />
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: Name: 搜烦重复囄Q或其他Lcd、大的文gQ对0字节的也比较Q?br />::
:: Author: NeedJava
::
:: Modified: 2007-07-30
::
:: 注意Q你可以在Q何地方用此批处理,但必M持文件作者及注释部分的完?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
@ECHO OFF
SETLOCAL EnableDelayedExpansion
ECHO 搜烦重复的图片,按Q意键l箋?br />ECHO.
PAUSE>NUL
DEL /F /Q hash.txt 2>NUL
DEL /F /Q sort.txt 2>NUL
DEL /F /Q clone.txt 2>NUL
DEL /F /Q lost.txt 2>NUL
RD /S /Q "Clone\" 2>NUL & MD "Clone\" 2>NUL
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 生成“文件大|文g路径”,再排序,内容诸如Q?br />::
:: 25329|C:\Documents and Settings\Administrator\桌面\02.jpg
::
:: 把文件大加?00000000Q即100MBQ这h便SORT命o比较大小Q那么内容变成如下:
::
:: 100025329|C:\Documents and Settings\Administrator\桌面\02.jpg
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
CLS
ECHO 正在搜烦文gQ请E候…?br />ECHO.
FOR /R %%a IN ( *.jpg ) DO (
SET /A size=%%~za+100000000
ECHO !size!^|%%a>>hash.txt
)
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: Ҏ列表每行前面所列出的文件大进行排?br />::
:: 把文件大加?00000000Q即100MBQ这h便SORT命o比较大小
::
:: 否则SORT会给我们??23?235??1?”这L序
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
CLS
ECHO 正在排序文gQ请E候…?br />ECHO.
IF EXIST hash.txt (
SORT /R hash.txt /O sort.txt 2>NUL
)
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 把大相同的文g分离成一个个单独的文Ӟ方便后面的相互比?br />::
:: 我不认ؓ需要对5MB以上的图片文件进行二q制比较Q它们够昄的了
::
:: 只有大小一h需要作q一步的二进制比较,否则是搞笑?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
CLS
ECHO 正在分离文gQ请E候…?br />ECHO.
IF EXIST sort.txt (
SET "preSize="
SET "preFile="
FOR /F "tokens=1,2 delims=|" %%a IN ( sort.txt ) DO (
SET /A curSize=%%a-100000000
SET "curFile=%%b"
IF NOT "!preFile!"=="" IF !preSize! LEQ 5000000 (
IF !preSize! EQU !curSize! (
IF /I NOT "!always!"=="true" (
ECHO !preSize!^|!preFile!>"Clone\!preSize!.vab"
SET "always=true"
)
ECHO !curSize!^|!curFile!>>"Clone\!preSize!.vab"
) ELSE (
SET "always=false"
)
)
SET /A preSize=!curSize!
SET "preFile=!curFile!"
)
)
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 微Y一些DOS命o的搞WBUGQ?br />::
:: FCQ名U的字数过185个的文g夹不予理?br />::
:: DIRQ把路径中的一些Unicode码(?0FBQ用半角问号?”代替,C本也如此
::
:: FOR /RQ不但把Unicode码(?0FBQ用半角问号?”代替,q会删除路径中的?”和“^?br />::
:: 以上q些微YBUGQɘq个批处理也有了BUGQ\径中不能有?”、“^”和一些Unicode?br />::
::
:: FC命oq回代码含义Q?br />::
:: 0 完全相同
::
:: 1 不完全同
::
:: 2 ~少文g
::
::
:: FIND命oq回代码含义Q?br />::
:: 0 扑ֈ字符?br />::
:: 1 没有扑ֈ字符?br />::
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:reload
IF EXIST "Clone\" (
FOR /R "Clone\" %%a IN ( *.vab ) DO (
SET "list=Clone\%%~nxa"
SET /A num=1
GOTO cycle
)
)
GOTO delete
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 原理Q?br />::
:: 假设有DATA[A B C D B A A]q个7位数l需要自w比较,按照正常的方法,如下Q?br />::
:: for( int i=0; i<n-1; i++ )
:: {
:: for( int j=i+1; j<n; j++ )
:: {
:: compare DATA[i] DATA[j]...
