Atitit.木马病毒自动启动-------------win7计划任务的管理
Atitit.木马病毒自动启动-------------win7计划任务的管理
1. 计划任务的Windows系统中取代AT 的schtasks命令1
2.1. 计划任务列表管理gui版本 %windir%\system32\taskschd.msc /s1
6. Qa schtasks在win7下提示错误:无法加载列资源 3
1. 计划任务的Windows系统中取代AT 的schtasks命令
、SchTasks.exe 取代了包含在 Windows 早期版本中的工具 At.exe。XP、Vista、Windows7、Windows2003/2008等系统中均可以使用。
2. Win本身的系统计划任务列表
2.1. 计划任务列表管理gui版本 %windir%\system32\taskschd.msc /s
2.2. 计划任务列表管理cli版本
作者:: 绰号:老哇的爪子 （ 全名：：Attilax Akbar Al Rapanui 阿提拉克斯 阿克巴 阿尔 拉帕努伊 ） 汉字名：艾龙， EMAIL:1466519819@qq.com
转载请注明来源： http://www.cnblogs.com/attilax/
3. 360的列表接口ui
4. task Scheduler的计划任务服务
服务对话框中找到名称为Task Scheduler的计划任务服务，
5. 错误日志
、要确认计划运行或要找出计划不运行的原因，请查看“任务计划”服务事务日志 Systemroot\SchedLgU.txt。该日志记录了由包括“计划任务”和 SchTasks.exe 在内的所有使用该服务的工具启动的尝试运行。
6. Qa schtasks在win7下提示错误:无法加载列资源
Char encode问题...
查看编码
C:\Users\Administrator>chcp
活动代码页: 936
如使用 936中文GBK编码的话
schtasks.exe /query 会报错
错误: 无法加载列资源。
chcp 65001 就是换成UTF-8代码页走ok兰...
7. 添加一个atitask1任务以后
360的列表显示如下图片
Cli显示
Folder: \
TaskName Next Run Time Status
======================================== ====================== ===============
Adobe Flash Player Updater Disabled
atitask1 2016/3/10 14:51:06 Ready
ComputerZ-Tray Disabled
DandelionStarter Disabled
Google Pinyin Daemon Disabled
PowerWord-Notify-AT6T5TKUVHGT0IG_Adminis Disabled
PowerWord-Update-AT6T5TKUVHGT0IG_Adminis Disabled
QQBrowser Updater Task 2016/3/9 16:50:00 Ready
QQBrowser Updater Task(Core) N/A Ready
SogouImeMgr Disabled
WpsNotifyTask_Administrator 2016/3/9 15:00:00 Ready
WpsUpdateTask_Administrator 2016/3/9 15:00:00 Ready
8. 自己创建一个任务通过cli
schtasks /create /tn atitask0309_153509_775 /tr "'D:\workspace 空格\AtiPlatf\0screenUtil.bat'" /sc MINUTE /mo 2
----echo:
成功: 成功创建计划任务 "atitask0309_153509_775"。
注意:: 空格的双引号转义..要多传导一个双引号,不个单个引号trans类k...
9. Schtasks 显示的输出如下
Folder: \
TaskName Next Run Time Status
======================================== ====================== ===============
Adobe Flash Player Updater Disabled
ComputerZ-Tray Disabled
DandelionStarter Disabled
Google Pinyin Daemon Disabled
PowerWord-Notify-AT6T5TKUVHGT0IG_Adminis Disabled
PowerWord-Update-AT6T5TKUVHGT0IG_Adminis Disabled
QQBrowser Updater Task 2016/3/9 14:50:00 Ready
QQBrowser Updater Task(Core) N/A Ready
SogouImeMgr Disabled
WpsNotifyTask_Administrator 2016/3/9 15:00:00 Ready
WpsUpdateTask_Administrator 2016/3/9 15:00:00 Ready
Folder: \Apple
TaskName Next Run Time Status
======================================== ====================== ===============
AppleSoftwareUpdate Disabled
Folder: \Microsoft
TaskName Next Run Time Status
======================================== ====================== ===============
INFO: There are no scheduled tasks presently available at your access level.
