开启火绒时powershell崩溃 - 火绒安全软件

C:\WINDOWS\system32\compattelrunner.exe -cv:ZhKnJltWckWrh0Iy.0.8 -wce:0000000000000218 -m:appraiser.dll -f:DoScheduledTelemetryRun

复制代码

powershell.exe -ExecutionPolicy Restricted -Command
$Res = 0
[UInt64]$MinDiskSpaceThreshold = 25 * 1024 * 1024 * 1024
try {
$SystemDrive = (Get-CimInstance Win32_OperatingSystem).SystemDrive
$SystemDriveLetter = $SystemDrive[0]
$SystemDriveSpace = (Get-Volume -DriveLetter $SystemDriveLetter).SizeRemaining
Write-Host 'Current system drive space:', $SystemDriveSpace.ToString('N0')
if ($SystemDriveSpace -lt $MinDiskSpaceThreshold) {
Write-Host 'System drive space is less than the threshold:', $MinDiskSpaceThreshold.ToString('N0'), 'Applying safeguard.'
$Res = 1
}
} catch {
# Do nothing
}
Write-Host 'Final result:', $Res

复制代码

$ErrorActionPreference = "Stop"
$Res = 0
$MinDiskSpaceThreshold = 25 * 1024 * 1024 * 1024 # 25 GB
try {
Write-Host "获取系统驱动器..."
$SystemDrive = (Get-CimInstance Win32_OperatingSystem).SystemDrive
Write-Host "系统驱动器是：$SystemDrive"
$SystemDriveLetter = $SystemDrive[0]
Write-Host "驱动器字母是：$SystemDriveLetter"
$Volume = Get-Volume -DriveLetter $SystemDriveLetter
Write-Host "驱动器卷信息：$($Volume | Out-String)"
$SystemDriveSpace = $Volume.SizeRemaining
Write-Host "当前可用空间（字节）: $SystemDriveSpace"
if ($SystemDriveSpace -lt $MinDiskSpaceThreshold) {
Write-Host "磁盘空间不足！"
$Res = 1
}
} catch {
Write-Error "发生异常：$($_.Exception.Message)"
}
Write-Host "最终结果: $Res"

