|
|
1.清理开始菜单残留uwp图标
@echo off
bcdedit >nul 2>&1 && goto :main
mshta vbscript:createobject("shell.application").shellexecute("%~f0","","","runas",1)(window.close)
exit
:main
title 清理开始菜单残留
powershell -NoProfile -ExecutionPolicy Bypass -Command "$f='%~f0'; $c=Get-Content -LiteralPath $f; $n=($c | Select-String -Pattern '^::PSBEGIN::$').LineNumber; Invoke-Expression ($c[$n..($c.Count-1)] -join [char]10)"
exit
::PSBEGIN::
$ErrorActionPreference = 'Continue'
Write-Host "===== 开始菜单残留一键清理 =====" -ForegroundColor Cyan
# 系统关键包保护名单（family 名前缀匹配），绝不碰
$script:protected = @(
'Microsoft.Windows.StartMenuExperienceHost',
'Microsoft.Windows.ShellExperienceHost',
'Microsoft.Windows.Cortana',
'Microsoft.AAD.BrokerPlugin',
'Microsoft.Windows.CloudExperienceHost',
'Microsoft.AccountsControl',
'Microsoft.LockApp',
'Microsoft.Windows.AssignedAccessLockApp',
'Microsoft.Windows.ContentDeliveryManager',
'Microsoft.Windows.Oobenetworkconnectionflow',
'Microsoft.Windows.Oobenetworkcaptiveportal',
'Microsoft.Windows.PeopleExperienceHost',
'Microsoft.Windows.PinningConfirmationDialog',
'Microsoft.Windows.SecHealthUI',
'Microsoft.Windows.SecureAssessmentBrowser',
'Microsoft.Windows.XGpuEjectDialog',
'Microsoft.XboxGameCallableUI',
'MicrosoftWindows.Client.CBS',
'MicrosoftWindows.Client.Core',
'MicrosoftWindows.UndockedDevKit',
'Microsoft.UI.Xaml',
'Microsoft.VCLibs',
'Microsoft.NET.Native',
'Microsoft.Services.Store.Engagement',
'Microsoft.WindowsStore',
'Microsoft.StorePurchaseApp',
'Microsoft.DesktopAppInstaller',
'Microsoft.WebMediaExtensions',
'NVIDIA'
)
function Test-Protected([string]$name) {
if ([string]::IsNullOrEmpty($name)) { return $false }
foreach ($pre in $script:protected) { if ($name.StartsWith($pre, [StringComparison]::OrdinalIgnoreCase)) { return $true } }
return $false
}
$actions = 0
# ---------- 1. UWP 注册残留：包记录还在，文件已没 ----------
Write-Host "`n[1/3] 清理 UWP 注册残留..." -ForegroundColor Yellow
try {
$ghosts = @(Get-AppxPackage -AllUsers -ErrorAction Stop | Where-Object {
-not $_.IsFramework -and -not $_.NonRemovable -and
-not (Test-Protected $_.PackageFamilyName) -and
([string]::IsNullOrEmpty($_.InstallLocation) -or -not (Test-Path -LiteralPath $_.InstallLocation))
})
if ($ghosts.Count -eq 0) {
Write-Host " 无残留" -ForegroundColor Green
} else {
foreach ($g in $ghosts) {
try {
Remove-AppxPackage -Package $g.PackageFullName -AllUsers -ErrorAction Stop
Write-Host (" 已注销: " + $g.Name) -ForegroundColor Green
$actions++
} catch {
Write-Host (" 失败: " + $g.Name + " - " + $_.Exception.Message) -ForegroundColor Red
}
}
}
} catch {
Write-Host (" 枚举失败: " + $_.Exception.Message) -ForegroundColor Red
}
# ---------- 2. 预配包（会自动装回来的源头）----------
Write-Host "`n[2/3] 清理预配包..." -ForegroundColor Yellow
try {
$prov = @(Get-AppxProvisionedPackage -Online -ErrorAction Stop | Where-Object { -not (Test-Protected $_.DisplayName) })
if ($prov.Count -eq 0) {
Write-Host " 无预配包" -ForegroundColor Green
} else {
foreach ($pp in $prov) {
try {
Remove-AppxProvisionedPackage -Online -PackageName $pp.PackageName -AllUsers -ErrorAction Stop | Out-Null
Write-Host (" 已移除: " + $pp.DisplayName) -ForegroundColor Green
$actions++
} catch {
