[文本处理] 批处理版SREnglog智能分析工具(请帮忙找问题及精简)

rem   版权代码部分开始于此处
@echo off 
rem 
mode con cols=100 lines=12 &color 9f 
cls
set a=^set /p=■%b%^<nul^&ping/n 0 127.1.0^>nul^& 
echo.
echo         程序正在初始化. . .           
echo       ┌──────────────────────────────────────┐
set/p=        <nul&%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%%a%
echo 100%% 
echo       └──────────────────────────────────────┘
set b=
set a=■
set /a z=100
:start
cls
set a=%a%■■
set /a b+=5
set /a z-=5
echo.
echo        程序正在启动，请稍候. . . 欢迎使用SREnglog智能分析助手       by 52kafan
echo                                                                     from [url]http://bbs.kafan.cn/[/url]
echo       ┌──────────────────────────────────────────┐
echo        %a% %b%%%
echo       └──────────────────────────────────────────┘
ping /n 0 127.0 >nul
if %b% geq 100 goto num2
ping /n 0 127.0 >nul
set /a sum =5
goto start
:_exit
set /a sum-=1
set/p=%sum% 秒后退出! <nul
echo. 
if %sum% EQU 0 exit
ping /n 0 127.0 >nul
goto _exit
:num2
rem   版权部分结束于此处
rem ⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙
rem ┌─────────────────────────────────────────────────────────────┐
rem                                       软            件            架            构            部            分
rem └─────────────────────────────────────────────────────────────┘
rem   (1)穷举"N/A"写入到N-A.txt
(echo 创建文本& echo.)>>tt.txt
(echo 创建文本& echo.)>>N7.txt
(echo 创建文本& echo.)>>old2.txt
(echo 创建文本& echo.)>>ttt.txt
findstr /li "N/" SREngLOG.log>>N-A.txt
setlocal enabledelayedexpansion
for /f "tokens=*" %%i in (N-A.txt) do (
set var=%%i
rem ┌──────────────────────────────────────────────────────────────┐
rem                                       N/A           白            明            单            部            分
rem └──────────────────────────────────────────────────────────────┘
rem   (2)标记"N-A.txt"中正常的驱动项和相关服务项
set "var=!var:drivers\360AntiArp.sys=%正常!"
set "var=!var:Garena\safedrv.sys=%正常!"
set "var=!var:system32\DRIVERS\ewusbmdm.sys=%正常的华为CDMA上网卡驱动!"            
set "var=!var:system32\DRIVERS\ewusbdev.sys=%正常的华为出品无线网卡相关驱动!"            
set "var=!var:system32\drivers\massfilter.sys=%正常的DVD/CD-ROM设备管理程序驱动!"          
set "var=!var:system32\drivers\mpfilt.sys=%正常的安国U盘量产工具的驱动!"   
set "var=!var:system32\DRIVERS\pcdrndisuio.sys=%正常的联想toolbox安装的驱动!"         
set "var=!var:System32\Drivers\sptd.sys=%正常的虚拟光驱DAEMON Tools的驱动文件!"               
set "var=!var:system32\NtDriver.sys=%正常的卡巴斯基木马扫描工具troyanfindinfo驱动!"         
set "var=!var:system32\DRIVERS\tvtpktfilter.sys=%正常的联想thinkpad文件还原恢复程序的驱动!"      
set "var=!var:system32\DRIVERS\UIUSYS.SYS=%正常的联想调制解调器驱动!"              
set "var=!var:system32\DRIVERS\zgdccat.sys=%正常的CDMA人机接口驱动!"            
set "var=!var:system32\DRIVERS\zgdccdiag.sys=%正常的USB调制解调器/串行设备驱动!"          
set "var=!var:system32\DRIVERS\zgdccmdm.sys=%正常的CDMA联想USB调制解调器驱动!"            
set "var=!var:system32\DRIVERS\zgdccvousb.sys=%正常的USB调制解调器/串行设备驱动!"          
set "var=!var:AntiARPClientLoader.exe=%正常的!"   
set "var=!var:System32\TPHDEXLG.exe=%正常的!"      
