China DOS Union

【Discussion】Farewell to Antivirus Software, Build a Personalized Green System
I don't know if it's appropriate to post this thread in this forum, but I think it's closely related to some commands of batch processing, such as reg, Secedit, cacls, etc.
I'll post it first and see everyone's opinions.
-----------------------------------------
My idea is roughly as follows:
I think antivirus mainly lies in prevention:

Virus infection is nothing more than the virus modifying system files or adding some files to the system. Now I want to use the method of setting permissions for directories or files + monitoring file modifications and creations to bid farewell to antivirus software.
So the main thing is file monitoring. There are many software for registry monitoring and system file monitoring on the Internet. Choose a green, small-sized and practical one (preferably write one by yourself, so that if something abnormal is found, you know how to deal with it).

So I come to the following two points:
1. First install all the software you like (green versions), to ensure a virus-free environment.
2. Use an account with lower than administrator privileges to use the system, and always monitor the changes of system files.
-----------------------------------------

I'm not very knowledgeable, just this idea. If everyone thinks I'm daydreaming, then forget it. I just want to know how far this idea is from reality.

[ Last edited by plp626 on 2009-9-3 at 05:17 ]

I am currently, generally, destroying the system myself, and it has nothing to do with viruses
Keep patching the system, browsers, and other software
Also install an ARP firewall
Be careful when downloading and installing software at ordinary times, and don't download things from garbage stations.
This is prevention
Pay attention to hygiene and get vaccinated before getting sick, this is prevention

Hey, usually when browsing normal websites and downloading things, don't just download randomly when you find something. When an external USB drive comes, first check it.

When watching adult content, keep an eye on processes, restrict the system drive, and after watching, lift the restriction when没事. That's it.

Just use a shadow system.

First of all, we must download the program. A program obtained through downloading has risks.
To use this software, you must install or run it. Installing or running requires permissions, especially during the installation process.
As long as this permission is obtained, then the computer is at its mercy...
During the installation process, some files are written or the program is run, and it is difficult for us to monitor and judge... Because we don't know what it is actually doing.

Then it should be run in a virtual machine. Do whatever you want to tinker with.

Yeah, someone wants to solve the problem manually.
It's about whose shortcomings have made the antivirus software earn money and made us toss around...

[ Last edited by 523066680 on 2009-9-3 at 21:42 ]

Not feasible!

I once also tried without antivirus software. It seemed possible to prevent ordinary viruses, but now many viruses are infection - type, adding themselves to EXE files, and not changing system settings. Many of my software have become the same icon. So depressed!

assoc._xe=exefile

I have changed as much as I can, and for the EXEs that can't be changed, I backed them up in compressed packages. Or just set them to have only read permissions

Originally posted by yishanju at 2009-9-3 05:53 PM:
Then it should be run in a virtual machine, you can mess around casually,

I don't know much about the operating mechanism of virtual machines. Besides, it's very easy for a virus to damage the virtual machine.

Now I'm temporarily using the restore wizard (of course, it's easy for a virus to remove it). The number of files after installation is small, which is convenient for research.

