Atitit.木马病毒自动启动-------------win7计划任务的管理
Atitit.木马病毒自动启动-------------win7计划任务的管理
1. 计划任务的Windows系统中取代AT 的schtasks命令1
2.1. 计划任务列表管理gui版本 %windir%\system32\taskschd.msc /s1
6. Qa schtasks在win7下提示错误:无法加载列资源 3
1. 计划任务的Windows系统中取代AT 的schtasks命令
、SchTasks.exe 取代了包含在 Windows 早期版本中的工具 At.exe。XP、Vista、Windows7、Windows2003/2008等系统中均可以使用。
2. Win本身的系统计划任务列表
2.1. 计划任务列表管理gui版本 %windir%\system32\taskschd.msc /s
2.2. 计划任务列表管理cli版本
作者:: 绰号:老哇的爪子 （ 全名：：Attilax Akbar Al Rapanui 阿提拉克斯 阿克巴 阿尔 拉帕努伊 ） 汉字名：艾龙， EMAIL:1466519819@qq.com
转载请注明来源： http://www.cnblogs.com/attilax/
3. 360的列表接口ui
4. task Scheduler的计划任务服务
服务对话框中找到名称为Task Scheduler的计划任务服务，
5. 错误日志
、要确认计划运行或要找出计划不运行的原因，请查看“任务计划”服务事务日志 Systemroot\SchedLgU.txt。该日志记录了由包括“计划任务”和 SchTasks.exe 在内的所有使用该服务的工具启动的尝试运行。
6. Qa schtasks在win7下提示错误:无法加载列资源
Char encode问题...
查看编码
C:\Users\Administrator>chcp
活动代码页: 936
如使用 936中文GBK编码的话
schtasks.exe /query 会报错
错误: 无法加载列资源。
chcp 65001 就是换成UTF-8代码页走ok兰...
7. 添加一个atitask1任务以后
360的列表显示如下图片
Cli显示
Folder: \
TaskName Next Run Time Status
======================================== ====================== ===============
Adobe Flash Player Updater Disabled
atitask1 2016/3/10 14:51:06 Ready
ComputerZ-Tray Disabled
DandelionStarter Disabled
Google Pinyin Daemon Disabled
PowerWord-Notify-AT6T5TKUVHGT0IG_Adminis Disabled
PowerWord-Update-AT6T5TKUVHGT0IG_Adminis Disabled
QQBrowser Updater Task 2016/3/9 16:50:00 Ready
QQBrowser Updater Task(Core) N/A Ready
SogouImeMgr Disabled
WpsNotifyTask_Administrator 2016/3/9 15:00:00 Ready
WpsUpdateTask_Administrator 2016/3/9 15:00:00 Ready
8. 自己创建一个任务通过cli
schtasks /create /tn atitask0309_153509_775 /tr "'D:\workspace 空格\AtiPlatf\0screenUtil.bat'" /sc MINUTE /mo 2
----echo:
成功: 成功创建计划任务 "atitask0309_153509_775"。
注意:: 空格的双引号转义..要多传导一个双引号,不个单个引号trans类k...
9. Schtasks 显示的输出如下
Folder: \
TaskName Next Run Time Status
======================================== ====================== ===============
Adobe Flash Player Updater Disabled
ComputerZ-Tray Disabled
DandelionStarter Disabled
Google Pinyin Daemon Disabled
PowerWord-Notify-AT6T5TKUVHGT0IG_Adminis Disabled
PowerWord-Update-AT6T5TKUVHGT0IG_Adminis Disabled
QQBrowser Updater Task 2016/3/9 14:50:00 Ready
QQBrowser Updater Task(Core) N/A Ready
SogouImeMgr Disabled
WpsNotifyTask_Administrator 2016/3/9 15:00:00 Ready
WpsUpdateTask_Administrator 2016/3/9 15:00:00 Ready
Folder: \Apple
TaskName Next Run Time Status
======================================== ====================== ===============
AppleSoftwareUpdate Disabled
Folder: \Microsoft
TaskName Next Run Time Status
======================================== ====================== ===============
INFO: There are no scheduled tasks presently available at your access level.