set "var=!var:oracle\ora92=%正常的!"                                                                           
set "var=!var:ipinip.sys=%正常!"
set "var=!var:aliide.sys=%正常!"
set "var=!var:viaudio.sys=%正常!
set "var=!var:SKNFW.sys=%正常!"
set "var=!var:RsNTGdi.sys=%正常!"
set "var=!var:SkyNet\Firewall\SkyProcs.sys=%正常!"
set "var=!var:snpstd3.sys=%正常!"
set "var=!var:ggghost.sys=%正常!"
set "var=!var:p2pfilter.sys=%正常!"
set "var=!var:tcphoc.sys=%正常!"
set "var=!var:usb2vcom.sys=%正常!"
set "var=!var:SystemCleaner\krpr.sys=%正常!"
set "var=!var:dtscsi.sys=%正常!"
set "var=!var:DRIVERS\sr.sys=%正常!"
set "var=!var:d347prt.sys=%正常!"
set "var=!var:npkcusb.sys=%正常!"
set "var=!var:Rfw\HookUrl.sys=%正常!"
set "var=!var:Rfw\RsFwDrv.sys=%正常!"
set "var=!var:scdriver\ScbkEx.sys=%正常!"
set "var=!var:scdriver\ScCchMgr.sys=%正常!"
set "var=!var:scdriver\ssfltpt.sys=%正常!"
set "var=!var:Rfw\HookUrl.sys=%正常!"
set "var=!var:Rfw\RsFwDrv.sys=%正常!"
set "var=!var:3waregsm.sys=%正常!"
set "var=!var:KLIF.SYS=%正常!"
set "var=!var:tsusbhub.sys=%正常!"
set "var=!var:Program Files=%正常!"
set "var=!var:o2media.sys=%正常!"
set "var=!var:o2sd.sysO2Micro=%正常!"
set "var=!var:blueletaudio.sys=%正常!"
set "var=!var:rdvgkmd.sys=%正常!"
set "var=!var:btnetdrv.sys=%正常!"
set "var=!var:vbtenum.sys=%正常!"
set "var=!var:BTHidMgr.sys=%正常!"
set "var=!var:npkcrypt.sys><N/A>=%npkcrypt.sys><N/A正常!"
set "var=!var:xAntiArp.sys><N/A>=xAntiArp.sys><N/A>正常!"
set "var=!var:<\??\C:\PROGRA~1\thunder network\thunder\XLDoctor\7.1.7.2244_2\Program\tcphoc.sys><N/A>=%<\??\C:\PROGRA~1\thunder network\thunder\XLDoctor\7.1.7.2244_2\Program\tcphoc.sys><N/A>正常!"
set "var=!var:EagleXNt.sys=%正常!"
set "var=!var:DRIVERS\epfwtdir.sys=%正常!"
set "var=!var:零时空\ntio518xp.sys=%正常!"
set "var=!var:DTL132\DTL132_x32.sys=%正常!"
set "var=!var:360TimeProt.sys=%正常!"
set "var=!var:synth3dvsc.sys=%正常!"
set "var=!var:VcommMgr.sys=%正常!"
set "var=!var:TDSMAPI.SYS=%正常!"
set "var=!var:TPInput.sys=%正常!"
set "var=!var:System32\drivers\Tppwrif.sys=%正常!"
set "var=!var:ASIO.SYS=%正常!" 
set "var=!var:system32\drivers\AsIO.sys=%正常!"
set "var=!var:drivers\PnpWmkDrv.sys=%正常!"
set "var=!var:system32\DRIVERS\pfc027.sys=%正常!"
set "var=!var:hostnt.sys=%正常!"
set "var=!var:nod32drv.sys=%正常!"
set "var=!var:hostnt.sys=%正常!" 
set "var=!var:mhdrv.sys=%正常!"
set "var=!var:drivers\rcmhdog.sys=%正常!"
set "var=!var:bdpredir.sys=%正常!"
set "var=!var:LongRADrv.sys=%正常!"
set "var=!var:gmsipci.sys=%正常!"
set "var=!var:npf.sysCACE=%正常!" 
set "var=!var:EagleNT.sys=%正常!"
set "var=!var:npkycryp.sys=%正常!"