Write-Host (" 失败: " + $pp.DisplayName + " - " + $_.Exception.Message) -ForegroundColor Red
}
}
}
} catch {
Write-Host (" 枚举失败: " + $_.Exception.Message) -ForegroundColor Red
}
# ---------- 3. 开始菜单失效 .lnk ----------
Write-Host "`n[3/3] 清理失效快捷方式..." -ForegroundColor Yellow
$menuDirs = @(
"$env:ProgramData\Microsoft\Windows\Start Menu\Programs",
"$env:AppData\Microsoft\Windows\Start Menu\Programs"
)
$shell = New-Object -ComObject WScript.Shell
$dead = @()
foreach ($d in $menuDirs) {
if (-not (Test-Path $d)) { continue }
Get-ChildItem -LiteralPath $d -Recurse -Filter *.lnk -ErrorAction SilentlyContinue | ForEach-Object {
try {
$sc = $shell.CreateShortcut($_.FullName)
$t = [Environment]::ExpandEnvironmentVariables($sc.TargetPath)
if ($t -and ($t -match '^[A-Za-z]:\\') -and -not (Test-Path -LiteralPath $t)) {
$dead += $_.FullName
}
} catch { }
}
}
if ($dead.Count -eq 0) {
Write-Host " 无失效快捷方式" -ForegroundColor Green
} else {
foreach ($x in $dead) {
try {
Remove-Item -LiteralPath $x -Force -ErrorAction Stop
Write-Host (" 已删除: " + $x) -ForegroundColor Green
$actions++
} catch {
Write-Host (" 失败: " + $x + " - " + $_.Exception.Message) -ForegroundColor Red
}
}
}
# ---------- 收尾 ----------
Write-Host "`n===== 完成：共处理 $actions 项 =====" -ForegroundColor Cyan
& ie4uinit.exe -show 2>$null
Write-Host "提示：开始菜单如仍有残留图标，注销或重启后自动消失。" -ForegroundColor DarkYellow
2.清理系统日志
@echo off
title 一键清理系统日志
:: ============================================================
:: 清理系统日志与使用痕迹
:: 包含：事件日志 / CBS、DISM等安装日志 / 错误报告WER /
:: 崩溃转储 / 系统LogFiles / WinSAT / 使用痕迹 /
:: 程序打开记录（UserAssist/Prefetch/RecentApps等）
:: 说明：占用中的文件会静默删除失败（正常现象）
:: ============================================================
bcdedit >nul 2>&1
if '%errorlevel%' NEQ '0' (goto UACPrompt) else (goto UACAdmin)
:UACPrompt
%1 start "" mshta vbscript:CreateObject("Shell.Application").ShellExecute("""%~f0""","::",,"runas",1)(window.close)&exit
:UACAdmin
cd /d "%~dp0"
echo ============================================================
echo [1/7] 清除全部 Windows 事件日志（应用程序/系统/安全等）
echo ============================================================
for /f "tokens=*" %%a in ('wevtutil el') do (
wevtutil cl "%%a" >nul 2>&1
)
echo 完成。
echo.
echo ============================================================
echo [2/7] 清除 CBS / DISM / 其他安装日志
echo ============================================================
del /f /q "%windir%\Logs\CBS\*.log" >nul 2>&1
del /f /q "%windir%\Logs\CBS\*.cab" >nul 2>&1
del /f /q "%windir%\Logs\DISM\*.log" >nul 2>&1
del /f /q "%windir%\Logs\MoSetup\*.log" >nul 2>&1
del /f /q "%windir%\Logs\NetSetup\*.log" >nul 2>&1
del /f /q "%windir%\inf\setupapi.*.log" >nul 2>&1
del /f /q "%windir%\WindowsUpdate.log" >nul 2>&1
del /f /q "%windir%\SoftwareDistribution\ReportingEvents.log" >nul 2>&1
echo 完成。
echo.
echo ============================================================
echo [3/7] 清除系统安装/升级日志（Panther 等）
echo ============================================================
rd /s /q "%windir%\Panther" >nul 2>&1
rd /s /q "%windir%\Logs\SIH" >nul 2>&1
rd /s /q "%windir%\Logs\waasmedic" >nul 2>&1
rd /s /q "%windir%\Logs\Diagnostic" >nul 2>&1
del /f /s /q "%windir%\Logs\*.*" >nul 2>&1
echo 完成。
echo.
