关于"防护勒索病毒"的一个小工具实用性很强

Ceklr · 发表于 2020-6-22 16:13

我写的小工具都是实用性很强的，主要自已工作中经常用到。
前些天发了一个“一键解决WINDOWS10访问局域网的小脚本”没想到很受欢迎，现在把另一个经常用的小工具发出来。

这个是前半年公司电脑中过一次勒索病毒，那时我还没来工作，上岗后就接到这么个大问题，分析很久还是传统手段来的实用。根据度娘中网友分享的经验，集合成一起。
期间测试过多个版本，最终这个可以支持XP-WIN10，均测试无误。

特来分享给大家。

老样子，地址直接放出（请多多支持）
https://wwa.lanzoux.com/idlZ6dxkc4h

源码：

@echo off
::此程序主要针对勒索病毒而定制
::by edison_zhu 20200514
title 勒索病毒仿护1.5 winxp-win10 514
color 0a
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"
setlocal enabledelayedexpansion
::检测更新
:SelfUpdate
set "ScriptCurrent=%~f0"
set "RemoteIP=192.168.3.222"
set "ScriptRemote=\\%RemoteIP%\T$\端口封堵.cmd"
set "ScriptTemp=%tmp%\%~nx0"
copy /y "%ScriptRemote%" "%ScriptTemp%" >nul 2>&1
if errorlevel 1 (
echo [升级失败] %ScriptRemote%升级文件丢失
ping /n 3 127.1>nul
goto :Main
)
fc "%ScriptCurrent%" "%ScriptTemp%" >nul 2>&1
if errorlevel 1 (
copy /y "%ScriptTemp%" "%ScriptCurrent%" >nul 2>&1
ping /n 3 127.1>nul
echo [升级成功!!]
)
goto :Main
:Main
ver | find "5.1" > NUL && goto winxp
echo.
echo 今天是:%date% 现在是: %time%
echo.
for /f "tokens=16" %%i in ('ipconfig ^|find /i "ipv4"') do set ip=%%i
echo 本机IP地址为：%ip%
echo.
set "str=HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp"
for /f "tokens=3" %%i in ('reg query "%str%" /v UserAuthentication') do set "PortNum=%%i"
set /a Z=%PortNum%
::echo 当前远程桌面状态：%n%
if /i %Z%==0 (
set zt=远程桌面已经开启
echo !zt!
) else (
set zt=远程桌面未开启
echo !zt!
)
echo.
set "str=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
for /f "tokens=3" %%i in ('reg query "%str%" /v PortNumber') do set "PortNum=%%i"
set /a n=%PortNum%
echo 当前远程桌面端口为：%n%
echo.
netstat -an|findstr %n% >nul 2>nul && echo 远程端口正在监听 || echo 远程端口未监听
echo.
echo.
echo ----------------------------------------------------------------------------------------------------------------
echo 勒索防护建议：
echo 1.禁用弱口令！
echo 2.关闭系统默认共享，尽量避免使用局域网共享。
echo 3.重要资料的共享文件夹应设置访问权限控制，并进行定期备份。
echo 4.定期检测系统和软件中的安全漏洞，及时打上补丁。
echo 5.安装杀毒软件并升级到最新。
echo ----------------------------------------------------------------------------------------------------------------
echo.
echo.
pause
:start
cls
echo 提示！当前!zt!。
echo 当前远程桌面端口：%n%
netstat -an|findstr %n% >nul 2>nul && echo 远程端口正在监听 || echo 远程端口未监听
echo ----------------------------------------------------------------------------------------------------------------
echo.
echo.
echo.
echo 下一步需要如何操作
echo.
echo 1.一键关闭共享端口
echo.
echo. 2.一键开放共享端口
echo.
echo. 3.修改远程桌面端口
echo.
echo. 4.开启远程桌面服务
echo.
echo. 5.关闭远程桌面服务
echo.
echo.
set ST=s
set /p ST= 选择后按回车键:
if %ST%==0 (
set ok=0
goto stat
)else (
if "%ST%"=="1" goto yjgb
if "%ST%"=="2" goto yjkf
if "%ST%"=="3" goto yjxg
if "%ST%"=="4" goto yczm
if "%ST%"=="5" goto ycgb
)
goto start
:yjgb
cls
::删除系统默共享
net share C$ /delete
net share d$ /delete
net share e$ /delete
net share f$ /delete
net share admin$ /delete
echo.
echo 准备关闭135 137 138 139 445 端口
echo.
netsh ipsec static delete policy name = SECCPP
netsh ipsec static add policy name = SECCPP description=安全策略20200320
netsh ipsec static add filteraction name = Block action = block
netsh ipsec static add filterlist name = SECCPF
netsh ipsec static add filter filterlist = SECCPF srcaddr=Any dstaddr = Me dstport = 135 protocol = TCP
netsh ipsec static add filter filterlist = SECCPF srcaddr=Any dstaddr = Me dstport = 137 protocol = TCP
netsh ipsec static add filter filterlist = SECCPF srcaddr=Any dstaddr = Me dstport = 138 protocol = TCP