:: }
:: }
::
:: 需要比较N*(N-1)/2ơ,?*(7-1)/2=21ơ,如下Q?br />::
:: [A B]、[A C]、[A D]、[A B]、[A A]、[A A]
::
:: [B C]、[B D]、[B B]、[B A]、[B A]
::
:: [C D]、[C B]、[C A]、[C A]
::
:: [D B]、[D A]、[D A]
::
:: [B A]、[B A]
::
:: [A A]
::
:: 但是从上面的列表可以发现Q有些已l被定和某个数相同的数Q如[A]和[B]两类Q?br />::
:: 在后面依然和别的数l比较,q是不科学的Q应该在扑ֈ相同cdQ删除它们?br />::
:: 也就是说Q一旦找到相同的c,把它们剔除出@环,那么循环应该如下Q?br />::
:: A B C D B A A
::
:: W一ơ@环找出所有相同的[A]后,待比较列表动态变为:
::
:: B C D B
::
:: W二ơ@环找出所有相同的[B]后,待比较列表动态变为:
::
:: C D
::
:: 如上Q那么比较ؓQ?br />::
:: [A B]、[A C]、[A D]、[A B]、[A A]、[A A]
::
:: [B C]、[B D]、[B B]、[BXA]、[BXA]
::
:: [C D]、[CXB]、[CXA]、[CXA]
::
:: [DXB]、[DXA]、[DXA]
::
:: [BXA]、[BXA]
::
:: [AXA]
::
:: 中间有X的表C已被羃减的Q即最l比较ؓQ?br />::
:: [A B]、[A C]、[A D]、[A B]、[A A]、[A A]
::
:: [B C]、[B D]、[B B]
::
:: [C D]
::
:: 整个批处理原理:
::
:: 1、FOR命o通过%%~za生成零散的,每列开头ؓ文g大小的文件列表hash.txtQ如Q?br />::
:: 100017000|E:\123.jpg
:: 100017000|E:\345.jpg
:: 100056732|E:\ffff.jpg
:: 100017000|E:\OK\123.jpg
:: 100056732|E:\OK\ffff.jpg
:: 100012345|E:\OK\gag.jpg
::
:: 2、SORT命ohash.txt从大到小Q当然也可以从小到大Q排序成sort.txtQ如Q?br />::
:: 100056732|E:\ffff.jpg
:: 100056732|E:\OK\ffff.jpg
:: 100017000|E:\123.jpg
:: 100017000|E:\345.jpg
:: 100017000|E:\OK\123.jpg
:: 100012345|E:\OK\gag.jpg
::
:: 3、分析sort.txt列表文gQ如果有两行以上大小相同的纪录,分离到同一个新列表文gQ?br />::
:: 文g名:Clone\56732.vabQ内容如下:
:: 100056732|E:\ffff.jpg
:: 100056732|E:\OK\ffff.jpg
::
:: 文g名:Clone\17000.vabQ内容如下:
:: 100017000|E:\123.jpg
:: 100017000|E:\345.jpg
:: 100017000|E:\OK\123.jpg
::
:: 4、通过双层嵌套FOR命oQ进行比较,相同的纪录进clone.txtQ也是最l文Ӟ
::
:: 不相同的则纪录进新的文gcomparedN.vabQ此处N为数????Q如果不删除Q?br />::
:: 可以看到动态的待比较列表,用于调试?br />::
:: 一旦生成了comparedN.vab文gQ就表示有未比较的文Ӟ则将待比较列表list设成
::
:: 最新的comparedN.vab文gQƈ且蟩转到双层嵌套FOR命o开头cycleQ重新@环?br />::
:: 一旦待比较列表list消失Q则表明此类大小的文件比较完毕,跌{到reloadQ分析下
::
:: 一个大的文g列表?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:cycle
REM TYPE !list! & PAUSE
IF EXIST !list! (
FOR /F "tokens=1,2 delims=|" %%M IN ( !list! ) DO (
SET "found=false"
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 我们分析的文件内Ҏ用“|”分隔的Q如下:
REM ::
REM :: 56732|E:\ffff.jpg
REM ::
REM :: tokens=1,2 delims=|会把内容分割成两部分Q即56732和E:\ffff.jpg
REM ::
REM :: W一个部分用变量%%m表示Q也是文g大小56732
REM ::
REM :: W二个部分用变量%%n表示Q也是文g完整的\径E:\ffff.jpg
REM ::
REM :: skip=1表示跌一行,用来防止自n比较。当然ؓ了稳妥,下面q是用了判断