复制代码

PS C:\Users\Aalivexy\Desktop> .\test1.ps1
获取系统驱动器...
系统驱动器是：C:
驱动器字母是：C
未经处理的异常: System.AccessViolationException: 尝试读取或写入受保护的内存。这通常指示其他内存已损坏。
在 System.Management.Automation.AmsiUtils.AmsiNativeMethods.AmsiScanBuffer(IntPtr amsiContext, IntPtr buffer, UInt32 length, String contentName, IntPtr amsiSession, AMSI_RESULT& result)
在 System.Management.Automation.AmsiUtils.ScanContent(String content, String sourceMetadata)
在 System.Management.Automation.CompiledScriptBlockData.PerformSecurityChecks()
在 System.Management.Automation.CompiledScriptBlockData.ReallyCompile(Boolean optimize)
在 System.Management.Automation.CompiledScriptBlockData.CompileOptimized()
在 System.Management.Automation.CompiledScriptBlockData.Compile(Boolean optimized)
在 System.Management.Automation.ScriptBlock.GetCodeToInvoke(Boolean& optimized, ScriptBlockClauseToInvoke clauseToInvoke)
在 System.Management.Automation.ScriptBlock.InvokeWithPipeImpl(ScriptBlockClauseToInvoke clauseToInvoke, Boolean createLocalScope, Dictionary`2 functionsToDefine, List`1 variablesToDefine, ErrorHandlingBehavior errorHandlingBehavior, Object dollarUnder, Object input, Object scriptThis, Pipe outputPipe, InvocationInfo invocationInfo, Object[] args)
在 System.Management.Automation.ScriptBlock.<>c__DisplayClass57_0.<InvokeWithPipe>b__0()
在 System.Management.Automation.Runspaces.RunspaceBase.RunActionIfNoRunningPipelinesWithThreadCheck(Action action)
在 System.Management.Automation.ScriptBlock.InvokeWithPipe(Boolean useLocalScope, ErrorHandlingBehavior errorHandlingBehavior, Object dollarUnder, Object input, Object scriptThis, Pipe outputPipe, InvocationInfo invocationInfo, Boolean propagateAllExceptionsToTop, List`1 variablesToDefine, Dictionary`2 functionsToDefine, Object[] args)
在 System.Management.Automation.ScriptBlock.DoInvokeReturnAsIs(Boolean useLocalScope, ErrorHandlingBehavior errorHandlingBehavior, Object dollarUnder, Object input, Object scriptThis, Object[] args)
在 System.Management.Automation.ScriptBlock.InvokeReturnAsIs(Object[] args)
在 Microsoft.PowerShell.Commands.ModuleCmdletBase.LoadModuleManifestData(String moduleManifestPath, ScriptBlock scriptBlock, String[] validMembers, ManifestProcessingFlags manifestProcessingFlags, Boolean& containedErrors)
在 Microsoft.PowerShell.Commands.ModuleCmdletBase.LoadModuleManifestData(ExternalScriptInfo scriptInfo, String[] validMembers, ManifestProcessingFlags manifestProcessingFlags, Boolean& containedErrors)
在 Microsoft.PowerShell.Commands.ModuleCmdletBase.LoadModuleManifestData(ExternalScriptInfo scriptInfo, ManifestProcessingFlags manifestProcessingFlags, Hashtable& data, Hashtable& localizedData, Boolean& containedErrors)
在 Microsoft.PowerShell.Commands.ModuleCmdletBase.LoadModule(PSModuleInfo parentModule, String fileName, String moduleBase, String prefix, SessionState ss, Object privateData, ImportModuleOptions& options, ManifestProcessingFlags manifestProcessingFlags, Boolean& found, Boolean& moduleFileFound)
在 Microsoft.PowerShell.Commands.ImportModuleCommand.ImportModule_LocallyViaName(ImportModuleOptions importModuleOptions, String name)
在 Microsoft.PowerShell.Commands.ImportModuleCommand.ProcessRecord()
在 System.Management.Automation.CommandProcessor.ProcessRecord()
在 System.Management.Automation.CommandProcessorBase.DoExecute()
在 System.Management.Automation.Internal.PipelineProcessor.SynchronousExecuteEnumerate(Object input)
在 System.Management.Automation.Runspaces.LocalPipeline.InvokeHelper()
在 System.Management.Automation.Runspaces.LocalPipeline.InvokeThreadProc()
在 System.Management.Automation.Runspaces.LocalPipeline.StartPipelineExecution()
在 System.Management.Automation.Runspaces.PipelineBase.CoreInvoke(IEnumerable input, Boolean syncCall)
在 System.Management.Automation.Runspaces.PipelineBase.Invoke(IEnumerable input)
在 System.Management.Automation.PowerShell.Worker.ConstructPipelineAndDoWork(Runspace rs, Boolean performSyncInvoke)
在 System.Management.Automation.PowerShell.CoreInvokeHelper[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
在 System.Management.Automation.PowerShell.CoreInvoke[TInput,TOutput](PSDataCollection`1 input, PSDataCollection`1 output, PSInvocationSettings settings)
在 System.Management.Automation.PowerShell.Invoke[T]()