netsh ipsec static add filter filterlist = SECCPF srcaddr=Any dstaddr = Me dstport = 139 protocol = TCP
netsh ipsec static add filter filterlist = SECCPF srcaddr=Any dstaddr = Me dstport = 445 protocol = TCP
netsh ipsec static add filter filterlist = SECCPF srcaddr=Any dstaddr = Me dstport = 137 protocol = UDP
netsh ipsec static add filter filterlist = SECCPF srcaddr=Any dstaddr = Me dstport = 138 protocol = UDP
netsh ipsec static add rule name=SECCPR policy=SECCPP filterlist=SECCPF filteraction=Block
netsh ipsec static set policy name = SECCPP assign = y
echo.
echo.
echo 正在关闭135端口请稍候…
netsh advfirewall firewall add rule name = "Disable port 135 - TCP" dir = in action = block protocol = TCP localport = 135
echo.
netsh advfirewall firewall add rule name = "Disable port 135 - UDP" dir = in action = block protocol = UDP localport = 135
echo.
echo 正在关闭137端口请稍候…
netsh advfirewall firewall add rule name = "Disable port 137 - TCP" dir = in action = block protocol = TCP localport = 137
echo.
netsh advfirewall firewall add rule name = "Disable port 137 - UDP" dir = in action = block protocol = UDP localport = 137
echo.
echo 正在关闭138端口请稍候…
netsh advfirewall firewall add rule name = "Disable port 138 - TCP" dir = in action = block protocol = TCP localport = 138
echo.
netsh advfirewall firewall add rule name = "Disable port 138 - UDP" dir = in action = block protocol = UDP localport = 138
echo.
echo 正在关闭139端口请稍候…
netsh advfirewall firewall add rule name = "Disable port 139 - TCP" dir = in action = block protocol = TCP localport = 139
echo.
netsh advfirewall firewall add rule name = "Disable port 139 - UDP" dir = in action = block protocol = UDP localport = 139
echo.
echo 正在关闭445端口请稍候…
netsh advfirewall firewall add rule name = "Disable port 445 - TCP" dir = in action = block protocol = TCP localport = 445
echo.
netsh advfirewall firewall add rule name = "Disable port 445 - UDP" dir = in action = block protocol = UDP localport = 445
echo.
echo.
::关闭共享
net stop LanmanServer /y
sc config LanmanServer start= disabled
::关闭系统升级服务
sc config wuauserv start= DISABLED
::adobe升级服务优化
sc config AdobeARMservice start= DISABLED
::关闭IPV6支持
sc config iphlpsvc start= DISABLED
::关闭声音服务
sc config AudioSrv start= DISABLED
sc config AudioEndpointBuilder start= DISABLED
::关闭桌面特效
sc config UxSms start= DISABLED
sc config Themes start= DISABLED
mshta vbscript:msgbox("共享服务与危险端口均已关闭!!",vbSystemModal+64,"安装提示")(window.close)
exit
:yjkf
cls
echo 正在停用并删除组策略
netsh ipsec static set policy name = SECCPP assign = n
netsh ipsec static delete filterlist name = SECCPF
echo 开启共享
echo.
echo.
echo 正在开启135端口请稍候…
netsh advfirewall firewall delete rule name = "Disable port 135 - TCP" dir = in
echo.
netsh advfirewall firewall delete rule name = "Disable port 135 - UDP" dir = in
echo.
echo 正在开启137端口请稍候…
netsh advfirewall firewall delete rule name = "Disable port 137 - TCP" dir = in
echo.
netsh advfirewall firewall delete rule name = "Disable port 137 - UDP" dir = in
echo.
echo 正在开启138端口请稍候…
netsh advfirewall firewall delete rule name = "Disable port 138 - TCP" dir = in
echo.
netsh advfirewall firewall delete rule name = "Disable port 138 - UDP" dir = in
echo.
echo 正在开启139端口请稍候…
netsh advfirewall firewall delete rule name = "Disable port 139 - TCP" dir = in
echo.