Folder: \Microsoft\Windows
TaskName Next Run Time Status
======================================== ====================== ===============
INFO: There are no scheduled tasks presently available at your access level.
Folder: \Microsoft\Windows\Active Directory Rights Management Services Client
TaskName Next Run Time Status
======================================== ====================== ===============
AD RMS Rights Policy Template Management Disabled
AD RMS Rights Policy Template Management N/A Ready
Folder: \Microsoft\Windows\AppID
TaskName Next Run Time Status
======================================== ====================== ===============
PolicyConverter Disabled
VerifiedPublisherCertStoreCheck Disabled
Folder: \Microsoft\Windows\Application Experience
TaskName Next Run Time Status
======================================== ====================== ===============
AitAgent Disabled
Folder: \Microsoft\Windows\Autochk
TaskName Next Run Time Status
======================================== ====================== ===============
Proxy Disabled
Folder: \Microsoft\Windows\Bluetooth
TaskName Next Run Time Status
======================================== ====================== ===============
UninstallDeviceTask N/A Ready
Folder: \Microsoft\Windows\CertificateServicesClient
TaskName Next Run Time Status
======================================== ====================== ===============
SystemTask N/A Ready
UserTask N/A Ready
UserTask-Roam Disabled
Folder: \Microsoft\Windows\Customer Experience Improvement Program
TaskName Next Run Time Status
======================================== ====================== ===============
Consolidator 2016/3/9 18:00:00 Could not start
KernelCeipTask 2016/3/10 3:30:00 Ready
UsbCeip 2016/3/11 1:30:00 Ready
Folder: \Microsoft\Windows\Defrag
TaskName Next Run Time Status
======================================== ====================== ===============
ScheduledDefrag Disabled
Folder: \Microsoft\Windows\Diagnosis
TaskName Next Run Time Status
======================================== ====================== ===============
Scheduled 2016/3/13 1:00:00 Ready
Folder: \Microsoft\Windows\Location
TaskName Next Run Time Status
======================================== ====================== ===============
Notifications Disabled
Folder: \Microsoft\Windows\Maintenance
TaskName Next Run Time Status
======================================== ====================== ===============
WinSAT 2016/3/13 1:00:00 Ready
Folder: \Microsoft\Windows\MemoryDiagnostic
TaskName Next Run Time Status
======================================== ====================== ===============
CorruptionDetector N/A Ready
DecompressionFailureDetector N/A Ready
Folder: \Microsoft\Windows\MUI
TaskName Next Run Time Status
======================================== ====================== ===============
LPRemove N/A Ready
Folder: \Microsoft\Windows\Multimedia
TaskName Next Run Time Status
======================================== ====================== ===============
SystemSoundsService N/A Running
Folder: \Microsoft\Windows\NetTrace
TaskName Next Run Time Status
======================================== ====================== ===============
GatherNetworkInfo Disabled
Folder: \Microsoft\Windows\PerfTrack
TaskName Next Run Time Status
======================================== ====================== ===============
BackgroundConfigSurveyor Disabled
Folder: \Microsoft\Windows\PLA
TaskName Next Run Time Status
======================================== ====================== ===============
INFO: There are no scheduled tasks presently available at your access level.
