修改后的kabs.vbs

'kill all but system
'By spark

Dim strComputer,astr,Wshshell,objWMIService,ps

strComputer = "." '设置要操作的计算机
astr = "Select * from Win32_Process" '查询语句
set WshShell=wScript.CreateObject("WScript.Shell")
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery _
(astr)

Function ntsdkill(Byref pid)
If pid<5 then
ntsdkill = false
Exit Function
End if
ntsdkill = "ntsd -c q -p" + " " + pid
'set WshShell=wScript.CreateObject("WScript.Shell")
WshShell.exec ntsdkill
End Function

'kill begin

For Each ps in colProcessList
ps.name = LCase(ps.name) 'LCase(string)返回字符串小写
If(ps.handle = 0)then
'elseif(ps.handle = 4)then
elseif(ps.name = "smss.exe")then
elseif(ps.name = "winlogon.exe")then
elseif(ps.name = "services.exe")then
elseif(ps.name = "lsass.exe")then
elseif(ps.name = "csrss.exe")then
elseif(ps.name = "wscript.exe")then
elseif(ps.name = "alg.exe")then
elseif(ps.name = "ctfmon.exe")then
elseif(ps.name = "explorer.exe")then
elseif(ps.name = "stylexpservice.exe")then
elseif(ps.name = "syssafe.exe")then
elseif(ps.name = "msmpeng.exe")then
elseif(ps.name = "soundman.exe")then
elseif(ps.name = "svchost.exe")then
elseif(ps.name = "keyhook.exe")then
elseif(ps.name = "fscp.exe")then
elseif(ps.name = "qkqnbtn.exe")then
elseif(ps.name = "sistray.exe")then
elseif(ps.name = "wmplayer.exe")then
elseif(ps.name = "conime.exe")then
elseif(ps.Terminate() = 0) then
else
ntsdkill(ps.handle)
End if
Next