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
FOR /F "skip=1 tokens=1,2 delims=|" %%m IN ( !list! ) DO (
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 必须是大相同的文g才能比较。不是必要,但稳妥v见还是判断一?br />REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF /I "%%M"=="%%m" (
REM ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 不能自己跟自己比较。虽然上面用skip=1跌Q但E_赯q是判断一?br />REM ::
REM ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF /I NOT "%%N"=="%%n" (
CLS
ECHO 正在比较以下%%M字节的两个文Ӟ
ECHO %%N
ECHO %%n
ECHO.
REM PAUSE
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: ҎFC命o用二q制比较Q所q回的错误码来判断两个文件是否相?br />REM ::
REM :: Windows 2000下FC命o有问题,所以Windows 2000不能使用此批处理
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
FC.EXE /B "%%N" "%%n">NUL 2>NUL
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 两个文g比较后完全相同,FC命o会返?
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF !ERRORLEVEL! EQU 0 (
ECHO 两个文g完全相同Q?br /> ECHO.
REM PAUSE
REM ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 如果!found!为trueQ就表示在比较@环中Q遇CW一ơ相?br />REM ::
REM :: 用于在找到的列表clone.txt中写入新的标?br />REM ::
REM ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF /I NOT "!found!"=="true" (
ECHO [%%M Bytes]>>clone.txt
ECHO %%N>>clone.txt
SET "found=true"
)
ECHO %%n>>clone.txt
)
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 两个文g比较后不相同QFC命o会返?
REM ::
REM :: 把不相同的文件写入下一个待比较列表
REM ::
REM :: q个列表取代现有列表用于下ơ@?br />REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF !ERRORLEVEL! EQU 1 (
REM ECHO %%n & ECHO. & PAUSE
ECHO %%m^|%%n>>"compared!num!.vab"
)
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 找不到相应的文gӞFC命o会返?
REM ::
REM :: ׃FOR /R命o得出的\径,会删除\径中的?”和“^”,
REM ::
REM :: q会D虽然待比较列表有路径Q错误的Q,然而FC命o却找不到
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF !ERRORLEVEL! EQU 2 (
REM ECHO %%n & ECHO. & PAUSE
IF NOT EXIST "%%N" (
ECHO %%M^|%%N>>lost.txt
)
IF NOT EXIST "%%n" (
ECHO %%m^|%%n>>lost.txt
)
)
)
)
)
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 如果!found!为trueQ就表示在这ơ@环中扑ֈ了相同文?br />REM ::
REM :: 那么针对q次循环的结束,在找到的列表clone.txt中追加一个空行,用来分隔
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF /I "!found!"=="true" (
ECHO.>>clone.txt
)
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 删除现有的待比较列表Q必d除,否则会陷入死循环
REM ::
REM :: q也是蟩出@环的判断条gQvery important!
