| 引用: |
【吸血吻1977的贴子】【回复“BlackStone”的帖子】运行过前几天论坛上的灰鸽子免疫工具
........................... |
那个灰鸽子免疫器改动文件位置以及对注册表的修改有以下内容：
rem 功能：限制 Windows 目录下的可执行文件的运行
rem 设置系统外壳的绝对路径：
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "%SystemRoot%\System32\Explorer.exe" /f>nul 2>nul
rem 复制系统文件到System32目录：
for %%a in (explorer,hh,notepad,regedit,taskman,twunk_16,twunk_32,winhelp,winhlp32) do if not exist %SystemRoot%\System32\%%a.exe copy /y %SystemRoot%\%%a.exe %SystemRoot%\System32\>nul 2>nul
rem 添加禁止Windows目录执行程序的限制策略：
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{a29e74d3-68cd-43f4-80ab-022331b49a6b}" /v ItemData /t REG_SZ /d "%SystemRoot%\*.exe" /f>nul 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{a29e74d3-68cd-43f4-80ab-022331b49a6b}" /v Description /t REG_SZ /d "" /f>nul 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{a29e74d3-68cd-43f4-80ab-022331b49a6b}" /v SaferFlags /t REG_DWORD /d "00000000" /f>nul 2>nul
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{a29e74d3-68cd-43f4-80ab-022331b49a6b}" /v LastModified /t REG_BINARY /d "c086ab8c87e0e502" /f>nul 2>nul
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy
Objects\{E515547B-34A9-47E3-991B-FE1C19E5BFF0}Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{9e85b2da-fe36-41ec-9b26-f1acbf7f895d}" /v SaferFlags /t REG_BINARY /d "9091122623e0c501" /f>nul 2>nul
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy
Objects\{E515547B-34A9-47E3-991B-FE1C19E5BFF0}Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{9e85b2da-fe36-41ec-9b26-f1acbf7f895d}" /v Description /t REG_SZ /d "" /f>nul 2>nul
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy
Objects\{E515547B-34A9-47E3-991B-FE1C19E5BFF0}Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{9e85b2da-fe36-41ec-9b26-f1acbf7f895d}" /v SaferFlags /t REG_DWORD /d "00000000" /f>nul 2>nul
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy
Objects\{E515547B-34A9-47E3-991B-FE1C19E5BFF0}Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{9e85b2da-fe36-41ec-9b26-f1acbf7f895d}" /v LastModified /t REG_BINARY /d "c086ab8c87e0e502" /f>nul 2>nul
gpupdate /force>nul
如果不想要这个免疫器了，对照这个，自己改过来。