The building owner's suggestion is very good. I also recently uninstalled nod32. Just using Fengyun Firewall plus software policies, NTFS permissions, and registry permissions can prevent small viruses. Everyone might as well take a look at the batch processing of Wasqu from Carf:
@echo off
color 2f
Set Prog=Wasqu - Self - Startup (Directory & Registry Key Value) Protection
Set L1=　　　　　　　 ╭───────────────────╮
Set L2=　　　　　　╭─┤%Prog% ├─╮
Set L3=　　　　　　│ ╰───────────────────╯　│
Set L4=　　　　　　│==============================================│
Set L5=　　　　　　│ For netizens' communication　 Piracy is not investigated │
Set L6=　　　　　　╰───────────────────────╯
set ofn=[1 17 8]
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WSQ" /s |find /I "AUTORUNR" >nul 2>nul||set ofn=[8]
if "%ofn%"=="[1 17 8]" (
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WSQ" /f /v "AUTORUNR" >nul 2>nul
set caclsRF=F
set endr=Cancel!!
set endra=Enable! "Protection", please re - run this program
)
if "%ofn%"=="[8]" (
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\WSQ" /v "AUTORUNR" /t reg_sz /d "Wasqu - Self - Startup (Directory & Registry Key Value) Protection" /f >nul 2>nul
set caclsRF=R
set endr=Enable!!
set endra=Cancel! "Protection", please re - run this program
echo Remove dangerous command USER permissions……
echo Unconditionally prohibit automatic running characteristics to prevent viruses……
echo Repair disk open association……
echo Clear unused automatic loading key values……
)
Title %endr%Wasqu - Self - Startup (Directory & Registry Key Value) Protection
:::Unconditionally prohibit automatic running characteristics to prevent viruses……
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveAutoRun /t REG_BINARY /d ffffff03 /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t REG_DWORD /d 0x00000001 /f>nul 2>nul
:::Repair disk open association……
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f>nul 2>nul
:::Clear automatic loading key values……
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SoundMam /f>nul 2>nul
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wincfgs /f>nul 2>nul
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /f>nul 2>nul
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /f>nul 2>nul
:::Modify directory permissions to prevent viruses or trojans from damaging the system ……
CALL :cacls_exe
Echo %endr%Self - startup directory permission protection ……
Echo %endr%Self - startup directory permission protection ……>list
echo Y|cacls "%USERPROFILE%\「Start」Menu\Programs\Startup" /C /P everyone:R Administrators:%caclsRF% SYSTEM:%caclsRF%>nul 2>nul
Cacls "%USERPROFILE%\「Start」Menu\Programs\Startup" /E /C /R Administrator >nul 2>nul
echo Y|cacls "%ALLUSERSPROFILE%\「Start」Menu\Programs\Startup" /C /P everyone:R Administrators:%caclsRF% SYSTEM:%caclsRF%>nul 2>nul
Cacls "%ALLUSERSPROFILE%\「Start」Menu\Programs\Startup" /E /C /R Administrator >nul 2>nul
Echo %endr%%SystemRoot% directory permission protection ……
Echo %endr%%SystemRoot% directory permission protection ……>>list
Cacls "%SystemRoot%" /T /E /C /R Administrator >nul 2>nul
echo Y|cacls "%SystemRoot%" /T /C /E /P Administrators:%caclsRF%>nul 2>nul
Echo %endr%Policy permission protection ……
Echo %endr%Policy permission protection ……>>list
echo Y|cacls "%SystemRoot%\system32\grouppolicy" /T /C /P everyone:R Administrators:%caclsRF% SYSTEM:%caclsRF%>nul 2>nul
:::Remove dangerous command USER permissions
Cacls %SystemRoot%\regedit.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\cmd.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\net.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\net1.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\tftp.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\at.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\telnet.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\shell32.dll /e /R Users >nul 2>nul
Cacls %SystemRoot%\System32\netstat.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\nbtstat.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\reged32t.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\attrib.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\ftp.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\cscript.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\ddeshare.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\debug.exe /e /R Users >nul 2>nul
Cacls %SystemRoot%\System32\ddeshare.exe /e /R Users >nul 2>nul
Cacls %SystemRoot%\System32\hostname.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\msppcnfg.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\mstsc.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\netsh.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\nslookup.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\regedt32.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\regsvr32.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\sc.exe /e /R Users >nul 2>nul
Cacls %SystemRoot%\System32\shadow.exe /e /R Users >nul 2>nul
Cacls %SystemRoot%\System32\share.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\xcopy.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\edlin.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\ping.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\route.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\finger.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\posix.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\rsh.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\atsvc.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\qbasic.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\runonce.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\syskey.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\secfixup.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\rdisk.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\edit.com /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\rexec.exe /E /R Users >nul 2>nul
if "%ofn%"=="[8]" (
echo Y|Cacls.exe %SystemRoot%\System32\Cacls.exe /C /P everyone:N>nul 2>nul
echo Y|Cacls.exe %SystemRoot%\System32\regini.exe /C /P everyone:N>nul 2>nul
)
if "%ofn%"=="[1 17 8]" (
echo Y|Cacls.exe %SystemRoot%\System32\Cacls.exe /C /P Administrators:F SYSTEM:F>nul 2>nul
echo Y|Cacls.exe %SystemRoot%\System32\regini.exe /C /P Administrators:F SYSTEM:F>nul 2>nul
)
if exist Cacls.exe del /A /F /S /Q Cacls.exe >nul 2>nul
::::Modify registry automatic running key value permissions to prevent viruses or trojans from damaging the system ……
CALL :regini_exe
Echo %endr%All users' self - startup registry key value protection……
Echo %endr%All users' self - startup registry key value protection……>>list
>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%All users' Explorer registry key value protection……
Echo %endr%All users' Explorer registry key value protection……>>list
>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Policies\Explorer %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Explorer\Shell folders %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Explorer\User shell folders %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%All users' IE registry key value protection……
Echo %endr%All users' IE registry key value protection……>>list
>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%All users' initialization program registry key value protection……
Echo %endr%All users' initialization program registry key value protection……>>list
>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows nt\Currentversion\Windows %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows nt\Currentversion\Winlogon %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Immune malicious web page trojan registry key value protection……
Echo %endr%Immune malicious web page trojan registry key value protection……>>list
>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4} %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228} %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5} %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EA-F192-11D4-A65F-0040963251E5} %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B} %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Local user self - startup registry key value protection……
Echo %endr%Local user self - startup registry key value protection……>>list
>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Runonce %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Runonceex %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Local user Explorer registry key value protection……
Echo %endr%Local user Explorer registry key value protection……>>list
>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Policies\Explorer %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Shell folders %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\User shell folders %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Local user IE registry key value protection……
Echo %endr%Local user IE registry key value protection……>>list
>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Local user initialization program registry key value protection……
Echo %endr%Local user initialization program registry key value protection……>>list
>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows nt\Currentversion\Inifilemapping %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Service driver registry key value protection……
Echo %endr%Service driver registry key value protection……>>list
>regini.ini Echo HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Default user self - startup registry key value protection……
Echo %endr%Default user self - startup registry key value protection……>>list
>regini.ini Echo HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run %ofn%
regini.exe regini.ini >nul 2>nul
if exist regini.* del /A /F /S /Q regini.* >nul 2>nul
CALL END.CMD
goto :eof
:cacls_exe
@echo bs=_>xx.vbs
@echo

