VBS 強制關閉Symantec Endpoint Protection的代碼

2020-07-26 11:48:48

字體：大中小

來源：轉載

供稿：網友

使用這個腳本，可以隨時讓它歇下來。當然也可以讓它繼續工作。
前提是，你必須是本機管理員。
這個腳本使用一各很過時的終止程序方法：ntsd.exe -c q -p ProcessID。所以以前有過一個bat版，之所以用VBS是因為效率高一點，而且沒有太多的黑色窗口。
主要思想是：循環終止程序+停止服務

代碼如下：

復制代碼代碼如下:

'On Error Resume Next
' 檢查操作系統版本
Call CheckOS()
Call MeEncoder()

' 程序初始化，取得參數
If WScript.Arguments.Count = 0 Then
    Call main()
    WScript.Quit
Else
    Dim strArg, arrTmp
    For Each strArg In WScript.Arguments
        arrTmp = Split(strArg, "=")
        If UBound( arrTmp ) = 1 Then
            Select Case LCase( arrTmp(0) )
                Case "sep"
                    Call sep( arrTmp(1) )
                Case "process_stop"
                    Call process_stop( arrTmp(1) )
                Case "process_start"
                    Call process_start( arrTmp(1) )
                Case "server_stop"
                    Call server_stop( arrTmp(1) )
                Case "server_start"
                    Call server_start( arrTmp(1) )
                Case "show_tip"
                    Call show_tip( arrTmp(1) )
                Case Else
                    WScript.Quit
            End Select
        End If
    Next
    WScript.Quit
End If

' 主程序
Sub main()
    If (IsRun("Rtvscan.exe", "") = 1) Or (IsRun("ccSvcHst.exe", "") = 1) Or (IsRun("SMC.exe", "") = 1) Then
        Call SEP_STOP()
    Else
        Call SEP_START()
    End If
End Sub

' 帶參數運行
Sub sep( strMode )
    Select Case LCase(strMode)
        Case "stop"
            Call SEP_STOP()
        Case "start"
            Call SEP_START()
    End Select
End Sub

' 停止SEP
Sub SEP_STOP()

    Set wso = CreateObject("WScript.Shell")

    'kill other app
    Call process_clear()
    'kill sep
    wso.Run """" & WScript.ScriptFullName & """ server_stop=""SENS""", 0, True

    'Get Me PID
    Set pid = Getobject("winmgmts://.").InstancesOf("Win32_Process")
    For Each id In pid
        If LCase(id.name) = LCase("Wscript.exe") Then
            mepid=id.ProcessID
        End If
    Next

'tips
wso.Run """" & WScript.ScriptFullName & """ show_tip=stop", 0, False

    'stop service
    wso.Run """" & WScript.ScriptFullName & """ server_stop=""SENS""", 0, True
    wso.Run """" & WScript.ScriptFullName & """ server_stop=""Symantec AntiVirus""", 0, True
    wso.Run """" & WScript.ScriptFullName & """ server_stop=""ccEvtMgr""", 0, True
    wso.Run """" & WScript.ScriptFullName & """ server_stop=""SmcService""", 0, True
    wso.Run """" & WScript.ScriptFullName & """ server_stop=""SNAC""", 0, True
    wso.Run """" & WScript.ScriptFullName & """ server_stop=""ccSetMgr""", 0, True

    'kill apps
    wso.Run """" & WScript.ScriptFullName & """ process_stop=ccApp.exe", 0, False
    wso.Run """" & WScript.ScriptFullName & """ process_stop=ccSvcHst.exe", 0, False
    wso.Run """" & WScript.ScriptFullName & """ process_stop=SNAC.exe", 0, False
    wso.Run """" & WScript.ScriptFullName & """ process_stop=Rtvscan.exe", 0, False
    wso.Run """" & WScript.ScriptFullName & """ process_stop=SescLU.exe", 0, False
    wso.Run """" & WScript.ScriptFullName & """ process_stop=Smc.exe", 0, False
    wso.Run """" & WScript.ScriptFullName & """ process_stop=SmcGui.exe", 0, False

'wait
WScript.Sleep 15000

    'kill other script
    Set pid = Getobject("winmgmts://.").InstancesOf("Win32_Process")
    For Each ps In pid
        If (LCase(ps.name) = "wscript.exe") Or (LCase(ps.name) = "cscript.exe") Then ps.terminate
    Next

    'kill other app
    Call process_clear()

    'start ?
    'Call SEP_START()
End Sub

' 恢復SEP
Sub SEP_START()
    Set wso = CreateObject("WScript.Shell")
    'tips
    wso.Run """" & WScript.ScriptFullName & """ show_tip=start", 0, False

    'start server
    wso.Run """" & WScript.ScriptFullName & """ server_stop=""SENS""", 0, True
    wso.Run """" & WScript.ScriptFullName & """ server_start=""Symantec AntiVirus""", 0, True
    wso.Run """" & WScript.ScriptFullName & """ server_start=""ccEvtMgr""", 0, True
    wso.Run """" & WScript.ScriptFullName & """ server_start=""SmcService""", 0, True
    wso.Run """" & WScript.ScriptFullName & """ server_start=""SNAC""", 0, True
    wso.Run """" & WScript.ScriptFullName & """ server_start=""ccSetMgr""", 0, True
    Set wso = Nothing
End Sub

' 關閉進程
Function process_stop( strAppName )
        Dim i
        For i = 1 To 100
        Set pid = Getobject("winmgmts://.").InstancesOf("Win32_Process")
                For Each id In pid
                        If LCase(id.name) = LCase(strAppName) Then
                                Dim wso
                                Set wso = CreateObject("WScript.Shell")
                                wso.run "ntsd.exe -c q -p " & id.ProcessID, 0, True
                        End If
                Next
        WScript.Sleep 500
        Next
End Function

' 停止服務
Sub server_stop( byVal strServerName )

    Set wso = CreateObject("WScript.Shell")
    wso.run "sc config """ & strServerName & """ start= disabled", 0, True
    wso.run "cmd /c echo Y|net stop """ & strServerName & """", 0, True
    Set wso = Nothing

End Sub

' 啟動服務
Sub server_start( byVal strServerName )

    Set wso = CreateObject("WScript.Shell")
    wso.run "sc config """ & strServerName & """ start= auto", 0, True
    wso.run "cmd /c echo Y|net start """ & strServerName & """", 0, True
    Set wso = Nothing

End Sub

' 顯示提示信息
Sub show_tip( strType )
    Set wso = CreateObject("WScript.Shell")
    Select Case LCase(strType)
        Case "stop"
            wso.popup chr(13) + "正在停止 SEP，亚洲香蕉成人av网站在线观看_欧美精品成人91久久久久久久_久久久久久久久久久亚洲_热久久视久久精品18亚洲精品_国产精自产拍久久久久久_亚洲色图国产精品_91精品国产网站_中文字幕欧美日韩精品_国产精品久久久久久亚洲调教_国产精品久久一区_性夜试看影院91社区_97在线观看视频国产_68精品久久久久久欧美_欧美精品在线观看_国产精品一区二区久久精品_欧美老女人bb