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
DEL /F /Q "!list!" 2>NUL
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 如果刚才的@环,有一些文件不相同Q就会存在新的待比较列表
REM ::
REM :: 我们把它设ؓ新的待比较列表,准备跌{到@环开_重新循环
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF EXIST "compared!num!.vab" (
SET "list=compared!num!.vab"
SET /A num+=1
) ELSE (
GOTO reload
)
GOTO cycle
)
)
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 删除用过的文?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:delete
DEL /F /Q hash.txt 2>NUL
DEL /F /Q sort.txt 2>NUL
RD /S /Q "Clone\" 2>NUL
IF EXIST clone.txt %SystemRoot%\NOTEPAD.EXE clone.txt
@ECHO ON
ECHO 搜烦可用的〔JRE〕\径,按Q意键l箋?/font>
PAUSE>NUL
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 先找到java.exe文gQ得C要\径,然后Ҏjava.exe附近一些有特点的文Ӟ
::
:: 来判断是否是有效的\径?br />::
:: 没办法识别h为制造的恶意路径Q除非每个文仉用MD5辨认?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
DEL /F /Q JRE.txt 2>NUL
FOR %%a IN ( C D E F G H I J K L M N O P Q R S T U V W X Y Z ) DO (
IF EXIST "%%a:\" (
ECHO 正在?%a:〕盘下搜索…?/p>
FOR /F "delims=" %%b IN ( 'DIR /A-D /B /S "%%a:\java.exe" 2^>NUL' ) DO (
SET "JRELocation=%%~dpb"
REM ECHO [%%~fb] & ECHO [!JRELocation!] & PAUSE
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: 去除末尾的“\bin\?br />REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM IF /I "!JRELocation:~5!"=="\bin\" (
REM
REM SET "JRELocation=!JRELocation:~0,5!"
REM
REM ECHO [!JRELocation!] & PAUSE
REM
REM )
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: q是JDK内含的JRE
REM ::
REM :: C:\Program Files\Java\jdk1.5.0_12\bin\java.exe
REM ::
REM :: C:\Program Files\Java\jdk1.5.0_12\jre\bin\java.dll
REM ::
REM :: C:\Program Files\Java\jdk1.5.0_12\jre\bin\client\jvm.dll
REM ::
REM :: C:\Program Files\Java\jdk1.5.0_12\jre\lib\rt.jar
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF EXIST "!JRELocation!\..\jre\bin\java.dll" (
IF EXIST "!JRELocation!\..\jre\bin\client\jvm.dll" (
IF EXIST "!JRELocation!\..\jre\lib\rt.jar" (
CALL :version !JRELocation!
)
)
)
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
REM ::
REM :: q是单独的JREQ必d除JDK内含JRE的情况,防止重复
REM ::
REM :: C:\Program Files\Java\jre1.5.0_12\bin\java.exe
REM ::
REM :: C:\Program Files\Java\jre1.5.0_12\bin\java.dll
REM ::
REM :: C:\Program Files\Java\jre1.5.0_12\bin\client\jvm.dll
REM ::
REM :: C:\Program Files\Java\jre1.5.0_12\lib\rt.jar
REM ::
REM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF EXIST "!JRELocation!\java.dll" (
IF EXIST "!JRELocation!\client\jvm.dll" (
IF EXIST "!JRELocation!\..\lib\rt.jar" (
IF NOT EXIST "!JRELocation!\..\..\bin\java.exe" (
CALL :version !JRELocation!
)
)
)
)
)
)
)
GOTO :show
:version
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: JAVA.EXE -version不是用标准输出流Q而是用标准错误输出流
::
:: 所以如果要输出到文Ӟ必须用错误流Q即2>。输出类似如下:
::
:: java version "1.5.0_12"
::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
ECHO Found JRE: [%*]
IF NOT "!JRELocation!"=="" IF "!JRELocation!"=="%*" (
"!JRELocation!\JAVA.EXE" -version 2>versionErr.txt 1>versionOut.txt
FOR /F "tokens=1,2,3,4* delims= " %%a IN ( versionErr.txt versionOut.txt ) DO (
IF /I "%%a"=="java" IF /I "%%b"=="version" (
SET "JREVersion=%%~c"
ECHO JRE Version: [!JREVersion!] & ECHO.