set "var=!var:PCAMp50.sys=%正常!"
set "var=!var:PCASp50.sys=%正常!" 
set "var=!var:amd64\AODDriver2.sys=%正常!" 
set "var=!var:AmgVP.sys=%正常!"
set "var=!var:DRIVERS\motfilt.sys=%正常!"
set "var=!var:Drivers\motoandroid.sys=%正常!"
set "var=!var:DRIVERS\motccgp.sys=%正常!"
set "var=!var:DRIVERS\motccgpfl.sys=%正常!"
set "var=!var:DRIVERS\motodrv.sys=%正常!"
set "var=!var:DRIVERS\motmodem.sys=%正常!"
set "var=!var:DRIVERS\motswch.sys=%正常!"
set "var=!var:DRIVERS\Motousbnet.sys=%正常!"
set "var=!var:DRIVERS\motusbdevice.sys=%正常!"
set "var=!var:DRIVERS\TurboB.sys=%正常!"
set "var=!var:SuperFZ.sys=%正常!"
set "var=!var:SucopDrv.sys=%正常!"
set "var=!var:epfwtdir.sys=%正常!"
set "var=!var:\??\=%ddd!"
set "var=!var:-k netsvcs-->=%@!" 
echo !var!>>N1.txt
)
rem   (3)生成可疑驱动.txt
findstr /li "ddd" N1.txt >>可疑驱动.txt
setlocal enabledelayedexpansion
for /f "delims=" %%i in (N1.txt) do ( 
if not defined %%i set %%i=A & echo %%i>>report.txt)
rem ⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙⊙
rem ┌──────────────────────────────────────────────────────────┐
rem                              软            件            报            告            部            分
rem └──────────────────────────────────────────────────────────┘
rem 
rem ----------------------------------------------------------------------------------------------------------------------------
findstr /li "system32\COMRes.dll" SREngLOG.log >>old.txt
rem ----------------------------------------------------------------------------------------------------------------------------
findstr /li "[," SREngLOG.log >>1001.txt
findstr /li ".ocx" 1001.txt >>old.txt
setlocal enabledelayedexpansion
for /f "tokens=*" %%i in (old.txt) do (
set var=%%i
set "var=!var:System32=%system32!"
set "var=!var:1=%!" 
set "var=!var:0=%!" 
echo !var!>>old2.txt
)
setlocal enabledelayedexpansion
for /f "delims=" %%i in (old2.txt) do (findstr /c:"%%i" tt.txt>nul||echo %%i>>tt.txt)
(echo 1、用替换工具替换以下文件：& echo.)>分析报告.txt
findstr /li "system32\COMRes.dll" tt.txt >>分析报告.txt
findstr /li "Infected" SREngLOG.log >>分析报告.txt
(echo ———————————————————————————————————————& echo.)>>分析报告.txt
(echo 2、用xdelbox删除以下文件 ：& echo.)>>分析报告.txt 
findstr /li "[," report.txt >>要删除的文件.txt
findstr /li "A," report.txt >>要删除的文件.txt
findstr /li "<internat>" SREngLOG.log>>要删除的文件.txt
findstr /li "updater.exe" SREngLOG.log>>要删除的文件.txt
findstr /li ".ocx" tt.txt >>要删除的文件.txt
findstr /li "菜单" SREngLOG.log>>要删除的文件.txt
findstr /li "samservice.exe><>" SREnglog.log>>要删除的文件.txt
findstr /li "@" N1.txt >>要删除的文件.txt
findstr /li ".exe><N/" N1.txt >>要删除的文件.txt
findstr /li ".dll><N/" N1.txt >>要删除的文件.txt
findstr /li "tasks\SogouImeMgr.job" SREnglog.log>>要删除的文件.txt
findstr /li "Tmp" SREngLOG.log >>Temp.txt
findstr /li "[]" Temp.txt >>要删除的文件.txt
findstr /li "LOCALS~1\Temp" SREngLOG.log >>要删除的文件.txt
@findstr /v "PID" 要删除的文件.txt >>重复文件.txt 
setlocal enabledelayedexpansion
for /f "delims=" %%i in (重复文件.txt) do (findstr /c:"%%i" ttt.txt>nul||echo %%i>>ttt.txt)
findstr /li "Tmp" ttt.txt >>分析报告.txt 
@findstr /v "tmp" ttt.txt >>分析报告.txt 
(echo ———————————————————————————————————————& echo.)>>分析报告.txt
(echo 正在运行的程序:& echo.)>>分析报告.txt
@findstr /v "特权" 要删除的文件.txt >8.txt 
findstr /li "PID" 8.txt>>mm.txt
findstr /li "svchost.exe" SREngLOG.log >>mm.txt
findstr /li "smss.exe" SREngLOG.log >>mm.txt
(echo 正在运行的程序:& echo.)>>正在运行的程序.txt
setlocal enabledelayedexpansion
for /f "tokens=*" %%i in (mm.txt) do (
set var=%%i
set "var=!var:.cn=%!"
