勒索病毒防护脚本，一键关闭高危端口和服务

cn1188181 2021-06-08

展开全文

%1 mshta vbscript:CreateObject('Shell.Application').ShellExecute('cmd.exe','/c %~s0 ::','','runas',1)(window.close)&&exit

echo.@echo offcolor 1fecho.chcp 65001echo.title 您正在使用一键关闭危险端口和服务 by Mannixecho.echo 您正在使用一键关闭危险端口和服务echo.echo 正在帮您关闭这些危险端口，请稍等echo.echo 正在开启Windows防火墙服务echo.net start MpsSvcecho.echo 正在帮您开启Windows防火墙自启动echo.sc config MpsSvc start= autoecho.echo 正在启用防火墙echo.netsh advfirewall set allprofiles state onecho.

echo 正在帮您关闭端口....echo.echo.echo.

echo 正在关闭 135 端口请稍候…netsh advfirewall firewall delete rule name = 'Disable port 135 - TCP'

netsh advfirewall firewall add rule name = 'Disable port 135 - TCP' dir = in action = block protocol = TCP localport = 135

echo.netsh advfirewall firewall delete rule name = 'Disable port 135 - UDP'

netsh advfirewall firewall add rule name = 'Disable port 135 - UDP' dir = in action = block protocol = UDP localport = 135

echo.

echo 正在关闭 137 端口请稍候…netsh advfirewall firewall delete rule name = 'Disable port 137 - TCP'

netsh advfirewall firewall add rule name = 'Disable port 137 - TCP' dir = in action = block protocol = TCP localport = 137

echo.netsh advfirewall firewall delete rule name = 'Disable port 137 - UDP'

netsh advfirewall firewall add rule name = 'Disable port 137 - UDP' dir = in action = block protocol = UDP localport = 137

echo.

echo 正在关闭 138 端口请稍候…netsh advfirewall firewall delete rule name = 'Disable port 138 - TCP'

netsh advfirewall firewall add rule name = 'Disable port 138 - TCP' dir = in action = block protocol = TCP localport = 138

echo.netsh advfirewall firewall delete rule name = 'Disable port 138 - UDP'

netsh advfirewall firewall add rule name = 'Disable port 138 - UDP' dir = in action = block protocol = UDP localport = 138

echo.

echo 正在关闭 139 端口请稍候…netsh advfirewall firewall delete rule name = 'Disable port 139 - TCP'

netsh advfirewall firewall add rule name = 'Disable port 139 - TCP' dir = in action = block protocol = TCP localport = 139

echo.netsh advfirewall firewall delete rule name = 'Disable port 139 - UDP'

netsh advfirewall firewall add rule name = 'Disable port 139 - UDP' dir = in action = block protocol = UDP localport = 139

echo.

echo 正在关闭 445 端口请稍候…netsh advfirewall firewall delete rule name = 'Disable port 445 - TCP'

netsh advfirewall firewall add rule name = 'Disable port 445 - TCP' dir = in action = block protocol = TCP localport = 445

echo.netsh advfirewall firewall delete rule name = 'Disable port 445 - UDP'

netsh advfirewall firewall add rule name = 'Disable port 445 - UDP' dir = in action = block protocol = UDP localport = 445

echo.

echo 正在关闭 3389 端口请稍候…netsh advfirewall firewall delete rule name = 'Disable port 3389 - TCP'

netsh advfirewall firewall add rule name = 'Disable port 3389 - TCP' dir = in action = block protocol = TCP localport = 445

echo.netsh advfirewall firewall delete rule name = 'Disable port 3389 - UDP'

netsh advfirewall firewall add rule name = 'Disable port 3389 - UDP' dir = in action = block protocol = UDP localport = 445

echo.

echo 危险端口已经用Windows防火墙关闭成功

echo.echo ----------------echo 正在关闭 Workstation（LanmanWorkstation）服务sc stop LanmanWorkstationsc config LanmanWorkstation start= disabled

echo.echo ----------------echo 正在关闭 Server（LanmanServer）服务sc stop LanmanServersc config LanmanServer start= disabled

echo.echo ----------------echo 正在关闭 TCP/IP NetBIOS Helper（lmhosts）共享服务sc stop lmhostssc config lmhosts start= disabled

echo.echo ----------------echo 正在关闭 Distributed Transaction Coordinator（MSDTC）共享服务sc stop MSDTCsc config MSDTC start= disabled

echo.echo ----------------echo 正在关闭 NetBT 服务sc stop NetBTsc config NetBT start= disabled

echo.echo ----------------reg add 'hklm\System\CurrentControlSet\Services\NetBT\Parameters' /v 'SMBDeviceEnabled' /t reg_dword /d '0' /freg add 'hklm\SOFTWARE\Microsoft\Ole' /v 'EnableDCOM' /t reg_sz /d 'N' /freg add 'hklm\SOFTWARE\Microsoft\Rpc' /v 'DCOM Protocols' /t reg_multi_sz /d '' /f

echo.echo ----------------echo 恭喜您，危险端口已经关闭,请重新启动电脑后用 netstat -an 查看本地端口

echo 按任意键退出pause>nul