Folder: \Microsoft\Windows
TaskName Next Run Time Status
======================================== ====================== ===============
INFO: There are no scheduled tasks presently available at your access level.
Folder: \Microsoft\Windows\Active Directory Rights Management Services Client
TaskName Next Run Time Status
======================================== ====================== ===============
AD RMS Rights Policy Template Management Disabled
AD RMS Rights Policy Template Management N/A Ready
Folder: \Microsoft\Windows\AppID
TaskName Next Run Time Status
======================================== ====================== ===============
PolicyConverter Disabled
VerifiedPublisherCertStoreCheck Disabled
Folder: \Microsoft\Windows\Application Experience
TaskName Next Run Time Status
======================================== ====================== ===============
AitAgent Disabled
Folder: \Microsoft\Windows\Autochk
TaskName Next Run Time Status
======================================== ====================== ===============
Proxy Disabled
Folder: \Microsoft\Windows\Bluetooth
TaskName Next Run Time Status
======================================== ====================== ===============
UninstallDeviceTask N/A Ready
Folder: \Microsoft\Windows\CertificateServicesClient
TaskName Next Run Time Status
======================================== ====================== ===============
SystemTask N/A Ready
UserTask N/A Ready
UserTask-Roam Disabled
Folder: \Microsoft\Windows\Customer Experience Improvement Program
TaskName Next Run Time Status
======================================== ====================== ===============
Consolidator 2016/3/9 18:00:00 Could not start
KernelCeipTask 2016/3/10 3:30:00 Ready
UsbCeip 2016/3/11 1:30:00 Ready
Folder: \Microsoft\Windows\Defrag
TaskName Next Run Time Status
======================================== ====================== ===============
ScheduledDefrag Disabled
Folder: \Microsoft\Windows\Diagnosis
TaskName Next Run Time Status
======================================== ====================== ===============
Scheduled 2016/3/13 1:00:00 Ready
Folder: \Microsoft\Windows\Location
TaskName Next Run Time Status
======================================== ====================== ===============
Notifications Disabled
Folder: \Microsoft\Windows\Maintenance
TaskName Next Run Time Status
======================================== ====================== ===============
WinSAT 2016/3/13 1:00:00 Ready
Folder: \Microsoft\Windows\MemoryDiagnostic
TaskName Next Run Time Status
======================================== ====================== ===============
CorruptionDetector N/A Ready
DecompressionFailureDetector N/A Ready
Folder: \Microsoft\Windows\MUI
TaskName Next Run Time Status
======================================== ====================== ===============
LPRemove N/A Ready
Folder: \Microsoft\Windows\Multimedia
TaskName Next Run Time Status
======================================== ====================== ===============
SystemSoundsService N/A Running
Folder: \Microsoft\Windows\NetTrace
TaskName Next Run Time Status
======================================== ====================== ===============
GatherNetworkInfo Disabled
Folder: \Microsoft\Windows\PerfTrack
TaskName Next Run Time Status
======================================== ====================== ===============
BackgroundConfigSurveyor Disabled
Folder: \Microsoft\Windows\PLA
TaskName Next Run Time Status
======================================== ====================== ===============
INFO: There are no scheduled tasks presently available at your access level.
