#65410 - 2002-05-13 07:06 AM
Harmful extensions - checker - RFC
|
Kdyer
KiX Supporter
   
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
With Melissa and Goner in the past, I was thinking that has to be a way to help alleviate some of the infections that go on out there.
Here is what has been thrown together:
code:
:extchecks
; -- Rename or delete FORMAT.COM, so no one can format the drive without intervention ; -- This may not work with W2K/XP if file protection is turned on IF @inwin = 1 ; -- WINDOWS_NT IF EXIST ("%WINDIR%\SYSTEM32\FORMAT.COM") SHELL "%COMSPEC% /C REN %WINDIR%\SYSTEM32\FORMAT.COM %WINDIR%\SYSTEM32\FOR1MAT.COM" ENDIF ELSE IF EXIST ("%WINDIR%\COMMAND\FORMAT.COM") SHELL "%COMSPEC% /C REN %WINDIR%\COMMAND\FORMAT.COM %WINDIR%\COMMAND\FOR1MAT.COM" ENDIF ENDIF
; -- Check for extensions that could pose harm. ; -- Disclaimer: These practices are not always guaranteed
; -- Bat files (Batch files) - Nuisance for script developers $bataction = READVALUE("HKEY_CLASSES_ROOT\BATFile\Shell","") IF $bataction <> "Edit" ; -- Check to insure default option is not to immediately execute files $rc = WRITEVALUE("HKEY_CLASSES_ROOT\BATFile\Shell","","Edit","REG_SZ") ENDIF
IF @inwin = 1 ; -- WINDOWS_NT ; -- CMD script files (Batch files) - Nuisance for script developers $cmdaction = READVALUE("HKEY_CLASSES_ROOT\cmdfile\Shell","") IF $cmdaction <> "Edit" ; -- Check to insure default option is not to immediately open files $rc = WRITEVALUE("HKEY_CLASSES_ROOT\cmdFile\Shell","","Edit","REG_SZ") ENDIF ENDIF
; -- Reg files (Registry export files) $regaction = READVALUE("HKEY_CLASSES_ROOT\Regfile\Shell","") IF $regaction <> "" ; -- Check to insure default option is not to immediately merge files $rc = WRITEVALUE("HKEY_CLASSES_ROOT\Regfile\Shell","","","REG_SZ") ENDIF
; -- Scr files (Screen Saver files) - i.e. GONER.SCR $scraction = READVALUE("HKEY_CLASSES_ROOT\SCRFile\Shell","") IF $scraction <> "" ; -- Check to insure default option is not to immediately open files $rc = WRITEVALUE("HKEY_CLASSES_ROOT\SCRFile\Shell","","","REG_SZ") ENDIF
; -- VBScript (Visual Basic Script) - i.e. Melissa - Nuisance for script developers $vbsaction = READVALUE("HKEY_CLASSES_ROOT\VBSFile\Shell","") IF $vbsaction <> "Edit" ; -- Default action is to Open. Check to insure to not immediately open files $rc = WRITEVALUE("HKEY_CLASSES_ROOT\VBSFile\Shell","","Edit","REG_SZ") ENDIF
RETURN
Thanks!
- Kent [ 13 May 2002, 07:18: Message edited by: kdyer ]
|
|
Top
|
|
|
|
Moderator: Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 1046 anonymous users online.
|
|
|