[注册表类] 批处理注册表键值判断

luckboy45

Quote:

@echo off & setlocal enabledelayedexpansion COLOR 0a for /f "tokens=*" %%a in (                'reg query "HKLM\System\CurrentControlSet\Services"' ) do (         set tmpString=%%a         set tmpString=!tmpString:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\=!         echo !tmpString! >>2.txt ) PAUSE

效果是这样的：

REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
Abiosdsk
ACPI
ACPIEC
aec
AFD
Alerter
ALG
AliIde
amdide
AmdK8
AmdLLD
AppMgmt
AsyncMac
atapi
Atdisk
Atmarpc
AudioSrv
audstub
BattC
Beep
BITS
Browser
Cdaudio
Cdfs
Cdrom
CiSvc

Quote:

wmic /namespace:\\root\default path stdregprov call EnumKey ^&h80000002,"System\CurrentControlSet\Services" >>1.txt

则效果是这样的

执行 (stdregprov)->EnumKey()

方法执行成功。
输出参数:
instance of __PARAMETERS
{
        ReturnValue = 0;
        sNames = {"Abiosdsk", "ACPI", "ACPIEC", "aec", "AFD", "Alerter", "ALG", "AliIde", "amdide", "AmdK8", "AmdLLD", "AppMgmt", "AsyncMac", "atapi", "Atdisk", "Atmarpc", "AudioSrv", "audstub", "BattC", "Beep", "BITS", "Browser", "Cdaudio", "Cdfs", "Cdrom", "CiSvc", "Class", "ClipSrv", "CmdIde", "COMSysApp", "ContentFilter", "ContentIndex", "CryptSvc", "DcomLaunch", "Dhcp", "Disk", "dmadmin", "dmboot", "dmio", "dmload", "dmserver", "DMusic", "Dnscache", "Dot3svc", "drmkaud", "EapHost", "ERSvc", "Eventlog", "EventSystem", "Fastfat", "FastUserSwitchingCompatibility", "Fdc", "Fips", "Flpydisk", "FltMgr", "FsVga", "Fs_Rec", "Ftdisk", "gameenum", "Gpc", "HDAudBus", "helpsvc", "HidServ", "HidUsb", "hkmsvc", "HTTP", "HTTPFilter", "i8042prt", "Imapi", "ImapiService", "inetaccs", "Inport", "IntcAzAudAddService", "IntelIde", "intelppm", "Ip6Fw", "IpFilterDriver", "IpInIp", "IpNat", "IPSec", "irda", "IRENUM", "Irmon", "irsir", "ISAPISearch", "isapnp", "Kbdclass", "kbdhid", "kmixer", "KSecDD", "LanmanServer", "lanmanworkstation", "ldap", "LicenseService", "LmHosts", "MDM", "Messenger", "mnmdd", "mnmsrvc", "Modem", "Mouclass", "mouhid", "MountMgr", "MRxDAV", "MRxSmb", "MSDTC", "Msfs", "MSIServer", "MSKSSRV", "MSPCLOCK", "MSPQM", "mssmbios", "Mup", "napagent", "NDIS", "NdisTapi", "Ndisuio", "NdisWan", "NDProxy", "NetBIOS", "NetBT", "NetDDE", "NetDDEdsdm", "Netlogon", "Netman", "Nla", "Npfs", "Ntfs", "NtLmSsp", "NtmsSvc", "Null", "nv", "NVSvc", "NwlnkFlt", "NwlnkFwd", "ose", "Parport", "PartMgr", "ParVdm", "PCI", "PCIIde", "Pcmcia", "perc2hib", "PerfDisk", "PerfNet", "PerfOS", "PerfProc", "PlugPlay", "PolicyAgent", "PptpMiniport", "Processor", "ProtectedStorage", "PSched", "Ptilink", "RasAcd", "RasAuto", "Rasirda", "Rasl2tp", "RasMan", "RasPppoe", "Raspti", "Rdbss", "RDPCDD", "RDPDD", "rdpdr", "RDPNP", "RDPWD", "RDSessMgr", "redbook", "RemoteAccess", "RemoteRegistry", "ROCKEYNT", "RpcSs", "RSVP", "RTL8023xp", "SamSs", "SCardSvr", "Schedule", "Secdrv", "seclogon", "SENS", "serenum", "Serial", "Sfloppy", "SharedAccess", "ShellHWDetection", "SiFilter", "Simbad", "splitter", "Spooler", "sptd", "sr", "Srv", "SSDPSRV", "stisvc", "swenum", "swmidi", "SwPrv", "sysaudio", "SysmonLog", "TapiSrv", "Tcpip", "TDPIPE", "TDTCP", "TermDD", "TermService", "Themes", "TlntSvr", "TosIde", "TrkWks", "TSDDD", "Udfs", "UnlockerDriver5", "Update", "upnphost", "UPS", "usbccgp", "usbehci", "usbhub", "usbohci", "usbstor", "usbuhci", "VgaSave", "ViaIde", "vmmouse", "VolSnap", "VSS", "VXD", "W32Time", "W3SVC", "Wanarp", "wdmaud", "WebClient", "winmgmt", "Winsock", "WinSock2", "WinTrust", "WmdmPmSN", "Wmi", "WmiApRpl", "WmiApSrv", "WS2IFSL", "wscsvc", "wuauserv", "WZCSVC", "xmlprov", "{A41CD26E-2C3E-4DB4-BC93-1E66051815FC}"};
};


我的目的是，先生成一个临时文件，内部是上面的服务名称，然后再检测下目前注册表中的服务，对应的，将多出来的服务用FOR命令提取后分别，再输出成这样的效果
[amdide / amdide][Running/Boot Start]
  <C：\WINDOWS\system32\DRIVERS\amdide.sys>

其实主要用来检测是否有莫名服务或者驱动被安装,希望有能力的朋友能帮忙实现下.

luckboy45

昨天在群里有位好心人帮忙写了点，不过完全不明白，且运行后无反应，各位也帮忙看看吧！

@echo off
setlocal enabledelayedexpansion
for /f "tokens=* " %%i in ('reg query "HKLM\System\CurrentControlSet\Services"') do (
   call :是否存在重复服务 "%%~ni"
    if "%重复服务%"=="FALSE" call :列出驱动 "%%i"
    )
pause
:是否存在重复服务
   set "重复服务=FALSE"
   set "CurrentValue=%~n1"
   type list.txt|findstr "^%CurrnetVAlue%$"&& set "重复服务=TRUE"
   goto :eof

:列出驱动
   set hk=%~1
   reg query "%~1" /v ImagePath
   goto :eof