Folder: \Microsoft\Windows\Power Efficiency Diagnostics
TaskName Next Run Time Status
======================================== ====================== ===============
AnalyzeSystem Disabled
Folder: \Microsoft\Windows\RAC
TaskName Next Run Time Status
======================================== ====================== ===============
RacTask 2016/3/9 15:05:17 Ready
Folder: \Microsoft\Windows\Ras
TaskName Next Run Time Status
======================================== ====================== ===============
MobilityManager N/A Ready
Folder: \Microsoft\Windows\Registry
TaskName Next Run Time Status
======================================== ====================== ===============
RegIdleBackup 2016/3/19 0:25:49 Ready
Folder: \Microsoft\Windows\RemoteAssistance
TaskName Next Run Time Status
======================================== ====================== ===============
RemoteAssistanceTask Disabled
Folder: \Microsoft\Windows\Shell
TaskName Next Run Time Status
======================================== ====================== ===============
WindowsParentalControls Disabled
WindowsParentalControlsMigration Disabled
Folder: \Microsoft\Windows\SoftwareProtectionPlatform
TaskName Next Run Time Status
======================================== ====================== ===============
SvcRestartTask Disabled
Folder: \Microsoft\Windows\SystemRestore
TaskName Next Run Time Status
======================================== ====================== ===============
SR Disabled
Folder: \Microsoft\Windows\Task Manager
TaskName Next Run Time Status
======================================== ====================== ===============
Interactive N/A Ready
Folder: \Microsoft\Windows\Tcpip
TaskName Next Run Time Status
======================================== ====================== ===============
IpAddressConflict1 N/A Ready
IpAddressConflict2 N/A Ready
Folder: \Microsoft\Windows\TextServicesFramework
TaskName Next Run Time Status
======================================== ====================== ===============
MsCtfMonitor N/A Running
Folder: \Microsoft\Windows\Time Synchronization
TaskName Next Run Time Status
======================================== ====================== ===============
SynchronizeTime 2016/3/13 1:00:00 Ready
Folder: \Microsoft\Windows\UPnP
TaskName Next Run Time Status
======================================== ====================== ===============
UPnPHostConfig N/A Ready
Folder: \Microsoft\Windows\User Profile Service
TaskName Next Run Time Status
======================================== ====================== ===============
HiveUploadTask Disabled
Folder: \Microsoft\Windows\WDI
TaskName Next Run Time Status
======================================== ====================== ===============
ResolutionHost N/A Ready
Folder: \Microsoft\Windows\Windows Error Reporting
TaskName Next Run Time Status
======================================== ====================== ===============
QueueReporting N/A Ready
Folder: \Microsoft\Windows\Windows Filtering Platform
TaskName Next Run Time Status
======================================== ====================== ===============
BfeOnServiceStartTypeChange Disabled
Folder: \Microsoft\Windows\Windows Media Sharing
TaskName Next Run Time Status
======================================== ====================== ===============
UpdateLibrary N/A Ready
Folder: \Microsoft\Windows\WindowsBackup
TaskName Next Run Time Status
======================================== ====================== ===============
ConfigNotification Disabled
Folder: \Microsoft\Windows\WindowsColorSystem
TaskName Next Run Time Status
======================================== ====================== ===============
Calibration Loader Disabled
10. 引用
使用命令行创建计划任务(windows)_百度文库.htm
Atitit.木马病毒自动启动-------------win7计划任务的管理的更多相关文章
- Atitit.木马病毒的免杀原理---sikuli 的使用
Atitit.木马病毒的免杀原理---sikuli 的使用 1. 使用sikuli java api1 1.1. 3. Write code!1 2. 常用api2 2.1. wait 等待某个界面出 ...
- Atitit.木马病毒websql的原理跟个设计
Atitit.木马病毒websql的原理跟个设计 1. Keyword Wsql { var sql="select "+p.txt+" as t,"+p.v+ ...
- Atitit.木马病毒强制强行关闭360 360tray.exe的方法
Atitit.木马病毒强制强行关闭360 360tray.exe的方法 1. taskkill /im 进程名称1 2. 用 wmic process where name="进程名称&qu ...
- atitit.木马病毒webshell的原理and设计 java c# .net php.
atitit.木马病毒webshell的原理and设计 java c# .net php. 1. 隐蔽性 编辑 WebShell后门具有隐蔽性,一般有隐藏在正常文件中并修改文件时间达到隐蔽的,还有利用 ...
- Atitit.木马 病毒 免杀 技术 360免杀 杀毒软件免杀 原理与原则 attilax 总结
Atitit.木马 病毒 免杀 技术 360免杀 杀毒软件免杀 原理与原则 attilax 总结 1. ,免杀技术的用途2 1.1. 病毒木马的编写2 1.2. 软件保护所用的加密产品(比如壳)中,有 ...
