@echo off
::-----------------------------------------------
:: 蓝屏判断处理程序
::-----------------------------------------------
Title [System error checking procedures 1.2]
@echo 蓝屏检测处理程序
pause
::命令开始-----------------------------------
@echo off
:start
if exist %HOMEDRIVE%\backdump del %HOMEDRIVE%\backdump /f /s /q
if not exist %HOMEDRIVE%\backdump md %HOMEDRIVE%\backdump
:Judge
REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\SbieDrv /v ImagePath >nul 2>nul
if %errorlevel%==0 (goto :Shield)
if exist %SYSTEMROOT%\system32\drivers\BaseTdi.sys goto :BaseTdi
if exist %SYSTEMROOT%\system32\drivers\mfesmfk.sys goto :McAfee
if exist %SYSTEMROOT%\system32\drivers\mfehidk.sys goto :McAfee
if exist %SYSTEMROOT%\system32\drivers\mfebopk.sys goto :McAfee
if exist %SYSTEMROOT%\system32\drivers\mfesmfk.sys goto :McAfee
if exist %SYSTEMROOT%\system32\drivers\aswMon2.SYS goto :Avast
if exist %SYSTEMROOT%\system32\Drivers\Aavmker4.SYS goto :Avast
if exist %SYSTEMROOT%\system32\Drivers\aswRdr.SYS goto :Avast
if exist %SYSTEMROOT%\Minidump\ goto :Minidump
goto :endover
:BaseTdi
msg %username% /time:2 系统中存在旧版本瑞星驱动程序,正在清理中请稍等……
reg save HKLM\SYSTEM\CurrentControlSet\Services\BaseTdi %HOMEDRIVE%\backdump\BaseTdi.hiv >nul 2>nul
reg delete HKLM\SYSTEM\CurrentControlSet\Services\BaseTdi /f >nul 2>nul
MOVE /Y %SYSTEMROOT%\system32\drivers\BaseTdi.sys %HOMEDRIVE%\backdump >nul 2>nul
MOVE /Y %SYSTEMROOT%\MEMORY.DMP %SYSTEMROOT%\temp >nul 2>nul
MOVE /Y %SYSTEMROOT%\Minidump\*.dmp %SYSTEMROOT%\temp >nul 2>nul
if not exist %SYSTEMROOT%\system32\drivers\BaseTdi.sys goto :start
:Shield
msg %username% 您的计算机中存在360安全浏览器或沙盘程序,请卸载或更新其程序。
goto :end
:Avast
msg %username% 您的计算机中存在avast! antivirus软件请手动进行卸载。
goto :end
:McAfee
msg %username% 您的计算机中存在McAfee(麦咖啡)软件请手动进行卸载。
goto :end
:MEMORYDMP
msg %username% /time:5 正在复制(核心内存转储文件)到backdump目录请稍等!
copy %SYSTEMROOT%\MEMORY.DMP %HOMEDRIVE%\backdump
goto :end
:Minidump
msg %username% /time:5 正在复制(小内存转储文件)到backdump目录请稍等!
copy %SYSTEMROOT%\Minidump\*.* %HOMEDRIVE%\backdump
goto :end
:end
explorer %HOMEDRIVE%\backdump
exit
:endover
msg %username% 请重新启动计算机后确认蓝屏是否依旧存在。
exit
::命令结束-----------------------------------