set "var=!var:/=%!"
set "var=!var:System32\smss.exe=%!"
set "var=!var:system32\svchost.exe=%!"
echo !var!>>正在运行的程序.txt
)
findstr /li ".exe" 正在运行的程序.txt >>分析报告.txt
findstr /li ".tmp" 正在运行的程序.txt >>分析报告.txt

(echo ———————————————————————————————————————& echo.)>>分析报告.txt
(echo 3、打开SREng，选择【启动项目】-【注册表】，将以下项删除：& echo.)>>分析报告.txt
findstr /li "><" SREngLOG.log >>N2.txt
findstr /li "[]" N2.txt >>N3.txt
findstr /li "missing]" SREngLOG.log >>N3.txt

@findstr /v "菜单" N3.txt >>分析报告.txt  
setlocal enabledelayedexpansion
for /f "tokens=*" %%i in (分析报告.txt) do (
set var=%%i
rem ┌──────────────────────────────────────────────────────────┐
rem                                       report           白            明            单            部            分
rem └──────────────────────────────────────────────────────────┘
rem
set "var=!var:[File is missing]=%<注册表残留项>!"
set "var=!var:assembly\=%正常!"
set "var=!var:奇虎网=%正常!"
set "var=!var:CMBProtector.dat><N/A>=%CMBProtector.dat><N/A>正常!"
set "var=!var:CertClient.dat><N/A>=%CertClient.dat>正常!"
set "var=!var:system32\srvany.exe=%正常!"   
set "var=!var:KMService.exe=%正常!" 
set "var=!var:\jre\bin\=%正常!"
set "var=!var:Garena\safedrv.sys=%正常!"
set "var=!var:XLPPoEPCIoctl.dll=%正常!"
set "var=!var:BYTEHERO\BSD=%正常!"
set "var=!var:通讯簿=%正常!"
set "var=!var:Smallfrogs=%正常!"
set "var=!var:360\360SD=%这是正常程序!"
set "var=!var:load=%正常!"
set "var=!var:360Chrome\Chrome=%正常!"
set "var=!var:WebCheck=%正常!"
set "var=!var:@C:\WINDOWS\system32\=%!"
set "var=!var:AppInit_DLLs=%正常!"
set "var=!var:CPUMon\CPUMon.exe=%正常!"
set "var=!var:kolscan\sqlite.dll=%kolscan\sqlite.dll (这是正常程序)!"
set "var=!var:Thunder=%Thunder正常!"
set "var=!var:msdmo.dll=%正常!"
set "var=!var:kingsoft\=%正常!"
set "var=!var:\Avira\AntiVir=%正常!"
set "var=!var:Yuguo\=%Yuguo\正常的雨过天晴电脑保护系统!"
set "var=!var:Software\Avast=%正常!"
set "var=!var:KuGou\KuGou=%正常!"
set "var=!var:(Signed)=%(Signed)正常!"
set "var=!var:<load><>=%<load><>正常!" 
set "var=!var:atitray=%正常!" 
set "var=!var:Macrovision=%正常!"
set "var=!var:Secdrv=%正常!"
set "var=!var:VIA=%正常!" 
set "var=!var:system32\COMRes.dll=%正常!" 
set "var=!var:WDM=%正常!"
set "var=!var:ChinaNet=%正常!"
