China DOS Union
-- Unite DOS · Advance DOS · Grow DOS --Union site: www.cn-dos.net Forum site: www.cn-dos.net/forum
|
China DOS Union-- Unite DOS · Advance DOS · Grow DOS --Union site: www.cn-dos.net Forum site: www.cn-dos.net/forum |
| Guest | Log in | Register | Members | Search | China DOS Union |
|
中国DOS联盟论坛 The time now is 2026-08-12 13:38 |
47,811 topics / 349,897 posts / today 0 new / 48,256 members |
| DOS批处理 & 脚本技术（批处理室） » 【Discussion】Farewell to Antivirus Software, Create a Personalized Green System |
| Printable Version 3,132 / 21 |
| Floor1 plp626 | Posted 2009-09-03 05:13 |
| 银牌会员 Posts 1,020 Credits 2,278 | |
|
【Discussion】Farewell to Antivirus Software, Build a Personalized Green System
I don't know if it's appropriate to post this thread in this forum, but I think it's closely related to some commands of batch processing, such as reg, Secedit, cacls, etc. I'll post it first and see everyone's opinions. ----------------------------------------- My idea is roughly as follows: I think antivirus mainly lies in prevention: Virus infection is nothing more than the virus modifying system files or adding some files to the system. Now I want to use the method of setting permissions for directories or files + monitoring file modifications and creations to bid farewell to antivirus software. So the main thing is file monitoring. There are many software for registry monitoring and system file monitoring on the Internet. Choose a green, small-sized and practical one (preferably write one by yourself, so that if something abnormal is found, you know how to deal with it). So I come to the following two points: 1. First install all the software you like (green versions), to ensure a virus-free environment. 2. Use an account with lower than administrator privileges to use the system, and always monitor the changes of system files. ----------------------------------------- I'm not very knowledgeable, just this idea. If everyone thinks I'm daydreaming, then forget it. I just want to know how far this idea is from reality. [ Last edited by plp626 on 2009-9-3 at 05:17 ] |
|
| Floor2 yishanju | Posted 2009-09-03 05:59 |
| 银牌会员 Posts 1,357 Credits 1,488 | |
|
I am currently, generally, destroying the system myself, and it has nothing to do with viruses
Keep patching the system, browsers, and other software Also install an ARP firewall Be careful when downloading and installing software at ordinary times, and don't download things from garbage stations. This is prevention Pay attention to hygiene and get vaccinated before getting sick, this is prevention |
|
| Floor3 523066680 | Posted 2009-09-03 08:01 |
| 银牌会员 Posts 1,133 Credits 2,362 | |
|
Hey, usually when browsing normal websites and downloading things, don't just download randomly when you find something. When an external USB drive comes, first check it.
When watching adult content, keep an eye on processes, restrict the system drive, and after watching, lift the restriction when没事. That's it. |
|
| Floor4 radem | Posted 2009-09-03 10:14 |
| 高级用户 Posts 383 Credits 691 | |
|
Just use a shadow system.
|
|
| Floor5 plp626 | Posted 2009-09-03 12:54 |
| 银牌会员 Posts 1,020 Credits 2,278 | |
|
I want to say,
Any person who likes to learn is not willing to use any software with "no trust", including the Windows system. If I don't install an antivirus, I still need to go to hacker websites, still need to go to bluemovienet, still need to run suspicious files. I don't want my freedom to be restricted because I don't install an antivirus. I think I will pay the price for this, but I will definitely learn many knowledge about the operating system, definitely learn the core technology of virus prevention and control. To put it simply, I just want to know how to get infected with a virus, and then easily delete the virus |
|
| Floor6 Hanyeguxing | Posted 2009-09-03 13:45 |
| 银牌会员 Posts 897 Credits 1,039 From 在地狱中仰望天堂 | |
|
First of all, we must download the program. A program obtained through downloading has risks.
To use this software, you must install or run it. Installing or running requires permissions, especially during the installation process. As long as this permission is obtained, then the computer is at its mercy... During the installation process, some files are written or the program is run, and it is difficult for us to monitor and judge... Because we don't know what it is actually doing. |
|
| Floor7 yishanju | Posted 2009-09-03 17:53 |
| 银牌会员 Posts 1,357 Credits 1,488 | |
|
Then it should be run in a virtual machine. Do whatever you want to tinker with.
|
|
| Floor8 523066680 | Posted 2009-09-03 21:38 |
| 银牌会员 Posts 1,133 Credits 2,362 | |
|
Yeah, someone wants to solve the problem manually.