- Atitit.木马病毒的操作注册表原理 系统服务管理器 atiSysService
Atitit.木马病毒的操作注册表原理 系统服务管理器 atiSysService 1. atiSysService1 2. atiSysService 原理1 3. Java code1 4. 参 ...
- Atitit.木马病毒 webftp 的原理跟个设计
Atitit.木马病毒 webftp 的原理跟个设计 ftp木马的效果 文件传播 文件列表 文件内容查看 作者:: ★(attilax)>>> 绰号:老哇的爪子 ( 全名::Att ...
- Atitit. 木马病毒的外部class自动加载机制------加载class的方法总结
Atitit. 木马病毒的外部class自动加载机制------加载class的方法总结 Atitit.java load class methods 1. 动态加载jar文件和class文件. 1 ...
- Atitit。木马病毒原理机密与概论以及防御
Atitit.木马病毒原理机密与概论以及防御 1. 定时截屏木马1 1.1. QQ聊天与微信聊天木马1 2. 文档木马1 3. 病毒木马的触发方式2 4. 远程木马2 5. 漏洞木马2 6. 病毒木马 ...
随机推荐
- Objective-C中的语法糖
写这篇博客源于一个疑问:“WoK~, 这也行?!”.刚接触OC不久,今天做深浅拷贝的测试,无意中把获取NSArray的值写成了用下标获取的方式.当时把注意力放在了深浅拷贝的内存地址分析上了,就没太在意 ...
- 利用Shell脚本将MySQL表中的数据转化为json格式
脚本如下: #!/bin/bash mysql -s -phello test >.log <<EOF desc t1; EOF lines="concat_ws(',', ...
- Oracle Recovery 02 - 常规恢复之不完全恢复
背景:这里提到的常规恢复指的是数据库有完备可用的RMAN物理备份. 实验环境:RHEL6.4 + Oracle 11.2.0.4 单实例. 二.常规恢复之不完全恢复:部分数据丢失 2.1 重做日志文件 ...
- 1Z0-053 争议题目解析510
1Z0-053 争议题目解析510 考试科目:1Z0-053 题库版本:V13.02 题库中原题为: 510.You executed the following command in Recover ...
- MySQL学习（一）MySQLWorkbench（MySQL可视化工具）下载，安装，测试连接，以及注意事项
PS:MySQLWorkbench是MYSQL自带的可视化工具,无论使用哪个可视化工具,其实大同小异,如果想以后走的更远的话,可以考虑使用命令行操作数据库MYSQL.可视化工具让我们初学者更能理解数据 ...
- JS查找数组中出现的位置及个数
查找某个值在数组中出现的位置 var attr = [1,4,5,3,2,7,6,9]; var zhao = 8; var sy = -1; for(var i=0;i<attr.length ...
- QT QTableView用法小结
QTableView常用于实现数据的表格显示.下面我们如何按步骤实现学生信息表格: 一 添加表头 //准备数据模型 QStandardItemModel *student_model = new QS ...
- 无法为目标平台“Microsoft.Data.Tools.Schema.Sql.Sql120DatabaseSchemaProvider”创建扩展管理器
很久没写博客了,这段时间情绪不那么稳定,还是心态的问题... 就简单写个问题的解决方法吧,其实最近遇到的问题蛮多的,就拿这个解决过后又遇到的来写吧. 正如标题一样:VS2013 无法为目标平台“Mic ...
- MySQL 5.7 create VIEW or FUNCTION or PROCEDURE
1.视图 a. CREATE ALGORITHM = UNDEFINED DEFINER = `root`@`localhost` SQL SECURITY INVOKER VIEW `sakila` ...
- Java中，方法的重写、重载的区别，以及多态的实例
首先我们要明白什么是重写和重载 重写(override):子类方法覆盖了父类的方法. (类与类之间继承的关系) 例:父类代码 public class Deng { public void Qi ...