在 System.Management.Automation.CommandDiscovery.AutoloadSpecifiedModule(String moduleName, ExecutionContext context, SessionStateEntryVisibility visibility, Exception& exception)
在 System.Management.Automation.CommandDiscovery.TryModuleAutoDiscovery(String commandName, ExecutionContext context, String originalCommandName, CommandOrigin commandOrigin, SearchResolutionOptions searchResolutionOptions, CommandTypes commandTypes, Exception& lastError)
在 System.Management.Automation.CommandDiscovery.LookupCommandInfo(String commandName, CommandTypes commandTypes, SearchResolutionOptions searchResolutionOptions, CommandOrigin commandOrigin, ExecutionContext context)
在 System.Management.Automation.CommandDiscovery.LookupCommandProcessor(String commandName, CommandOrigin commandOrigin, Nullable`1 useLocalScope)
在 System.Management.Automation.ExecutionContext.CreateCommand(String command, Boolean dotSource)
在 System.Management.Automation.PipelineOps.AddCommand(PipelineProcessor pipe, CommandParameterInternal[] commandElements, CommandBaseAst commandBaseAst, CommandRedirection[] redirections, ExecutionContext context)
在 System.Management.Automation.PipelineOps.InvokePipeline(Object input, Boolean ignoreInput, CommandParameterInternal[][] pipeElements, CommandBaseAst[] pipeElementAsts, CommandRedirection[][] commandRedirections, FunctionContext funcContext)
在 System.Management.Automation.Interpreter.ActionCallInstruction`6.Run(InterpretedFrame frame)
在 System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
在 System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
在 System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
在 System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
在 System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
在 System.Management.Automation.Interpreter.Interpreter.Run(InterpretedFrame frame)
在 System.Management.Automation.Interpreter.LightLambda.RunVoid1[T0](T0 arg0)
在 System.Management.Automation.DlrScriptCommandProcessor.RunClause(Action`1 clause, Object dollarUnderbar, Object inputToProcess)
在 System.Management.Automation.DlrScriptCommandProcessor.Complete()
在 System.Management.Automation.CommandProcessorBase.DoComplete()
在 System.Management.Automation.Internal.PipelineProcessor.DoCompleteCore(CommandProcessorBase commandRequestingUpstreamCommandsToStop)
在 System.Management.Automation.Internal.PipelineProcessor.SynchronousExecuteEnumerate(Object input)
在 System.Management.Automation.PipelineOps.InvokePipeline(Object input, Boolean ignoreInput, CommandParameterInternal[][] pipeElements, CommandBaseAst[] pipeElementAsts, CommandRedirection[][] commandRedirections, FunctionContext funcContext)
在 System.Management.Automation.Interpreter.ActionCallInstruction`6.Run(InterpretedFrame frame)
在 System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
在 System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
在 System.Management.Automation.Interpreter.Interpreter.Run(InterpretedFrame frame)
在 System.Management.Automation.Interpreter.LightLambda.RunVoid1[T0](T0 arg0)
在 System.Management.Automation.DlrScriptCommandProcessor.RunClause(Action`1 clause, Object dollarUnderbar, Object inputToProcess)
在 System.Management.Automation.DlrScriptCommandProcessor.Complete()
在 System.Management.Automation.CommandProcessorBase.DoComplete()
在 System.Management.Automation.Internal.PipelineProcessor.DoCompleteCore(CommandProcessorBase commandRequestingUpstreamCommandsToStop)
在 System.Management.Automation.Internal.PipelineProcessor.SynchronousExecuteEnumerate(Object input)
在 System.Management.Automation.Runspaces.LocalPipeline.InvokeHelper()
在 System.Management.Automation.Runspaces.LocalPipeline.InvokeThreadProc()
在 System.Management.Automation.Runspaces.PipelineThread.WorkerProc()
在 System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
在 System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
在 System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
在 System.Threading.ThreadHelper.ThreadStart()
[已退出进程，代码为 3221225477 (0xc0000005)]

复制代码

PS C:\Users\Aalivexy\Desktop> .\test1.ps1
获取系统驱动器...
系统驱动器是：C:
驱动器字母是：C
驱动器卷信息：
DriveLetter FriendlyName FileSystemType DriveType HealthStatus OperationalStatus SizeRemaining Size
----------- ------------ -------------- --------- ------------ ----------------- ------------- ----
C Windows NTFS Fixed Healthy OK 120.7 GB 899.12 GB
当前可用空间（字节）: 129601699840
最终结果: 0

复制代码