echo ============================================================
echo [4/7] 清除 Windows 错误报告（WER）
echo ============================================================
rd /s /q "%ProgramData%\Microsoft\Windows\WER\ReportArchive" >nul 2>&1
rd /s /q "%ProgramData%\Microsoft\Windows\WER\ReportQueue" >nul 2>&1
rd /s /q "%ProgramData%\Microsoft\Windows\WER\Temp" >nul 2>&1
rd /s /q "%LOCALAPPDATA%\Microsoft\Windows\WER\ReportArchive" >nul 2>&1
rd /s /q "%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue" >nul 2>&1
echo 完成。
echo.
echo ============================================================
echo [5/7] 清除崩溃转储（minidump/完整dump/内核实时转储）
echo ============================================================
del /f /q "%windir%\Minidump\*.dmp" >nul 2>&1
del /f /q "%windir%\MEMORY.DMP" >nul 2>&1
del /f /s /q "%windir%\LiveKernelReports\*.*" >nul 2>&1
rd /s /q "%LOCALAPPDATA%\CrashDumps" >nul 2>&1
echo 完成。
echo.
echo ============================================================
echo [6/7] 清除系统 LogFiles（WMI/性能/防火墙计费/扫描等）
echo ============================================================
del /f /s /q "%windir%\System32\LogFiles\WMI\*.*" >nul 2>&1
del /f /s /q "%windir%\System32\LogFiles\SQM\*.*" >nul 2>&1
del /f /s /q "%windir%\System32\LogFiles\Scm\*.*" >nul 2>&1
del /f /s /q "%windir%\System32\LogFiles\AIT\*.*" >nul 2>&1
del /f /s /q "%windir%\System32\LogFiles\setupcln\*.*" >nul 2>&1
del /f /s /q "%windir%\System32\winevt\Logs\Archive*.*" >nul 2>&1
echo 完成。
echo.
echo ============================================================
echo [7/7] 清除 WinSAT 评分 / 电源诊断报告
echo ============================================================
del /f /s /q "%windir%\Performance\WinSAT\DataStore\*.*" >nul 2>&1
del /f /q "%windir%\System32\energy-report.html" >nul 2>&1
del /f /q "%windir%\System32\sleepstudy-report.html" >nul 2>&1
del /f /q "%windir%\System32\battery-report.html" >nul 2>&1
echo 完成。
echo.
echo ============================================================
echo [8/8] 清除使用痕迹（运行历史/最近文档/执行缓存等）
echo ============================================================
:: 运行对话框历史 + 注册表编辑器当前位置
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /f >nul 2>&1
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit" /v "LastKey" /f >nul 2>&1
:: 最近打开的文档 + 跳转列表
del /f /s /q "%APPDATA%\Microsoft\Windows\Recent\*.*" >nul 2>&1
del /f /s /q "%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.*" >nul 2>&1
del /f /s /q "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\*.*" >nul 2>&1
:: 程序缓存痕迹（资源监视器记录）
reg delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f >nul 2>&1
for /f "tokens=*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist"') do (
reg delete "%%a" /f >nul 2>&1
)
:: PowerShell / CMD 命令历史
del /f /q "%APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" >nul 2>&1
:: 程序执行缓存（取证工具读取的缓存重建）
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache" /v "AppCompatCache" /f >nul 2>&1
del /f /q "%windir%\AppCompat\Programs\Amcache.hve" >nul 2>&1
del /f /q "%windir%\AppCompat\Programs\RecentFileCache.bcf" >nul 2>&1
echo 完成。
echo.