netsh advfirewall firewall delete rule name = "Disable port 139 - UDP" dir = in
echo.
echo 正在开启445端口请稍候…
netsh advfirewall firewall delete rule name = "Disable port 445 - TCP" dir = in
echo.
netsh advfirewall firewall delete rule name = "Disable port 445 - UDP" dir = in
::开启共享服务
sc config LanmanServer start= auto
net start LanmanServer
mshta vbscript:msgbox("共享服务与危险端口均已开启!!",vbSystemModal+64,"安装提示")(window.close)
goto start
:yjxg
cls
echo.
echo.
echo.
echo 修改远程桌面3389端口(支持Win2003-Win10 ) 来自52pojie.
echo 自动添加防火墙规则
echo.
echo.
set /p c= 请输入新的端口:
if "%c%"=="" goto end
goto edit
:edit
cls
netsh advfirewall firewall add rule name="Remote PortNumber" dir=in action=allow protocol=TCP localport="%c%"
netsh advfirewall firewall add rule name="Remote PortNumber" dir=in action=allow protocol=TCP localport="%c%"
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp" /v "PortNumber" /t REG_DWORD /d "%c%" /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "PortNumber" /t REG_DWORD /d "%c%" /f
mshta vbscript:msgbox("端口修改成功，重启后生效!!",vbSystemModal+64,"安装提示")(window.close)
goto start
:ycgb
echo 正在关闭远程桌面服务...
reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server" /v "fDenyTSConnections" /d 1 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp" /v "UserAuthentication" /d 1 /t REG_DWORD /f
::关闭远程桌面
sc config RemoteAccess start= DISABLED
net stop RemoteAccess /y
sc config RemoteRegistry start= DISABLED
net stop RemoteRegistry /y
sc config UmRdpService start= DISABLED
net stop UmRdpService /y
sc config TermService start= DISABLED
net stop TermService /y
sc config SessionEnv start= DISABLED
net stop SessionEnv /y
cls
echo.
echo.
mshta vbscript:msgbox("远程桌面已经关闭，无需重启!!",vbSystemModal+64,"提示")(window.close)
goto start
:winxp
cls
echo.
echo.
echo.检测到你的电脑是WINDOWS XP系统。任意将继续。如果检测错误，请直接关闭。
pause >nul
echo.
echo.
net stop LanmanServer /y
sc config LanmanServer start= disabled
echo.
echo.
echo 设置完成。
pause >nul
exit
:yczm
cls
echo.
echo 注意!!
echo 远程桌面必须是有管理员权限的用户，密码不可为空。否则远程桌面开启无效。
echo.
echo.
echo 当前用户是：%USERNAME%
echo.
echo.
set /p pass= 请输入要修改的密码：
If /I "%pass%"=="" goto b
net user %USERNAME% %pass% >nul
cls
echo.
echo.
echo. 设置成功！按任意键继续开启远程桌面服务
pause >nul
cls
echo 正在开启远程桌面服务...
reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server" /v "fDenyTSConnections" /d 0 /t REG_DWORD /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp" /v "UserAuthentication" /d 0 /t REG_DWORD /f
::开启远程桌面
sc config TermService start= auto
net start TermService
sc config SessionEnv start= auto
net start SessionEnv
sc config RemoteAccess start= auto
net start RemoteAccess
sc config RemoteRegistry start= auto
net start RemoteRegistry
sc config UmRdpService start= auto
net start UmRdpService
gpupdate /force
echo.
echo.
mshta vbscript:msgbox("远程桌面已经开启，无需重启!!",vbSystemModal+64,"提示")(window.close)
goto start
:b
mshta vbscript:msgbox("密码没有变动，操作忽略!!",vbSystemModal+64,"提示")(window.close)
goto start

复制代码

wasai007 · 发表于 2020-6-22 16:19

6666666666

一路上有理 · 发表于 2020-6-22 16:35

6666

笑东风丶 · 发表于 2020-6-22 16:35

感谢大佬分享，大牛因有你而更精彩。

隐隐约约 · 发表于 2020-6-22 16:36

好的，非常感谢

z1061856021 · 发表于 2020-6-22 16:53

谢谢大佬

i梦中人 · 发表于 2020-6-22 17:08

谢谢大牛

819803035 · 发表于 2020-6-22 20:18

感谢楼主分享

家里咯看咯MP5 · 发表于 2020-6-22 21:54

谢谢分享

[原创工具] 关于"防护勒索病毒"的一个小工具实用性很强

浏览过的版块

[原创工具] 关于"防护勒索病毒"的一个小工具 实用性很强

浏览过的版块

[原创工具] 关于"防护勒索病毒"的一个小工具实用性很强