Folder: \Microsoft\Windows\Power Efficiency Diagnostics
TaskName Next Run Time Status
======================================== ====================== ===============
AnalyzeSystem Disabled
Folder: \Microsoft\Windows\RAC
TaskName Next Run Time Status
======================================== ====================== ===============
RacTask 2016/3/9 15:05:17 Ready
Folder: \Microsoft\Windows\Ras
TaskName Next Run Time Status
======================================== ====================== ===============
MobilityManager N/A Ready
Folder: \Microsoft\Windows\Registry
TaskName Next Run Time Status
======================================== ====================== ===============
RegIdleBackup 2016/3/19 0:25:49 Ready
Folder: \Microsoft\Windows\RemoteAssistance
TaskName Next Run Time Status
======================================== ====================== ===============
RemoteAssistanceTask Disabled
Folder: \Microsoft\Windows\Shell
TaskName Next Run Time Status
======================================== ====================== ===============
WindowsParentalControls Disabled
WindowsParentalControlsMigration Disabled
Folder: \Microsoft\Windows\SoftwareProtectionPlatform
TaskName Next Run Time Status
======================================== ====================== ===============
SvcRestartTask Disabled
Folder: \Microsoft\Windows\SystemRestore
TaskName Next Run Time Status
======================================== ====================== ===============
SR Disabled
Folder: \Microsoft\Windows\Task Manager
TaskName Next Run Time Status
======================================== ====================== ===============
Interactive N/A Ready
Folder: \Microsoft\Windows\Tcpip
TaskName Next Run Time Status
======================================== ====================== ===============
IpAddressConflict1 N/A Ready
IpAddressConflict2 N/A Ready
Folder: \Microsoft\Windows\TextServicesFramework
TaskName Next Run Time Status
======================================== ====================== ===============
MsCtfMonitor N/A Running
Folder: \Microsoft\Windows\Time Synchronization
TaskName Next Run Time Status
======================================== ====================== ===============
SynchronizeTime 2016/3/13 1:00:00 Ready
Folder: \Microsoft\Windows\UPnP
TaskName Next Run Time Status
======================================== ====================== ===============
UPnPHostConfig N/A Ready
Folder: \Microsoft\Windows\User Profile Service
TaskName Next Run Time Status
======================================== ====================== ===============
HiveUploadTask Disabled
Folder: \Microsoft\Windows\WDI
TaskName Next Run Time Status
======================================== ====================== ===============
ResolutionHost N/A Ready
Folder: \Microsoft\Windows\Windows Error Reporting
TaskName Next Run Time Status
======================================== ====================== ===============
QueueReporting N/A Ready
Folder: \Microsoft\Windows\Windows Filtering Platform
TaskName Next Run Time Status
======================================== ====================== ===============
BfeOnServiceStartTypeChange Disabled
Folder: \Microsoft\Windows\Windows Media Sharing
TaskName Next Run Time Status
======================================== ====================== ===============
UpdateLibrary N/A Ready
Folder: \Microsoft\Windows\WindowsBackup
TaskName Next Run Time Status
======================================== ====================== ===============
ConfigNotification Disabled
Folder: \Microsoft\Windows\WindowsColorSystem
TaskName Next Run Time Status
======================================== ====================== ===============
Calibration Loader Disabled
10. 引用
使用命令行创建计划任务(windows)_百度文库.htm
Atitit.木马病毒自动启动-------------win7计划任务的管理的更多相关文章
- Atitit.木马病毒的免杀原理---sikuli 的使用
Atitit.木马病毒的免杀原理---sikuli 的使用 1. 使用sikuli java api1 1.1. 3. Write code!1 2. 常用api2 2.1. wait 等待某个界面出 ...
- Atitit.木马病毒websql的原理跟个设计
Atitit.木马病毒websql的原理跟个设计 1. Keyword Wsql { var sql="select "+p.txt+" as t,"+p.v+ ...
- Atitit.木马病毒强制强行关闭360 360tray.exe的方法
Atitit.木马病毒强制强行关闭360 360tray.exe的方法 1. taskkill /im 进程名称1 2. 用 wmic process where name="进程名称&qu ...
- atitit.木马病毒webshell的原理and设计 java c# .net php.
atitit.木马病毒webshell的原理and设计 java c# .net php. 1. 隐蔽性 编辑 WebShell后门具有隐蔽性,一般有隐藏在正常文件中并修改文件时间达到隐蔽的,还有利用 ...