ECHO !JREVersion!^ !JRELocation!>>JRE.txt
)
)
DEL /F /Q versionErr.txt 2>NUL
DEL /F /Q versionOut.txt 2>NUL
)
GOTO :EOF
:show
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 不徏议用START.EXE命oQ防止关联被改Q直接调用记事本NOTEPAD.EXE打开?br />::
:: 其实后面用不着q个Q这里只是ؓ了方便查看?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF EXIST JRE.txt "%SystemRoot%\NOTEPAD.EXE" JRE.txt
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 下一步,是自动讄环境变量pathQ用INF文gҎ册表Q如下:
::
:: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path:
::
:: "%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;"
::
:: 可以d扑ֈ的JREQ让使用者自己选择用哪个JREQ用到的命oFOR、SET /PQ以后再写…?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
@ECHO ON
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: 讄初始变量
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
SET FileName=预防Autorun病毒
SET FilePath=%ProgramFiles%\\%FileName%.bat
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: 如果原来有BAT文g先取消所有属性,方便下面的修?br />:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF EXIST "%FilePath%" ATTRIB -S -H -A -R "%FilePath%"
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: 生成BAT文gq存攑ֈ指定地点
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
ECHO :: 先删除带路hAUTORUN.INFQ注意防止AUTORUN.INF是文件夹>"%FilePath%"
ECHO @IF NOT EXIST AUTORUN.INF\ ATTRIB -S -H -A -R AUTORUN.INF>>"%FilePath%"
ECHO @DEL /F /Q AUTORUN.INF>>"%FilePath%"
ECHO.>>"%FilePath%"
ECHO.>>"%FilePath%"
ECHO :: 讄初始变量>>"%FilePath%"
ECHO @SET FileType=EXE,COM,PIF,LNK,386,VXD,BIN,BAT,CMD,JS,JSE,VBE,VBS,WSF,WSH,HTA,HTT,CHM,HLP,EML,FND,INF,INI,REG,KEY,MSC,MSI,SCF,SCR,SYS>>"%FilePath%"
ECHO.>>"%FilePath%"
ECHO.>>"%FilePath%"
ECHO :: 隐藏的危险文g昄出来>>"%FilePath%"
ECHO @FOR %%%%a IN ( %%FileType%% ) DO @ATTRIB -S -H -A -R *.%%%%a 2^>NUL>>"%FilePath%"
ECHO.>>"%FilePath%"
ECHO.>>"%FilePath%"
ECHO @ECHO.>>"%FilePath%"
ECHO @ECHO 当前根目录下所有危险文件已l显C,该杀该剐׃处理?gt;>"%FilePath%"
ECHO @ECHO.>>"%FilePath%"
ECHO @ECHO CQ千万别双击Q用拖选的方式选择要删除的危险文g?gt;>"%FilePath%"
ECHO @ECHO.>>"%FilePath%"
ECHO.>>"%FilePath%"
ECHO.>>"%FilePath%"
ECHO @PAUSE>>"%FilePath%"
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: BAT文g讄pȝ、存档、只d?br />:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF EXIST "%FilePath%" ATTRIB +S +A +R "%FilePath%"
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: 生成注册表文Ӟq且q加q注册表?br />:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
ECHO Windows Registry Editor Version 5.00>AddRegister.reg
ECHO.>>AddRegister.reg
ECHO [-HKEY_CLASSES_ROOT\Drive\Shell\%FileName%]>>AddRegister.reg
ECHO.>>AddRegister.reg
ECHO [HKEY_CLASSES_ROOT\Drive\Shell\%FileName%\Command]>>AddRegister.reg
ECHO @="%FilePath%">>AddRegister.reg
REGEDIT /S AddRegister.reg
DEL /F /Q AddRegister.reg
ENDLOCAL
后记Q?br />
现在关于U盘病毒的防止有很多种Q按ShiftQ或在组{略中禁止自动运行?br />
开始想用FINDSTR.EXE分析Autorun.inf文gQ然后根据找到的路径直接删除病毒Q但是限制条件怪多的,如真假\径,双执行文Ӟ隐藏目录Q想惌是预防ؓ主,Z鄙视一下Micro$oftQ?br />
ECHO 要处理保存的网|Ӟ按Q意键l箋?/font>
PAUSE>NUL
DIR /AD /B /S "*.files" 2>NUL | SORT /R >list.txt 2>NUL
FOR /F "delims=" %%a IN ( list.txt ) DO (
ECHO ========================================================================
ECHO.