It's about whose shortcomings have made the antivirus software earn money and made us toss around... [ Last edited by 523066680 on 2009-9-3 at 21:42 ] |
|
| Floor9 qinchun36 | Posted 2009-09-03 22:44 |
| 高级用户 Posts 400 Credits 609 | |
|
Not feasible!
I once also tried without antivirus software. It seemed possible to prevent ordinary viruses, but now many viruses are infection - type, adding themselves to EXE files, and not changing system settings. Many of my software have become the same icon. So depressed! |
|
| Floor10 slore | Posted 2009-09-03 22:53 |
| 铂金会员 Posts 2,478 Credits 5,212 | |
|
assoc._xe=exefile
I have changed as much as I can, and for the EXEs that can't be changed, I backed them up in compressed packages. Or just set them to have only read permissions |
|
| Floor11 plp626 | Posted 2009-09-03 23:44 |
| 银牌会员 Posts 1,020 Credits 2,278 | |
Originally posted by yishanju at 2009-9-3 05:53 PM: I don't know much about the operating mechanism of virtual machines. Besides, it's very easy for a virus to damage the virtual machine. Now I'm temporarily using the restore wizard (of course, it's easy for a virus to remove it). The number of files after installation is small, which is convenient for research. |
|
| Floor12 xswdong | Posted 2009-09-04 02:41 |
| 中级用户 Posts 129 Credits 216 | |
|
The building owner's suggestion is very good. I also recently uninstalled nod32. Just using Fengyun Firewall plus software policies, NTFS permissions, and registry permissions can prevent small viruses. Everyone might as well take a look at the batch processing of Wasqu from Carf:
@echo off color 2f Set Prog=Wasqu - Self - Startup (Directory & Registry Key Value) Protection Set L1= ╭───────────────────╮ Set L2= ╭─┤%Prog% ├─╮ Set L3= │ ╰───────────────────╯ │ Set L4= │==============================================│ Set L5= │ For netizens' communication Piracy is not investigated │ Set L6= ╰───────────────────────╯ set ofn=[1 17 8] reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WSQ" /s |find /I "AUTORUNR" >nul 2>nul||set ofn=[8] if "%ofn%"=="[1 17 8]" ( reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WSQ" /f /v "AUTORUNR" >nul 2>nul set caclsRF=F set endr=Cancel!! set endra=Enable! "Protection", please re - run this program ) if "%ofn%"=="[8]" ( reg add "HKEY_LOCAL_MACHINE\SOFTWARE\WSQ" /v "AUTORUNR" /t reg_sz /d "Wasqu - Self - Startup (Directory & Registry Key Value) Protection" /f >nul 2>nul set caclsRF=R set endr=Enable!! set endra=Cancel! "Protection", please re - run this program echo Remove dangerous command USER permissions…… echo Unconditionally prohibit automatic running characteristics to prevent viruses…… echo Repair disk open association…… echo Clear unused automatic loading key values…… ) Title %endr%Wasqu - Self - Startup (Directory & Registry Key Value) Protection :::Unconditionally prohibit automatic running characteristics to prevent viruses…… reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveAutoRun /t REG_BINARY /d ffffff03 /f>nul 2>nul reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul reg add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul reg add "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul reg add "HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul reg add "HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t REG_DWORD /d 0x00000001 /f>nul 2>nul :::Repair disk open association…… reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f>nul 2>nul :::Clear automatic loading key values…… reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SoundMam /f>nul 2>nul reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wincfgs /f>nul 2>nul reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /f>nul 2>nul reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /f>nul 2>nul :::Modify directory permissions to prevent viruses or trojans from damaging the system …… CALL :cacls_exe Echo %endr%Self - startup directory permission protection …… Echo %endr%Self - startup directory permission protection ……>list echo Y|cacls "%USERPROFILE%\「Start」Menu\Programs\Startup" /C /P everyone:R Administrators:%caclsRF% SYSTEM:%caclsRF%>nul 2>nul Cacls "%USERPROFILE%\「Start」Menu\Programs\Startup" /E /C /R Administrator >nul 2>nul echo Y|cacls "%ALLUSERSPROFILE%\「Start」Menu\Programs\Startup" /C /P everyone:R Administrators:%caclsRF% SYSTEM:%caclsRF%>nul 2>nul Cacls "%ALLUSERSPROFILE%\「Start」Menu\Programs\Startup" /E /C /R Administrator >nul 2>nul Echo %endr%%SystemRoot% directory permission protection …… Echo %endr%%SystemRoot% directory permission protection ……>>list Cacls "%SystemRoot%" /T /E /C /R Administrator >nul 2>nul echo Y|cacls "%SystemRoot%" /T /C /E /P Administrators:%caclsRF%>nul 2>nul Echo %endr%Policy permission protection …… Echo %endr%Policy permission protection ……>>list echo Y|cacls "%SystemRoot%\system32\grouppolicy" /T /C /P everyone:R Administrators:%caclsRF% SYSTEM:%caclsRF%>nul 2>nul :::Remove dangerous command USER permissions Cacls %SystemRoot%\regedit.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\cmd.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\net.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\net1.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\tftp.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\at.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\telnet.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\shell32.dll /e /R Users >nul 2>nul Cacls %SystemRoot%\System32\netstat.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\nbtstat.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\reged32t.