set "var=!var:VIAudio=%正常!"
set "var=!var:KSM\sqlite.dll=%正常!" 
set "var=!var:SKNFW=%正常!"
set "var=!var:SkyProcs=%正常!"
set "var=!var:SkyNet\Firewall\SkyProcs.sys=%正常!"
set "var=!var:SNPSTD3=%正常!"
set "var=!var:Camera=%正常!"
set "var=!var:ZSMC=%正常!"
set "var=!var:VM=%正常!"
set "var=!var:ICBCEbankTools=%正常!"
set "var=!var:SogouExplorer\=%正常!"
set "var=!var:Unlocker=%正常!"
set "var=!var:snapshot\Client=%正常!" 
set "var=!var:Jollytime=%正常!" 
set "var=!var:usb2vcom=%正常!"
set "var=!var:MemTurbo\=%正常!"
set "var=!var:sptd=%正常!" 
set "var=!var:dtscsi=%正常!"
set "var=!var:[Explorer]=%<Explorer>!"
set "var=!var:Mozilla\Firefox=%正常!"
set "var=!var:Manager\PowerUtl.dll=%正常!" 
set "var=!var:firefox\mozjs.dll=%正常!" 
set "var=!var:d347bus=%正常!" 
set "var=!var:ufjdk\bin\java.exe=%正常!"    
set "var=!var:d347prt=%正常!"
set "var=!var:(Verified)Microsoft=%正常!" 
set "var=!var:npkcrypt=%正常!" 
set "var=!var:npkcusb=%正常!" 
set "var=!var:SMPLSCSI=%正常!" 
set "var=!var:CMBProtector=%正常!"
set "var=!var:rfw\rfwproxy.exe=%正常!"
set "var=!var:rfw\rfwsrv.exe=%正常!"
set "var=!var:3WAREGSM=%正常!"
set "var=!var:3WDRV=%正常!"
set "var=!var:IObit\Advanced SystemCare=%正常!"
set "var=!var:oreans32=%正常!"
set "var=!var:EHttpSrv.exe=%正常!"
set "var=!var:O2MDRDR=%正常!" 
set "var=!var:ekrn.exe=%正常!" 
set "var=!var:Numen\NumenAgentWin\=%正常!"
set "var=!var:O2Micro=%正常!"
set "var=!var:O2SDRDR=%正常!"
set "var=!var:o2sd.sysO2Micro=%正常!"
set "var=!var:Lenovo=%正常!"
set "var=!var:fsp.exe=%正常!"
set "var=!var:usblogon.exe=%正常!"
set "var=!var:Bluetooth=%正常!" 
set "var=!var:[   ]=%!" 
set "var=!var:Google\Chrome\Application=%Google\Chrome\Application正常!"
set "var=!var:_DLLs><>=%_DLLs><>正常!" 
set "var=!var:Easy Display Manager\HookDllPS2.dll]=%Easy Display Manager\HookDllPS2.dll] 正常!"
set "var=!var:System32\bcm1xsup.dll=%System32\bcm1xsup.dll (这是正常程序)!"
set "var=!var:Mozilla Firefox\mozjs.dll]=%Mozilla Firefox\mozjs.dll] 正常!"
set "var=!var:VMware Workstation\libxml2.dll]=%VMware Workstation\libxml2.dll] 正常 !" 
set "var=!var:Program Files\WinRAR=%Program Files\WinRAR正常的WinRAR文件!"
set "var=!var:json.dll]=%json.dll正常的金山在线杀毒模块]!"
set "var=!var:network\tp=%network\tp(这是正常程序)!"
set "var=!var:KWMUSIC\bin\=%KWMUSIC\bin\(这是正常程序)!"
set "var=!var:Fetion=%Fetion(这是正常程序)!
set "var=!var:\Holdfast\platform=%\Holdfast\platform(这是正常程序)!
set "var=!var:<\??\C:\PROGRA~1\thunder network\thunder\XLDoctor\7.1.7.2244_2\Program\tcphoc.sys><N/A>=%<\??\C:\PROGRA~1\thunder network\thunder\XLDoctor\7.1.7.2244_2\Program\tcphoc.sys><N/A>正常!"
