China DOS Union

This virus immunity package is made based on the Sanlian virus 5.30 immunity package.
The principle is still to prevent the generation of virus files by using 0kb-sized folders to block them to prevent known viruses.
Finally, thanks to Sanlian and all enthusiastic netizens. Let's join hands together to resist viruses and trojans.
The version number of this virus immunity package is 20070904
The latest updated version number is 20071001. The update date is October 1, 2007. Basically, it immunizes against various common malignant viruses and trojan groups. The next version will prevent unknown viruses.
Usage method: Just double-click to run. Those who have installed the old version patch can also directly run this immunity patch
The program can directly skip the old version patch and install the new immunity file.
If there is a BUG, or if you provide a virus sample, please contact QQ: 38463179 E-MAIL: angel144@yeah.net Shenlan
Thank you.
Supplementary note: The description in the virus immunity package is not entirely accurate. It is to add some registry contents. Mainly to prevent particularly malignant viruses.

[ Last edited by angel144 on 2007-10-1 at 11:24 AM ]

Obviously modified the registry
The statement also says it wasn't modified

Since it has been modified. Then delete it

[ Last edited by knoppix7 on 2007-9-19 at 05:53 PM ]

Reply to Floor 2 and Floor 3

The instructions inside were copied from Sanlian originally. I didn't read them carefully.

Now I'm redoing the instructions. Indeed, a part of the registry has been added.

It's mainly for the prevention of registry image hijacking of particularly malicious viruses. I think most people here are more capable than me, and should also be able to understand it.

This immunity package is purely a batch file. Everyone can check the content of the batch file to see exactly what changes have been made to the system. Do I understand the registry? Actually, to be honest, not very much. I haven't deeply understood many things yet.

Of course, in any case, the immunity instructions were indeed incorrect. Here, I want to apologize to everyone. The instructions will be modified in future versions. Those who find it not useful can not use it, and there's no need to say more about this.

Finally, thank you to friends Floor 2 and Floor 3 for the reminders.

[ Last edited by angel144 on 2007-9-18 at 11:11 PM ]

//Mainly for the prevention of registry image hijacking of particularly malignant viruses

Really can't see what this can prevent
The original intention of doing this is to make the virus unable to run, right
But the virus can consider deleting these key values first, heh heh

So long, no credit but also hard work. Thanks for your hard work. Keep up the good work.

Originally posted by HAT at 2007-9-19 03:48 AM:
//Mainly for the prevention of registry image hijacking of particularly malignant viruses

I really can't see what this can prevent
The original intention of doing this is to prevent the virus from running
But the virus can consider deleting these key values first, heh heh

At present, the virus has not considered it.
And the common trojans are already immune now and cannot be generated. Of course, trojans and viruses can also
consider setting the immune folder permissions to full control and then generating. But at present, no trojans and viruses have done this. To be precise, most trojans and viruses have not done this. And
according to the actual effect, this thing is still okay. After installing it, the probability of getting infected is basically very low.
The principle is very simple, but it is difficult to collect all. It will be updated once a month in the future. Hehe, experts please forgive me

//Mainly to prevent registry image hijacking of particularly malicious viruses
If you can use command-line tools to modify the permissions of registry entries.
It should be able to prevent image hijacking

Is there a program that can't be uninstalled? I installed it, but I can't delete it.

Originally posted by kaidashi01 at 2007-9-19 06:58 PM:
Is there any uninstall program? I installed it but can't delete it.

Uninstalling is simple. Reset the permissions and then delete the empty folders.
I'm sorry, but I'm currently very busy with work. I really don't have extra time to make an uninstall program. When I have time later, I will release it along with the uninstall program. Thank you

Originally posted by knoppix7 at 2007-9-19 06:30 PM:
//Mainly for the prevention of registry image hijacking by particularly malignant viruses
If you can use command-line tools to modify the permissions of registry keys.
It should be possible to prevent image hijacking

Using the setacl tool can be done in combination. Currently, I am considering using the setacl tool
to lock certain important key values in the registry to prevent unknown viruses. Mainly considering
whether it is convenient for everyone to use. Or you can write two batch files. When needed,
unlock them. Usually, lock them. Subsequent versions will attempt to improve in this regard.

The building owner has worked hard... Adding points...

// It can be done with the setacl tool. Currently, I'm considering using the setacl tool to lock some important key values in the registry to prevent unknown viruses.

After modifying the registry in your program, set the permissions of this key value with the setacl command, which should be able to prevent some unknown viruses. Because some viruses add key values here to disable antivirus software.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

The suggestion from the brother on floor 14 is not bad. I didn't consider preventing the anti-virus software from being disabled. Because I'm in the internet café industry and rarely use anti-virus software. I think I should consider the universality of the application and set this to read-only.

In addition, what I most want to set permissions for are run runonce and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

These key values, as well as the system.ini and win.ini files, to prevent the self-start of unknown viruses.
Just will this cause errors when everyone installs normal software?
All compatibility and feasibility are still in the testing stage.