ECHO 正在处理文g夏V?%a?br /> ECHO.
FOR /F "delims=" %%b IN ( 'DIR /B /ON /S "%%a\" 2^>NUL' ) DO (
ECHO 正在处理文g?%b?/font>
IF /I NOT "%%~xb"==".jpg" IF /I NOT "%%~xb"==".jpeg" IF /I NOT "%%~xb"==".png" IF /I NOT "%%~xb"==".bmp" DEL /F /Q "%%b"
)
REN "%%a" "%%~na" 2>NUL
DEL /F /Q "%%~dpna.htm" 2>NUL
)
DEL /F /Q list.txt 2>NUL
GOTO :EOF
SET dir=%TEMP%
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: 所有TEMP下的可执行文件列出来
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
ATTRIB /S /D -S -H -A -R "%dir%\*" 2>NUL
DIR /B /S /ON "%dir%\*.%file%">list 2>NUL
DEL /F /Q %file% 2>NUL
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: 先列出可执行文gQ再试图关闭q程Q如果出错,一般是没有q行
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF EXIST list FOR /F "delims=|" %%a IN ( list ) DO ECHO %%a>>%file% & TASKKILL /F /IM "%%~nxa" 2>>%file% & ECHO.>>%file% & REN "%%a" "%%~na.NeedJava"
IF EXIST %file% NOTEPAD.EXE %file%
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: l尾工作
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
DEL /F /Q list 2>NUL
RD /S /Q %TEMP% 2>NUL
MD %TEMP% 2>NUL
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 生成快捷方式
::
:: [InternetShortcut]
:: URL=file:///D:/WINDOWS/notepad.exe?/font>
http://www.126.com/
:: WorkingDirectory=D:\WINDOWS
:: IconFile=D:\WINDOWS\notepad.exe
:: IconIndex=0
:: HotKey=1601
::
:: 注意ECHO IconIndex=^0Q不能直接用ECHO IconIndex=0Q因????都是默认道Q需要用“^”{?br />::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
ECHO [InternetShortcut]>"%link%"
ECHO URL=file:///%SystemRoot%/notepad.exe>>"%link%"
ECHO WorkingDirectory=%SystemRoot%>>"%link%"
ECHO ShowCommand=7>>"%link%"
ECHO IconFile=%SystemRoot%\notepad.exe>>"%link%"
ECHO IconIndex=^0>>"%link%"
ECHO HotKey=1601>>"%link%"
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: 打开快捷方式1
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
"%link%"
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: 打开快捷方式2
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Rundll32.exe url.dll, FileProtocolHandler "%link%"
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: 删除快捷方式
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
PAUSE & DEL /F /Q "%link%"
::q原
::SET new=.TXT
::SET old=%old%%COMPUTERNAME%
::文g列表
SET list=%old%.VAB
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 1、先把当前目录及子目录下所?old%后缀名的文g列出来?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
DIR /A-D /B /L /N /ON /S *%old%>%list%
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 2、再Ҏ列出来的记录修改文g名?br />::
:: FOR命o加上"delims=|"Q表C文件夹名称变量用“|”分隔。因为默认是I格和制表符Q一旦遇到如“新建文?br />::
:: ?(2)”这L文g夹,会断开成ؓ“新建文件夹”,D找不到文件夹。又因ؓ“|”不能用于文件夹名,所以
::
:: 用“|”作为分隔符?br />::
:: 可以?%%~ 文件名分离成文件名、扩展名、盘W等部分Q?%~na表示只有文g名,%%~xa表示只有后缀?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF EXIST %list% FOR /F "delims=|" %%a IN ( %list% ) DO IF EXIST "%%a" REN "%%a" "%%~na%new%"
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::
:: 3、删除用q的列表?br />::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
IF EXIST %list% ATTRIB /D /S -S -H -A -R %list% && DEL /F /Q %list%
PAUSE