set "var=!var:regsvr32.exe /s /n /i:/UserInstall=%regsvr32.exe /s /n /i:/UserInstall (这是正常程序)!"
set "var=!var:\Outlook=%\Outlook (这是正常程序)!"
set "var=!var:VMware\VMware=%VMware\VMware (这是正常程序)!"
set "var=!var:Yuguo\shieldclnt.exe><N/A>=%Yuguo\shieldclnt.exe><N/A> (这是正常程序)!"
set "var=!var:bcmwltry.exe><N/A>=%bcmwltry.exe><N/A> (这是正常程序)!"
set "var=!var:System32\WLTRYSVC.EXE]=%System32\WLTRYSVC.EXE] (这是正常程序)!"
set "var=!var:Adobe Systems, Inc.,=%Adobe Systems, Inc.,正常!"
set "var=!var:Funshion Online=%Funshion Online (这是正常程序)!"
set "var=!var:Maxthon=%正常!"
set "var=!var:<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, >=%这是正常文件!"
set "var=!var:webaClient.exe=%正常!"
set "var=!var:NvCpl.dll=%正常!"
set "var=!var:NvStartup=%正常!"
set "var=!var:PCHealth=%正常!"
set "var=!var:AcPrfMgrSvc=%正常!"
set "var=!var:ThinkPad=%正常!"
set "var=!var:AcSvc=%正常!"
set "var=!var:Backup\QQPet=%正常!"
set "var=!var:H3C\gmMgr_h3c.exe=%正常!" 
set "var=!var:ConnectUtilities=%正常!"
set "var=!var:AcSvc.exeLenovo=%正常!"
set "var=!var:ThinkPad=%正常!"
set "var=!var:Defender\mpsvc.dll=%正常!"
set "var=!var:IBMPMSVC=%正常!"
set "var=!var:Tencent\QQ=%正常!"
set "var=!var:Intel\Wireless\Bin\=%正常!"
set "var=!var:ibmpmsvc.exe=%正常!"
set "var=!var:IBM=%正常!"
set "var=!var:system32\TpKmpSVC.exe=%正常!"
set "var=!var:system32\ati2sgag.exe=%正常!"
set "var=!var:UfAutoLoadService=%正常!"
set "var=!var:UfMsgGhost=%正常!"
set "var=!var:MsgGhost.exe=%正常!"
set "var=!var:U8AuthServer=%正常!"
set "var=!var:UFNet=%正常!"
set "var=!var:Outlook=%正常!"
set "var=!var:shmgrate.exe=%正常!"
set "var=!var:system32\ServerNT.exe=%正常!"
set "var=!var:Simulator=%正常!" 
set "var=!var:System32\PAStiSvc.exe=%正常!"
set "var=!var:Cyberip=%正常!"
set "var=!var:RichVideo.exe"=%正常!"
set "var=!var:powershadow=%正常!"
set "var=!var:ShadowSystemService=%正常!"
set "var=!var:ShadowService.exe=%正常!"
set "var=!var:O2Micro=%正常!"
set "var=!var:system32\o2flash.exe=%正常!"
set "var=!var:srservice=%正常!"  
set "var=!var:srsvc.dll=%正常!"
set "var=!var:MAPGIS=%正常!"
set "var=!var:zdLccSvc=%正常!"
set "var=!var:system32\ZDLCCSVC.EXE=%正常!"
set "var=!var:ALi=%正常!" 
set "var=!var:AliIde=%正常!"
set "var=!var:Antimalware=%正常!"
set "var=!var:NvMcTray.dll=%正常!"
set "var=!var:WBEM=%疑似灰鸽子木马!"
set "var=!var:PPPoEWin=%正常!"
set "var=!var:TDSMAPI=%正常!" 
set "var=!var:TPInput=%正常!"
set "var=!var:RUNDLL2000.EXE=%危险!"
set "var=!var:TPPWRIF=%正常!"
set "var=!var:System32\drivers\Tppwrif.sys=%正常!"
set "var=!var:TSMAPIP=%正常!"
set "var=!var:PnpWmkDrv=%正常!" 
set "var=!var:SoC=%正常!" 
