userinit病毒的防范-pc捍卫者

1.原理：

每分钟对userinit.exe进行监视，根据软件的DM5码准确无误的判断是否修改过，如果有修改,软件自动生成一个没有修改过的userinit.exe，并以机器狗穿回去!

2.利用注册表法:
以下分二部分，一部分是批处理，一部分是注册表！请确保c:\windows\system32\userinit.exe是无毒文件

@echo off
md %systemroot%\system32\1

md %systemroot%\system32\1\2

copy /y c:\windows\system32\userinit.exe c:\windows\system32\1\2\

echo y|cacls c:\windows\system32\1\2 /p everyone:f

echo y|cacls c:\windows\system32\1 /p everyone:n

md %systemroot%\system32\drivers\pcihdd.sys

cacls %systemroot%\system32\drivers\pcihdd.sys /e /p everyone:n

echo y|cacls c:\windows\system32\userinit.exe /p everyone:n

md c:\WINDOWS\AVPSrv.exe >nul 2>nul

md c:\WINDOWS\DiskMan32.exe >nul 2>nul

md c:\WINDOWS\IGM.exe >nul 2>nul

md c:\WINDOWS\Kvsc3.exe >nul 2>nul

md c:\WINDOWS\lqvytv.exe >nul 2>nul

md c:\WINDOWS\MsIMMs32.exe >nul 2>nul

md c:\WINDOWS\system32\3CEBCAF.EXE >nul 2>nul

md %windir%\system32\drivers\svchost.exe >nul 2>nul

md c:\WINDOWS\system32\a.exe >nul 2>nul

md c:\WINDOWS\upxdnd.exe >nul 2>nul

md c:\WINDOWS\WinForm.exe >nul 2>nul

md c:\WINDOWS\system32\rsjzbpm.dll >nul 2>nul

md c:\WINDOWS\system32\racvsvc.exe >nul 2>nul

md c:\WINDOWS\cmdbcs.exe >nul 2>nul

md c:\WINDOWS\dbghlp32.exe >nul 2>nul

md c:\WINDOWS\nvdispdrv.exe >nul 2>nul

md c:\WINDOWS\system32\cmdbcs.dll >nul 2>nul

md c:\WINDOWS\system32\dbghlp32.dll >nul 2>nul

md c:\WINDOWS\system32\upxdnd.dll >nul 2>nul

md c:\WINDOWS\system32\yfmtdiouaf.dll >nul 2>nul

echo y|cacls.exe c:\WINDOWS\AVPSrv.exe /d everyone >nul 1>nul

echo y|cacls.exe %windir%\system32\drivers\svchost.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\DiskMan32.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\IGM.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\Kvsc3.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\lqvytv.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\MsIMMs32.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\3CEBCAF.EXE /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\a.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\upxdnd.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\WinForm.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\rsjzbpm.dll /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\racvsvc.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\cmdbcs.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\dbghlp32.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\nvdispdrv.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\cmdbcs.dll /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\dbghlp32.dll /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\upxdnd.dll /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\yfmtdiouaf.dll /d everyone >nul 1>nul

echo reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IGM.EXE" /v debugger /t reg_sz /d debugfile.exe /f

echo gpupdate

exit

上一页下一页
本文共 3 页,第 [1] [2] [3] 页

转截请注明:文章来自 pc捍卫者 http://www.pchwz.com 本站发布此文为传递更多信息之目的,不表明pc捍卫者赞同其观点