@echo off
color 2f
Set Prog=Gas Song - Self - Starting (Directory & Registry Key Value) Protection
Set L1=　　　　　　　 ╭───────────────────╮
Set L2=　　　　　　╭─┤%Prog% ├─╮
Set L3=　　　　　　│ ╰───────────────────╯　│
Set L4=　　　　　　│==============================================│
Set L5=　　　　　　│ For netizens to communicate　 Piracy is not investigated │
Set L6=　　　　　　╰───────────────────────╯
set ofn=[1 17 8]
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WSQ" /s |find /I "AUTORUNR" >nul 2>nul||set ofn=[8]
if "%ofn%"=="[1 17 8]" (
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WSQ" /f /v "AUTORUNR" >nul 2>nul
set caclsRF=F
set endr=Cancel!!
set endra=Enable! "Protection", please re - run this program
)
if "%ofn%"=="[8]" (
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\WSQ" /v "AUTORUNR" /t reg_sz /d "Gas Song - Self - Starting (Directory & Registry Key Value) Protection" /f >nul 2>nul
set caclsRF=R
set endr=Enable!!
set endra=Cancel! "Protection", please re - run this program
echo Remove dangerous command USER permissions……
echo Unconditionally prohibit automatic operation characteristics to prevent viruses……
echo Repair disk open association……
echo Clear unused automatic loading key values……
)
Title %endr%Gas Song - Self - Starting (Directory & Registry Key Value) Protection
:::Unconditionally prohibit automatic operation characteristics to prevent viruses……
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveAutoRun /t REG_BINARY /d ffffff03 /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t REG_DWORD /d 0x00000001 /f>nul 2>nul
:::Repair disk open association……
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f>nul 2>nul
:::Clear automatic loading key values……
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SoundMam /f>nul 2>nul
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wincfgs /f>nul 2>nul
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /f>nul 2>nul
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /f>nul 2>nul
:::Modify directory permissions to prevent viruses or trojans from damaging the system ……
CALL :cacls_exe
Echo %endr%Self - starting directory permission protection ……
Echo %endr%Self - starting directory permission protection ……>list
echo Y|cacls "%USERPROFILE%\「Start」Menu\Programs\Startup" /C /P everyone:R Administrators:%caclsRF% SYSTEM:%caclsRF%>nul 2>nul
Cacls "%USERPROFILE%\「Start」Menu\Programs\Startup" /E /C /R Administrator >nul 2>nul
echo Y|cacls "%ALLUSERSPROFILE%\「Start」Menu\Programs\Startup" /C /P everyone:R Administrators:%caclsRF% SYSTEM:%caclsRF%>nul 2>nul
Cacls "%ALLUSERSPROFILE%\「Start」Menu\Programs\Startup" /E /C /R Administrator >nul 2>nul
Echo %endr%%SystemRoot% directory permission protection ……
Echo %endr%%SystemRoot% directory permission protection ……>>list
Cacls "%SystemRoot%" /T /E /C /R Administrator >nul 2>nul
echo Y|cacls "%SystemRoot%" /T /C /E /P Administrators:%caclsRF%>nul 2>nul
Echo %endr%Policy permission protection ……
Echo %endr%Policy permission protection ……>>list
echo Y|cacls "%SystemRoot%\system32\grouppolicy" /T /C /P everyone:R Administrators:%caclsRF% SYSTEM:%caclsRF%>nul 2>nul
:::Remove dangerous command USER permissions
Cacls %SystemRoot%\regedit.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\cmd.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\net.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\net1.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\tftp.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\at.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\telnet.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\shell32.dll /e /R Users >nul 2>nul
Cacls %SystemRoot%\System32\netstat.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\nbtstat.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\reged32t.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\attrib.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\ftp.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\cscript.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\ddeshare.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\debug.exe /e /R Users >nul 2>nul
Cacls %SystemRoot%\System32\ddeshare.exe /e /R Users >nul 2>nul
Cacls %SystemRoot%\System32\hostname.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\msppcnfg.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\mstsc.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\netsh.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\nslookup.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\regedt32.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\regsvr32.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\sc.exe /e /R Users >nul 2>nul
Cacls %SystemRoot%\System32\shadow.exe /e /R Users >nul 2>nul
