用setacl在批处理中修改注册表的权限(页 1) - HIPS专区 - 卡饭论坛 _杀毒软件_防火墙_HIPS_反病毒_计算机安全

lok911 发表于 2008-8-28 18:17

用setacl在批处理中修改注册表的权限

[size=4][color=#ff0000]大家一起研究一下[/color][/size]
[size=4][color=#ff0000][/color][/size]
[size=4][color=#ff0000]@echo off
color 17
mode con: cols=80 lines=40
:Selection
set UpdatePolicy=GPUpdate /Force>nul 2>nul
echo.
echo *******************************************************************************
echo          *                                                 *
echo       *             晗    晗    制    造             *
echo          *                                                 *
echo *******************************************************************************
echo.
echo                            声明：病毒免疫工具
Echo.
Echo       木马和病毒是通过注册表的自启动项，文件关联，系统服务实现自启动的。
echo 本程序将：
echo.
echo 设置  注册表隐藏文件键值为只读。
echo 设置  注册表自启动项为只读。
echo 设置  注册表重要文件关联为只读。
echo 设置  注册表所有服务为只读。
echo.
echo.
echo                            请选择需要执行的操作
echo.
echo                      [1]  安装
echo                      [2]  卸载 (恢复系统默认)
echo                      [3]  退出
echo.
echo                      提示:请务必确定你的计算机无毒。
echo.
set /p name=                      请输入[1,2,3]
if not errorlevel 1 goto goon
cls
goto Selection
:goon
if /i %name%==1 echo.&echo 你选择了安装&goto install
if /i %name%==2 echo.&echo 你选择了卸载 (恢复系统默认)&goto uninstall
if /i %name%==3 echo.&echo 你选择了退出&goto quit
cls
goto Selection

:install
echo.
set OP=-ot reg -actn ace -ace "n:everyone;p:read;m:grant;w:dacl" -actn setprot -op "dacl:p_nc"
set choice=安装
echo Y|cacls "%USERPROFILE%\「开始」菜单\程序\启动" /C /P everyone:r>nul 2>nul
echo Y|cacls "%ALLUSERSPROFILE%\「开始」菜单\程序\启动" /C /P everyone:r>nul 2>nul
goto Doit
:uninstall
echo.
set OP=-ot reg -actn ace -ace "n:everyone;p:read;m:revoke;w:dacl" -actn setprot -op "dacl:np"
set choice=卸载
echo Y|cacls "%USERPROFILE%\「开始」菜单\程序\启动" /C /P everyone:f>nul 2>nul
echo Y|cacls "%ALLUSERSPROFILE%\「开始」菜单\程序\启动" /C /P everyone:f>nul 2>nul
goto Doit

:Doit
echo 修复注册表键值......
rem 修复文件关联
ftype exefile="%%1" %%*>nul 2>nul
assoc .exe=exefile>nul 2>nul
ftype comfile="%%1" %%*>nul 2>nul
assoc .com=comfile>nul 2>nul
ftype scrfile="%%1" %/S>nul 2>nul
assoc .scr=scrfile>nul 2>nul
ftype txtfile=%%SystemRoot%%\system32\NOTEPAD.EXE %%1>nul 2>nul
assoc .txt=txtfile>nul 2>nul
ftype chm.file="c:\windows\hh.exe" %%1>nul 2>nul
assoc .chm=chm.file>nul 2>nul
ftype batfile="%%1" %%*>nul 2>nul
assoc .bat=batfile>nul 2>nul
ftype cmdfile="%%1" %%*>nul 2>nul
assoc .cmd=cmdfile>nul 2>nul
ftype hlpfile=%%SystemRoot%%\system32\winhlp32.exe %%1>nul 2>nul
assoc .hlp=hlpfile>nul 2>nul
ftype inffile=%%SystemRoot%%\System32\NOTEPAD.EXE %%1>nul 2>nul
assoc .inf=inffile>nul 2>nul
ftype inifile=%%SystemRoot%%\System32\NOTEPAD.EXE %%1>nul 2>nul
assoc .ini=inifile>nul 2>nul
ftype piffile="%%1" %%*>nul 2>nul
assoc .pif=piffile>nul 2>nul
ftype regedit=regedit.exe %%1>nul 2>nul
ftype regfile=regedit.exe "%%1">nul 2>nul
assoc .reg=regfile>nul 2>nul
rem 修复隐藏文件
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t reg_dword /d 1 /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v DefaultValue /t reg_dword /d 2 /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden" /v UncheckedValue /t reg_sz /d 1 /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden" /v CheckedValue /t reg_dword /d 0 /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden" /v DefaultValue /t reg_dword /d 0 /f>nul 2>nul
rem 修复AppInit_DLLs
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs /t reg_sz /f>nul 2>nul
echo 操作成功结束

echo.
echo %choice%病毒免疫工具......
rem HKLM
[u][b]setacl[/b][/u] -on "hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\RunEX" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEX" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesEx" %OP%>nul 2>nul

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t reg_dword /d 1 /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v DefaultValue /t reg_dword /d 2 /f>nul 2>nul

[u][b]setacl[/b][/u] -on "hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" %OP%>nul 2>nul

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden" /v UncheckedValue /t reg_sz /d 1 /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden" /v CheckedValue /t reg_dword /d 0 /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden" /v DefaultValue /t reg_dword /d 0 /f>nul 2>nul

[u][b]setacl[/b][/u] -on "hklm\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden" %OP%>nul 2>nul

rem HKCU
[u][b]setacl[/b][/u] -on "hkcu\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcu\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcu\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcu\SOFTWARE\Microsoft\Windows\CurrentVersion\RunEX" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcu\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEX" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcu\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesEx" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcu\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce" %OP%>nul 2>nul

rem HKCR
[u][b]setacl[/b][/u] -on "hkcr\.exe" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\.com" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\.scr" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\.txt" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\.chm" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\.bat" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\.cmd" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\.hlp" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\.inf" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\.ini" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\.pif" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\.reg" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\exefile\shell\open\command" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\inifile\shell\open\command" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\txtfile\shell\open\command" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\comfile\shell\open\command" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\batfile\shell\open\command" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\inffile\shell\open\command" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\scrfile\shell\open\command" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\chm.file\shell\open\command" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\cmdfile\shell\open\command" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\hlpfile\shell\open\command" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\piffile\shell\open\command" %OP%>nul 2>nul
[u][b]setacl[/b][/u] -on "hkcr\regfile\shell\open\command" %OP%>nul 2>nul

rem AppInit_DLLs
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs /t reg_sz /f>nul 2>nul

[u][b]setacl[/b][/u] -on "hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" %OP%>nul 2>nul

echo 操作成功结束

echo.
echo 正在更新帐户策略、审核策略......
REM 刷新本地安全策略
%UpdatePolicy%>nul 2>nul
echo 操作成功结束
echo.
echo.
echo 所有操作成功完成！

:quit
ENDLOCAL
echo.
echo.
title "(*^@^*)"晗晗的QQ：305158720
echo                         $$$ 晗晗制造，版本1.0 $$$
pause>nul 2>nul[/color][/size]

1e3e 发表于 2008-8-28 21:21

我以前用过，似乎加了权限以后计算机启动速度慢多了，另外，楼主这个批处理针对的是setacl那个版本呢？好像版本不同可能不能起到应有的作用

kuririn 发表于 2008-8-28 21:38

setacl我用在不手動設置註冊表權限時

hepen2002 发表于 2008-9-22 09:27

我怎么看不懂诶

页: [1]

卡饭论坛's Archiver

用setacl在批处理中修改注册表的权限