set "var=!var:HOSTNT=%正常!"
set "var=!var:MHDRV=%正常!" 
set "var=!var:Rainbow=%正常!" 
set "var=!var:aswFsBlk=%正常!"
set "var=!var:bdfdll=%正常!"
set "var=!var:BitDefender=%正常!"
set "var=!var:\H3C\iNode=%正常!"
set "var=!var:bdpredir=%正常!"
set "var=!var:KSafe\json.dll=%正常!" 
set "var=!var:Protector=%正常!" 
set "var=!var:ProtectorA=%正常!" 
set "var=!var:npf.sysCACE=%正常!" 
set "var=!var:WinPcap=%正常!"
set "var=!var:/Program=%正常!"
set "var=!var:system32\PnkBstrA.exe=%正常!" 
set "var=!var:punkbuster=%正常!" 
set "var=!var:c20ukdrwsvr.exe=%正常!"
set "var=!var:IcbcDaemon.exe=%正常!" 
set "var=!var:WDelMgr20=%正常!" 
set "var=!var:system32\nvshell.dll=%正常!" 
set "var=!var:system32\pthreadvc.dll=%正常!" 
set "var=!var:MacType.dll=%正常!" 
set "var=!var:Ock.dll=%正常!"
set "var=!var:VopClient.exe=%正常!"
set "var=!var:bgswitch.exe=%正常!"
set "var=!var:BigDogPathVM=%正常!"
set "var=!var:X-Scan-v3.3=%正常!"
set "var=!var:dumprep=%正常!" 
set "var=!var:HookDll.dll=%正常!" 
set "var=!var:dominodomino.exe=%正常!" 
set "var=!var:VMSnapset=%正常!" 
set "var=!var:Htpatch.exe=%正常!"
set "var=!var:HTpatchhtpatch.exe=%正常!"
set "var=!var:QQ\Bin=%正常!"
set "var=!var:Notify\DfLogon=%正常!"
set "var=!var:DfLogonLogonDll.dll=%正常!" 
set "var=!var:Interface=%正常!" 
set "var=!var:HidServ.dll=%正常!" 
set "var=!var:helpsvc=%正常!"
set "var=!var:><N>=%正常!"
set "var=!var:System32\WLTRYSVC.EXE=%正常!"
set "var=!var:rundll32.exe=%rundll32.exe 正常!"
set "var=!var:updaterC=%C!"
set "var=!var:WinRAR\rarext.dll=%WinRAR\rarext.dll正常的WinRAR文件!"
echo !var!>>白名单.txt
) 
setlocal enabledelayedexpansion
for /f "tokens=*" %%i in (白名单.txt) do (
set var=%%i
set "var=!var:状=%正常!"
echo !var!>>分析结果.txt
) 
(echo ———————————————————————————————————————&echo.)>>分析结果.txt 
(echo 4、用专杀或者修复工具修复以下磁碟机劫持: &echo.)>>分析结果.txt 

findstr /li "IFEO" SREngLOG.log >>IFEO.txt
setlocal enabledelayedexpansion
for /f "tokens=*" %%i in (IFEO.txt) do (
set var=%%i
set "var=!var:ntsd=%!" 
set "var=!var:-d=%!"
set "var=!var:IFEO=% [IFEO]    !"
set "var=!var:<=%!"
set "var=!var:>=%!"
echo !var!>>分析结果.txt
)
(echo ———————————————————————————————————————&echo.)>>分析结果.txt 
(echo 5、打开SREng，选择【启动项目】-【服务】-【Win32服务应用程序】，将以下项删除：&echo.)>>分析结果.txt 
findstr /li "missing)" SREngLOG.log >>ff.txt
findstr /li "samservice.exe><>" SREnglog.log>>ff.txt
findstr /li ".dll" 白名单.txt >>ser.txt
findstr /li ".EXE" 白名单.txt >>ser.txt
@findstr /v ".dll" ser.txt >>servers.txt  
@findstr /v ".exe" servers.txt >>N4.txt
@findstr /v "菜单" N4.txt >>N5.txt 
@findstr /v "特权" N5.txt >>ff.txt 
setlocal enabledelayedexpansion
for /f "tokens=*" %%i in (ff.txt) do (
set var=%%i
set "var=!var:Program Files/=%正常!"