echo ============================================================
echo [9/9] 补充清理程序打开记录（LastActivityView 数据源）
echo ============================================================
:: 最近文档（注册表）
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" /f >nul 2>&1
:: 打开/保存对话框历史（文件对话框记录）
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32" /f >nul 2>&1
:: 资源管理器地址栏输入历史
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths" /f >nul 2>&1
:: 开始菜单搜索历史
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery" /f >nul 2>&1
:: 最近使用/运行过的应用（Windows Search）
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Search\RecentApps" /f >nul 2>&1
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Search\RecentItems" /f >nul 2>&1
:: 资源管理器文件夹/地址栏历史（BagMRU + Bags）
reg delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU" /f >nul 2>&1
reg delete "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags" /f >nul 2>&1
:: UserAssist 再补一次（确保键本身也删掉）
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f >nul 2>&1
:: Prefetch 预读取（程序启动痕迹）
del /f /q "%windir%\Prefetch\*.pf" >nul 2>&1
del /f /q "%windir%\Prefetch\*.pf.done" >nul 2>&1
rd /s /q "%windir%\Prefetch\ReadyBoot" >nul 2>&1
:: Amcache 剩余附属文件
del /f /q "%windir%\AppCompat\Programs\Amcache.hve.LOG*" >nul 2>&1
del /f /q "%windir%\AppCompat\Programs\Amcache.hve.TXT" >nul 2>&1
del /f /q "%windir%\AppCompat\Programs\Amcache.hve.BAK" >nul 2>&1
:: Windows 时间线/活动历史数据库（Timeline）
rd /s /q "%LOCALAPPDATA%\ConnectedDevicesPlatform" >nul 2>&1
rd /s /q "%LOCALAPPDATA%\Microsoft\Windows\ConnectedSearch" >nul 2>&1
del /f /s /q "%LOCALAPPDATA%\Microsoft\Windows\Activity\*.*" >nul 2>&1
echo 完成。
echo.
echo ============================================================
echo 全部清理完成！
echo ============================================================
3刷新当前系统时间
@echo off
setlocal
title 免服务同步时间
if exist "%SystemRoot%\SysWOW64" path %path%;%windir%\SysNative;%SystemRoot%\SysWOW64;%~dp0
bcdedit >nul
if '%errorlevel%' NEQ '0' (goto UACPrompt) else (goto UACAdmin)
:UACPrompt
%1 start "" mshta vbscript:createobject("shell.application").shellexecute("""%~0""","::",,"runas",1)(window.close)&exit
exit /B
:UACAdmin
cd /d "%~dp0"
echo ============================================
echo 免服务同步时间 (无需 Windows Time 服务)
echo ============================================
echo.
powershell -NoProfile -ExecutionPolicy Bypass -Command "$c=Get-Content -LiteralPath '%~f0' -Raw -Encoding Default; $m=[char]60+'#PS#'+[char]62; $i=$c.IndexOf($m); if($i -lt 0){Write-Host 'ERR: marker not found'; pause; exit 1}; Invoke-Expression $c.Substring($i+6)"
echo.
echo ============================================
<#PS#>
$ErrorActionPreference = 'Stop'
$cs = @'
using System;
using System.Net;
using System.Net.Sockets;
using System.Runtime.InteropServices;
public static class NtpSync
{
[StructLayout(LayoutKind.Sequential)]
private struct SystemTime
{
public ushort Year, Month, DayOfWeek, Day, Hour, Minute, Second, Millisecond;
}
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool SetSystemTime(ref SystemTime st);
private static DateTime GetNtpTime(string server, int timeoutMs)
{
byte[] ntpData = new byte[48];
ntpData[0] = 0x1B; // LI=0, VN=3, Mode=3 (client)
using (UdpClient udp = new UdpClient())
{
udp.Connect(server, 123);
udp.Client.ReceiveTimeout = timeoutMs;
udp.Send(ntpData, ntpData.Length);
IPEndPoint ep = new IPEndPoint(IPAddress.Any, 0);
byte[] resp = udp.Receive(ref ep);
// 传输时间戳位于字节 40-47
ulong intPart = ((ulong)resp[40] << 24) | ((ulong)resp[41] << 16) | ((ulong)resp[42] << 8) | (ulong)resp[43];