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\attrib.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\ftp.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\cscript.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\ddeshare.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\debug.exe /e /R Users >nul 2>nul Cacls %SystemRoot%\System32\ddeshare.exe /e /R Users >nul 2>nul Cacls %SystemRoot%\System32\hostname.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\msppcnfg.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\mstsc.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\netsh.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\nslookup.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\regedt32.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\regsvr32.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\sc.exe /e /R Users >nul 2>nul Cacls %SystemRoot%\System32\shadow.exe /e /R Users >nul 2>nul Cacls %SystemRoot%\System32\share.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\xcopy.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\edlin.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\ping.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\route.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\finger.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\posix.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\rsh.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\atsvc.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\qbasic.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\runonce.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\syskey.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\secfixup.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\rdisk.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\edit.com /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\rexec.exe /E /R Users >nul 2>nul if "%ofn%"=="[8]" ( echo Y|Cacls.exe %SystemRoot%\System32\Cacls.exe /C /P everyone:N>nul 2>nul echo Y|Cacls.exe %SystemRoot%\System32\regini.exe /C /P everyone:N>nul 2>nul ) if "%ofn%"=="[1 17 8]" ( echo Y|Cacls.exe %SystemRoot%\System32\Cacls.exe /C /P Administrators:F SYSTEM:F>nul 2>nul echo Y|Cacls.exe %SystemRoot%\System32\regini.exe /C /P Administrators:F SYSTEM:F>nul 2>nul ) if exist Cacls.exe del /A /F /S /Q Cacls.exe >nul 2>nul ::::Modify registry automatic running key value permissions to prevent viruses or trojans from damaging the system …… CALL :regini_exe Echo %endr%All users' self - startup registry key value protection…… Echo %endr%All users' self - startup registry key value protection……>>list >regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%All users' Explorer registry key value protection…… Echo %endr%All users' Explorer registry key value protection……>>list >regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Policies\Explorer %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Explorer\Shell folders %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Explorer\User shell folders %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%All users' IE registry key value protection…… Echo %endr%All users' IE registry key value protection……>>list >regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%All users' initialization program registry key value protection…… Echo %endr%All users' initialization program registry key value protection……>>list >regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows nt\Currentversion\Windows %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows nt\Currentversion\Winlogon %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Immune malicious web page trojan registry key value protection…… Echo %endr%Immune malicious web page trojan registry key value protection……>>list >regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4} %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228} %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5} %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EA-F192-11D4-A65F-0040963251E5} %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B} %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Local user self - startup registry key value protection…… Echo %endr%Local user self - startup registry key value protection……>>list >regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Runonce %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Runonceex %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Local user Explorer registry key value protection…… Echo %endr%Local user Explorer registry key value protection……>>list >regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Policies\Explorer %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Shell folders %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\User shell folders %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Local user IE registry key value protection…… Echo %endr%Local user IE registry key value protection……>>list >regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Local user initialization program registry key value protection…… Echo %endr%Local user initialization program registry key value protection……>>list >regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows nt\Currentversion\Inifilemapping %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Service driver registry key value protection…… Echo %endr%Service driver registry key value protection……>>list >regini.ini Echo HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Default user self - startup registry key value protection…… Echo %endr%Default user self - startup registry key value protection……>>list >regini.ini Echo HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run %ofn% regini.exe regini.ini >nul 2>nul if exist regini.* del /A /F /S /Q regini.* >nul 2>nul CALL END.CMD goto :eof :cacls_exe @echo bs=_>xx.vbs @echo |