echo !var!>>N7.txt
)
@findstr /v "正常" N7.txt>>分析结果.txt 
(echo 6、打开SREng，选择【启动项目】-【服务】-【驱动程序】，将以下项删除：& echo.)>>分析结果.txt

findstr /li ".sys" N1.txt>>分析结果.txt

findstr /li "tmp" 可疑驱动.txt>>分析结果.txt
(echo ———————————————————————————————————————& echo.)>>分析结果.txt
(echo 7、用“SREng”修复以下【Winsock 提供者】项：& echo.)>>分析结果.txt
findstr /li "(, N/A)" SREngLOG.log >>分析结果.txt
(echo ———————————————————————————————————————& echo.)>>分析结果.txt
(echo 8、用U盘专杀工具查杀【Autorun.inf 】& echo.)>>分析结果.txt
findstr /li "ntldr" SREngLOG.log >b.txt
@more +6 b.txt >>分析结果.txt 
(echo ———————————————————————————————————————& echo.)>>分析结果.txt
(echo 9、用“SREng”修复以下 【hosts文件】项：& echo.)>>分析结果.txt
findstr /li "127.1" SREngLOG.log >>分析结果.txt
(echo ———————————————————————————————————————& echo.)>>分析结果.txt
(echo 10、用“SREng”修复以下【文件关联】项：& echo.)>>分析结果.txt
findstr /li "Error." SREngLOG.log >>分析结果.txt
(echo ———————————————————————————————————————& echo.)>>分析结果.txt
(echo 11、该项可能被修改,请参考系统默认值。& echo.)>>分析结果.txt
findstr /li "<AppInit_DLLs>" SREngLOG.log>>分析结果.txt
findstr /li "<load>" SREngLOG.log>>分析结果.txt
findstr /li "<run>" SREngLOG.log>>分析结果.txt
findstr /li "setup.exe>" SREngLOG.log >>分析结果.txt
findstr /li "<shell>" SREngLOG.log>>分析结果.txt
findstr /li "<Userinit>" SREngLOG.log>>分析结果.txt
findstr /li "<UIHost>" SREngLOG.log>>分析结果.txt
@findstr /v "正常" "分析结果.txt">分析报告.log
(echo ———————————————————————————————————————& echo.)>>分析报告.log
(echo 12、修复完成后，建议用Windows清理助手扫描清除恶意插件。& echo.)>>分析报告.log
findstr /li "ASSIST" SREngLOG.log>>分析报告.log
del /q *.txt
setlocal enabledelayedexpansion
for /f "tokens=*" %%i in (分析报告.log) do (
set var=%%i
set "var=!var:<AppInit_DLLs><>=%正常!"
set "var=!var:<load><>=%正常!"
set "var=!var:<shell><Explorer.exe>=%正常!"
set "var=!var:<Userinit><C:\WINDOWS\system32\userinit.exe,>=%正常!"
set "var=!var:<UIHost><logonui.exe>=%正常!"
set "var=!var:><=%>  <!"
set "var=!var:[NA, ]=%!"
set "var=!var:[]=%!"
set "var=!var:[   SYSTEM]=%!"
set "var=!var:[   Administrator]=%!"
set "var=!var:[N/A, ]=%!"
set "var=!var:hidserv.dll><N/A>=%hidserv.dll><N/A>  <正常的系统服务项>!"
set "var=!var:\SystemRoot\=%!"
set "var=!var:ddd=%!"
set "var=!var:<N/A>=%!"
set "var=!var:<(File is missing)>=%   <服务残留项>!"
set "var=!var:ExplorerC=%C!"
set "var=!var:[ ]=%!"
set "var=!var:ssMgr_ccb=%正常的建设银行U盾程序!" 
set "var=!var:创建文本=%………………………………………………………………………………………………………!"
echo !var!>>报告文件.txt
) 
@findstr /v "正常" 报告文件.txt>>智能分析报告.txt 
del /q 报告文件.txt
del /q 分析报告.log
start 智能分析报告.txt 
exit
复制代码