ulong fracPart = ((ulong)resp[44] << 24) | ((ulong)resp[45] << 16) | ((ulong)resp[46] << 8) | (ulong)resp[47];
double ntpSecs = (double)intPart + (double)fracPart / 4294967296.0;
DateTime epoch = new DateTime(1900, 1, 1, 0, 0, 0, DateTimeKind.Utc);
return epoch.AddSeconds(ntpSecs);
}
}
public static string SetTimeFromServer(string server, int timeoutMs)
{
DateTime utc = GetNtpTime(server, timeoutMs);
// SetSystemTime 要求 UTC
SystemTime st = new SystemTime();
st.Year = (ushort)utc.Year;
st.Month = (ushort)utc.Month;
st.DayOfWeek = (ushort)utc.DayOfWeek;
st.Day = (ushort)utc.Day;
st.Hour = (ushort)utc.Hour;
st.Minute = (ushort)utc.Minute;
st.Second = (ushort)utc.Second;
st.Millisecond = (ushort)utc.Millisecond;
if (!SetSystemTime(ref st))
{
int err = Marshal.GetLastWin32Error();
return "ERR:" + err;
}
return "OK:" + utc.ToLocalTime().ToString("yyyy-MM-dd HH:mm:ss");
}
}
'@
Add-Type -TypeDefinition $cs -ReferencedAssemblies 'System.dll', 'System.Net.dll'
$servers = @('ntp.aliyun.com', 'time.windows.com', 'time.nist.gov', 'pool.ntp.org')
$ok = $false
Write-Host "=== 免服务同步系统时间 ===" -ForegroundColor Cyan
Write-Host "方式: UDP 直连 NTP -> SetSystemTime (不启动 w32time 服务)"
Write-Host ""
foreach ($s in $servers) {
Write-Host ("[尝试] {0} ..." -f $s) -ForegroundColor DarkGray
try {
$r = [NtpSync]::SetTimeFromServer($s, 3000)
if ($r.StartsWith('OK:')) {
Write-Host ("[成功] 服务器: {0} 系统时间已设为: {1}" -f $s, $r.Substring(3)) -ForegroundColor Green
$ok = $true
break
} else {
Write-Host ("[错误] 设置失败 (Win32: {0})" -f $r) -ForegroundColor Yellow
}
} catch {
Write-Host ("[失败] {0} 原因: {1}" -f $s, $_.Exception.Message) -ForegroundColor Yellow
}
}
Write-Host ""
if ($ok) {
Write-Host ("当前系统时间: {0}" -f (Get-Date).ToString('yyyy-MM-dd HH:mm:ss')) -ForegroundColor Green
Write-Host "同步完成。" -ForegroundColor Green
} else {
Write-Host "所有时间服务器均连接失败，请检查网络/防火墙(需放行 UDP 123)。" -ForegroundColor Red
exit 1
}
4.修改系统安装时间到当前
@echo off
setlocal EnableExtensions
title 修改系统安装日期为当前时间
set "drv=%~d0"
if "%drv:~0,2%"=="\\" (
echo [X] 脚本位于共享文件夹/网络路径，提权后将无法访问
echo 请先复制到虚拟机本地磁盘（如 C:\Temp 或桌面）再运行
echo.
exit /b 1
)
bcdedit >nul 2>&1
if not errorlevel 1 goto gotAdmin
echo 正在请求管理员权限...
mshta vbscript:createobject("shell.application").shellexecute("%~f0","","","runas",1)(window.close) & exit /b
:gotAdmin
cd /d "%~dp0"
echo.
echo [1/3] 获取当前时间戳（Unix 秒 + FILETIME）...
set "ts="
set "ft="
for /f %%i in ('powershell -NoProfile -Command "try{[DateTimeOffset]::Now.ToUnixTimeSeconds()}catch{[int64]((Get-Date).ToUniversalTime()-(Get-Date \"1970-01-01\")).TotalSeconds}"') do set "ts=%%i"
for /f %%i in ('powershell -NoProfile -Command "[DateTime]::Now.ToFileTime()"') do set "ft=%%i"
if not defined ts (
echo [X] 获取时间戳失败
exit /b 1
)
if not defined ft (
echo [X] 获取 FILETIME 失败
exit /b 1
)
echo Unix 秒 : %ts% (InstallDate 用，WMI/systeminfo/检测工具读这个)
echo FILETIME: %ft% (InstallTime 用，设置-关于页读这个)
echo.
echo [2/3] 写入注册表...
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_DWORD /d %ts% /f /reg:64
if errorlevel 1 (
echo [X] InstallDate 写入失败
exit /b 1
)
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallTime /t REG_QWORD /d %ft% /f /reg:64
if errorlevel 1 (
echo [X] InstallTime 写入失败
exit /b 1
)
echo.
echo [3/3] 验证:
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallDate /reg:64
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallTime /reg:64
for /f "delims=" %%d in ('powershell -NoProfile -Command "[DateTime]::FromFileTime([int64]%ft%).ToString(\"yyyy-MM-dd HH:mm:ss\")"') do echo 对应日期: %%d
echo.
echo [OK] 完成，系统安装日期已修改为当前时间
|
-
-
常用脚本.rar
7.34 KB, 下载次数: 64, 下载积分: 无忧币 -2
|
闽公网安备35020302032614号 )
IP卡
狗仔卡
发表于 
提升卡
沉默卡
喧嚣卡
变色卡
千斤顶
显身卡