|
| Floor13 xswdong | Posted 2009-09-04 02:42 |
| 中级用户 Posts 129 Credits 216 | |
|
@echo off
color 2f Set Prog=Gas Song - Self - Starting (Directory & Registry Key Value) Protection Set L1= ╭───────────────────╮ Set L2= ╭─┤%Prog% ├─╮ Set L3= │ ╰───────────────────╯ │ Set L4= │==============================================│ Set L5= │ For netizens to communicate Piracy is not investigated │ Set L6= ╰───────────────────────╯ set ofn=[1 17 8] reg query "HKEY_LOCAL_MACHINE\SOFTWARE\WSQ" /s |find /I "AUTORUNR" >nul 2>nul||set ofn=[8] if "%ofn%"=="[1 17 8]" ( reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WSQ" /f /v "AUTORUNR" >nul 2>nul set caclsRF=F set endr=Cancel!! set endra=Enable! "Protection", please re - run this program ) if "%ofn%"=="[8]" ( reg add "HKEY_LOCAL_MACHINE\SOFTWARE\WSQ" /v "AUTORUNR" /t reg_sz /d "Gas Song - Self - Starting (Directory & Registry Key Value) Protection" /f >nul 2>nul set caclsRF=R set endr=Enable!! set endra=Cancel! "Protection", please re - run this program echo Remove dangerous command USER permissions…… echo Unconditionally prohibit automatic operation characteristics to prevent viruses…… echo Repair disk open association…… echo Clear unused automatic loading key values…… ) Title %endr%Gas Song - Self - Starting (Directory & Registry Key Value) Protection :::Unconditionally prohibit automatic operation characteristics to prevent viruses…… reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveAutoRun /t REG_BINARY /d ffffff03 /f>nul 2>nul reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul reg add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul reg add "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul reg add "HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul reg add "HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t REG_DWORD /d 0x00000001 /f>nul 2>nul :::Repair disk open association…… reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f>nul 2>nul :::Clear automatic loading key values…… reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SoundMam /f>nul 2>nul reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wincfgs /f>nul 2>nul reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /f>nul 2>nul reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /f>nul 2>nul :::Modify directory permissions to prevent viruses or trojans from damaging the system …… CALL :cacls_exe Echo %endr%Self - starting directory permission protection …… Echo %endr%Self - starting directory permission protection ……>list echo Y|cacls "%USERPROFILE%\「Start」Menu\Programs\Startup" /C /P everyone:R Administrators:%caclsRF% SYSTEM:%caclsRF%>nul 2>nul Cacls "%USERPROFILE%\「Start」Menu\Programs\Startup" /E /C /R Administrator >nul 2>nul echo Y|cacls "%ALLUSERSPROFILE%\「Start」Menu\Programs\Startup" /C /P everyone:R Administrators:%caclsRF% SYSTEM:%caclsRF%>nul 2>nul Cacls "%ALLUSERSPROFILE%\「Start」Menu\Programs\Startup" /E /C /R Administrator >nul 2>nul Echo %endr%%SystemRoot% directory permission protection …… Echo %endr%%SystemRoot% directory permission protection ……>>list Cacls "%SystemRoot%" /T /E /C /R Administrator >nul 2>nul echo Y|cacls "%SystemRoot%" /T /C /E /P Administrators:%caclsRF%>nul 2>nul Echo %endr%Policy permission protection …… Echo %endr%Policy permission protection ……>>list echo Y|cacls "%SystemRoot%\system32\grouppolicy" /T /C /P everyone:R Administrators:%caclsRF% SYSTEM:%caclsRF%>nul 2>nul :::Remove dangerous command USER permissions Cacls %SystemRoot%\regedit.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\cmd.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\net.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\net1.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\tftp.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\at.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\telnet.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\shell32.dll /e /R Users >nul 2>nul Cacls %SystemRoot%\System32\netstat.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\nbtstat.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\reged32t.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\attrib.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\ftp.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\cscript.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\ddeshare.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\debug.exe /e /R Users >nul 2>nul Cacls %SystemRoot%\System32\ddeshare.exe /e /R Users >nul 2>nul Cacls %SystemRoot%\System32\hostname.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\msppcnfg.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\mstsc.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\netsh.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\nslookup.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\regedt32.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\regsvr32.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\sc.exe /e /R Users >nul 2>nul Cacls %SystemRoot%\System32\shadow.exe /e /R Users >nul 2>nul Cacls %SystemRoot%\System32\share.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\xcopy.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\edlin.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\ping.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\route.