利用软件安全策略禁止活动盘符可执行文件运行
免疫时先拔下U盘
@ECHO OFF
SETLOCAL ENABLEDELAYEDEXPANSION
SET REGPATH=HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1979a749-e808-fe92-174a-
SET VAR=0123456789abcdefghijklmnopqrstuvwxyz
SET PART=%var:~12%
fsutil fsinfo drives >%temp%\part.dat
for /l %%i in (0,1,23) do find /i "!part:~%%i,1!" %temp%\part.dat 2>nul 1>nul||set disk=!disk!!part:~%%i,1!
for /l %%x in (0,1,2) do (
for /l %%i in (0,1,11) do (
set /a newrandom=!random!%%16
call set ranos=%%var:~!newrandom!,1%%!ranos!
)
REG ADD "%regpath%!ranos!}" /v SaferFlags /t REG_DWORD /d 0 /f >nul
REG ADD "%regpath%!ranos!}" /v ItemData /t REG_EXPAND_SZ /d !disk:~%%x,1!:\ /f >nul
REG ADD "%regpath%!ranos!}" /v LastModified /t REG_BINARY /d 0 /f >nul
REG ADD "%regpath%!ranos!}" /v Description /d !disk:~%%x,1! /f >nul
set ranos=
)
echo n|gpupdate /Force >nul
pause
@ECHO OFF
SETLOCAL ENABLEDELAYEDEXPANSION
SET REGPATH=HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1979a749-e808-fe92-174a-
SET VAR=0123456789abcdefghijklmnopqrstuvwxyz
SET PART=%var:~12% //part=cdefghijklmnopqrstuvwxyz
fsutil fsinfo drives >%temp%\part.dat //得到当前使用中的盘符
for /l %%i in (0,1,23) do find /i "!part:~%%i,1!" %temp%\part.dat 2>nul 1>nul||set disk=!disk!!part:~%%i,1! //生成未使用盘符变量disk
for /l %%x in (0,1,2) do ( //提取未使用盘符中的前三个
for /l %%i in (0,1,11) do (
set /a newrandom=!random!%%16
call set ranos=%%var:~!newrandom!,1%%!ranos! //生成12位16进制随机数
)
REG ADD "%regpath%!ranos!}" /v SaferFlags /t REG_DWORD /d 0 /f >nul //写注册表
REG ADD "%regpath%!ranos!}" /v ItemData /t REG_EXPAND_SZ /d !disk:~%%x,1!:\ /f >nul
REG ADD "%regpath%!ranos!}" /v LastModified /t REG_BINARY /d 0 /f >nul
REG ADD "%regpath%!ranos!}" /v Description /d !disk:~%%x,1! /f >nul
set ranos=
)
echo n|gpupdate /Force >nul //刷新策略
pause
Last edited by everest79 on 2008-1-5 at 03:42 PM ]
晕,不小心在U盘里运行这个BAT文件.
现在一插U盘就自动播放了.问我要做什么操作
我以前一直是直接运行gpedit.msc 在管理模版/系统里关闭自动播放