- Atitit.木马 病毒 免杀 技术 360免杀 杀毒软件免杀 原理与原则 attilax 总结
Atitit.木马 病毒 免杀 技术 360免杀 杀毒软件免杀 原理与原则 attilax 总结 1. ,免杀技术的用途2 1.1. 病毒木马的编写2 1.2. 软件保护所用的加密产品(比如壳)中,有 ...
- Atitit.木马病毒的操作注册表原理 系统服务管理器 atiSysService
Atitit.木马病毒的操作注册表原理 系统服务管理器 atiSysService 1. atiSysService1 2. atiSysService 原理1 3. Java code1 4. 参 ...
- Atitit.木马病毒 webftp 的原理跟个设计
Atitit.木马病毒 webftp 的原理跟个设计 ftp木马的效果 文件传播 文件列表 文件内容查看 作者:: ★(attilax)>>> 绰号:老哇的爪子 ( 全名::Att ...
- Atitit. 木马病毒的外部class自动加载机制------加载class的方法总结
Atitit. 木马病毒的外部class自动加载机制------加载class的方法总结 Atitit.java load class methods 1. 动态加载jar文件和class文件. 1 ...
- Atitit。木马病毒原理机密与概论以及防御
Atitit.木马病毒原理机密与概论以及防御 1. 定时截屏木马1 1.1. QQ聊天与微信聊天木马1 2. 文档木马1 3. 病毒木马的触发方式2 4. 远程木马2 5. 漏洞木马2 6. 病毒木马 ...
随机推荐
- Lua 学习笔记（七）编译、执行外部代码块
Lua称为解释型语言的原因:Lua允许在运行源代码之前,先将源代码预编译为一种中间形式.区别解释型语言的主要特征是在于编译器是否是语言运行时库的一部分,即有能力执行动态生成的代码.因为Lua中有dof ...
- 使用PL/SQL工具比对表结构,同步表结构
需求:Oracle数据库,B库和C库,某些表的表结构不一致,现在要求以C库为标准,同步更新B库表结构PL/SQL 连接到C库, Tools --> Compare User Objects .. ...
- MySQL入门01-MySQL源码安装
操作系统:CentOS 6.7 MySQL版本:5.6.30 1.前期准备 2.系统配置 3.CMake编译配置 4.make && make install 5.后期配置和测试 Re ...
- android中ProgressBar和ListView
ProgressBar进度条的使用情况: 进度条的.xml声明:如果不声明格式,则默认格式为转圆圈的形式,声明进度条的visibility为不可见. <ProgressBar android:i ...
- SQL SERVER 通用分页存储过程，两种用法任你选
写在前面 从SQLSERVER 2005开始,提供了Row_Number()函数,利用函数生成的Index来处理分页,按照正常的逻辑思维都是传pageIndex和pageSize来完成分页,昨天前端和 ...
- JS实现返回对象的详细信息
使用JS有时会需要打印出对象的详细信息,下面方法可以实现: function ShowObjProperty(Obj) { var PropertyList=''; var PropertyCount ...
- 常用查找数据结构及算法（Python实现）
目录 一.基本概念 二.无序表查找 三.有序表查找 3.1 二分查找(Binary Search) 3.2 插值查找 3.3 斐波那契查找 四.线性索引查找 4.1 稠密索引 4.2 分块索引 4.3 ...
- Net设计模式实例系列文章总结
1 什么是设计模式 设计模式是对在软件设计过程中重复出现的问题提出了一种比较好的解决方案.正如一位专家所说:设计模式是对程序设计人员经常遇到的设计问题的可再现的解决方案(The Smalltalk C ...
- linq分页组合查询
一.linq高级查 1.模糊查(字符串包含) 1 public List<User> Select(string name) 2 { 3 return con.User.Where(r = ...
- 使用SignalR实现即时通讯功能
教程简介 SignalR的好处是可以让多个客户端之间进行互动,比如这篇教程就展示了当你在页面上拖动矩形方块的同时,其它打开这个页面的用户也将会看到你拖动的轨迹以及最终的结果,当然他们也可以通过拖动该方 ...