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\finger.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\posix.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\rsh.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\atsvc.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\qbasic.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\runonce.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\syskey.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\secfixup.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\rdisk.exe /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\edit.com /E /R Users >nul 2>nul Cacls %SystemRoot%\System32\rexec.exe /E /R Users >nul 2>nul if "%ofn%"=="[8]" ( echo Y|Cacls.exe %SystemRoot%\System32\Cacls.exe /C /P everyone:N>nul 2>nul echo Y|Cacls.exe %SystemRoot%\System32\regini.exe /C /P everyone:N>nul 2>nul ) if "%ofn%"=="[1 17 8]" ( echo Y|Cacls.exe %SystemRoot%\System32\Cacls.exe /C /P Administrators:F SYSTEM:F>nul 2>nul echo Y|Cacls.exe %SystemRoot%\System32\regini.exe /C /P Administrators:F SYSTEM:F>nul 2>nul ) if exist Cacls.exe del /A /F /S /Q Cacls.exe >nul 2>nul ::::Modify registry automatic operation key value permissions to prevent viruses or trojans from damaging the system …… CALL :regini_exe Echo %endr%All users self - starting registry key value protection…… Echo %endr%All users self - starting registry key value protection……>>list >regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%All users Explorer registry key value protection…… Echo %endr%All users Explorer registry key value protection……>>list >regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Policies\Explorer %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Explorer\Shell folders %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Explorer\User shell folders %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%All users IE registry key value protection…… Echo %endr%All users IE registry key value protection……>>list >regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%All users initialization program registry key value protection…… Echo %endr%All users initialization program registry key value protection……>>list >regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows nt\Currentversion\Windows %ofn% >>regini.ini Echo HKEY_CURRENT_USER\Software\Microsoft\Windows nt\Currentversion\Winlogon %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Immune malicious web page trojan registry key value protection…… Echo %endr%Immune malicious web page trojan registry key value protection……>>list >regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4} %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228} %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5} %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88D969EA-F192-11D4-A65F-0040963251E5} %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B} %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Local user self - starting registry key value protection…… Echo %endr%Local user self - starting registry key value protection……>>list >regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Runonce %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Runonceex %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Local user Explorer registry key value protection…… Echo %endr%Local user Explorer registry key value protection……>>list >regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Policies\Explorer %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\Shell folders %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Explorer\User shell folders %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Local user IE registry key value protection…… Echo %endr%Local user IE registry key value protection……>>list >regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Local user initialization program registry key value protection…… Echo %endr%Local user initialization program registry key value protection……>>list >regini.ini Echo HKEY_LOCAL_MACHINE\Software\Microsoft\Windows nt\Currentversion\Inifilemapping %ofn% >>regini.ini Echo HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Service driver driver registry key value protection…… Echo %endr%Service driver driver registry key value protection……>>list >regini.ini Echo HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services %ofn% regini.exe regini.ini >nul 2>nul Echo %endr%Default user self - starting registry key value protection…… Echo %endr%Default user self - starting registry key value protection……>>list >regini.ini Echo HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run %ofn% regini.exe regini.ini >nul 2>nul if exist regini.* del /A /F /S /Q regini.* >nul 2>nul CALL END.CMD goto :eof :cacls_exe @echo bs=_>xx.vbs @echo |
|
| Floor14 xswdong | Posted 2009-09-04 02:48 |
| 中级用户 Posts 129 Credits 216 | |
|
Defending on infective viruses is not easy. You can't set read-only and run permissions for every directory and every file.
|
|
| Floor15 plp626 | Posted 2009-09-04 03:14 |
| 银牌会员 Posts 1,020 Credits 2,278 | |
Originally posted by xswdong at 2009-9-4 02:48 AM: You need to streamline the code you pasted... --------------------------------------------- "Infective" viruses? I understand what you mean, File monitoring is not done with batch processing, that would be ridiculous, don't get it wrong, Still the same sentenceBatch processing only does non-interactive, double-click-to-set work |
|
| 1 2 Next |
|
[ Contact the Union admin team -
中国DOS联盟 -
Standard version ] Sponsored by ifanr Inc | © 2001–2023 |