Cacls %SystemRoot%\System32\share.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\xcopy.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\edlin.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\ping.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\route.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\finger.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\posix.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\rsh.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\atsvc.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\qbasic.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\runonce.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\syskey.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\secfixup.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\rdisk.exe /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\edit.com /E /R Users >nul 2>nul
Cacls %SystemRoot%\System32\rexec.exe /E /R Users >nul 2>nul
if "%ofn%"=="[8]" (
echo Y|Cacls.exe %SystemRoot%\System32\Cacls.exe /C /P everyone:N>nul 2>nul
echo Y|Cacls.exe %SystemRoot%\System32\regini.exe /C /P everyone:N>nul 2>nul
)
if "%ofn%"=="[1 17 8]" (
echo Y|Cacls.exe %SystemRoot%\System32\Cacls.exe /C /P Administrators:F SYSTEM:F>nul 2>nul
echo Y|Cacls.exe %SystemRoot%\System32\regini.exe /C /P Administrators:F SYSTEM:F>nul 2>nul
)
if exist Cacls.exe del /A /F /S /Q Cacls.exe >nul 2>nul
::::Modify registry automatic operation key value permissions to prevent viruses or trojans from damaging the system ……
CALL :regini_exe
Echo %endr%All users self - starting registry key value protection……
Echo %endr%All users self - starting registry key value protection……>>list
>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%All users Explorer registry key value protection……
Echo %endr%All users Explorer registry key value protection……>>list
>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Policies\Explorer %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Explorer\Shell folders %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Explorer\User shell folders %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%All users IE registry key value protection……
Echo %endr%All users IE registry key value protection……>>list
>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%All users initialization program registry key value protection……
Echo %endr%All users initialization program registry key value protection……>>list
>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows nt\Currentversion\Windows %ofn%
>>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows nt\Currentversion\Winlogon %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Immune malicious web page trojan registry key value protection……
Echo %endr%Immune malicious web page trojan registry key value protection……>>list
>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4} %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228} %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5} %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EA-F192-11D4-A65F-0040963251E5} %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B} %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Local user self - starting registry key value protection……
Echo %endr%Local user self - starting registry key value protection……>>list
>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Runonce %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Runonceex %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Local user Explorer registry key value protection……
Echo %endr%Local user Explorer registry key value protection……>>list
>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Policies\Explorer %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Shell folders %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\User shell folders %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Local user IE registry key value protection……
Echo %endr%Local user IE registry key value protection……>>list
>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Local user initialization program registry key value protection……
Echo %endr%Local user initialization program registry key value protection……>>list
>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows nt\Currentversion\Inifilemapping %ofn%
>>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Service driver driver registry key value protection……
Echo %endr%Service driver driver registry key value protection……>>list
>regini.ini Echo HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services %ofn%
regini.exe regini.ini >nul 2>nul
Echo %endr%Default user self - starting registry key value protection……
Echo %endr%Default user self - starting registry key value protection……>>list
>regini.ini Echo HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run %ofn%
regini.exe regini.ini >nul 2>nul
if exist regini.* del /A /F /S /Q regini.* >nul 2>nul
CALL END.CMD
goto :eof
:cacls_exe
@echo bs=_>xx.vbs
@echo

Defending on infective viruses is not easy. You can't set read-only and run permissions for every directory and every file.

Originally posted by xswdong at 2009-9-4 02:48 AM:
It's not easy to defend against infective viruses. You can't set read-only and run permissions for each directory and each file, can you?

You need to streamline the code you pasted...

---------------------------------------------
"Infective" viruses? I understand what you mean,

File monitoring is not done with batch processing, that would be ridiculous, don't get it wrong,

Still the same sentenceBatch processing only does non-interactive, double-click-to-set work