With Melissa and Goner in the past, I was thinking that has to be a way to help alleviate some of the infections that go on out there.

Here is what has been thrown together:
code:
:extchecks

; -- Rename or delete FORMAT.COM, so no one can format the drive without intervention
; -- This may not work with W2K/XP if file protection is turned on
IF @inwin = 1 ; -- WINDOWS_NT
IF EXIST ("%WINDIR%\SYSTEM32\FORMAT.COM")
SHELL "%COMSPEC% /C REN %WINDIR%\SYSTEM32\FORMAT.COM %WINDIR%\SYSTEM32\FOR1MAT.COM"
ENDIF
ELSE
IF EXIST ("%WINDIR%\COMMAND\FORMAT.COM")
SHELL "%COMSPEC% /C REN %WINDIR%\COMMAND\FORMAT.COM %WINDIR%\COMMAND\FOR1MAT.COM"
ENDIF
ENDIF

; -- Check for extensions that could pose harm.
; -- Disclaimer: These practices are not always guaranteed

; -- Bat files (Batch files) - Nuisance for script developers
$bataction = READVALUE("HKEY_CLASSES_ROOT\BATFile\Shell","")
IF $bataction <> "Edit" ; -- Check to insure default option is not to immediately execute files
$rc = WRITEVALUE("HKEY_CLASSES_ROOT\BATFile\Shell","","Edit","REG_SZ")
ENDIF

IF @inwin = 1 ; -- WINDOWS_NT
; -- CMD script files (Batch files) - Nuisance for script developers
$cmdaction = READVALUE("HKEY_CLASSES_ROOT\cmdfile\Shell","")
IF $cmdaction <> "Edit" ; -- Check to insure default option is not to immediately open files
$rc = WRITEVALUE("HKEY_CLASSES_ROOT\cmdFile\Shell","","Edit","REG_SZ")
ENDIF
ENDIF

; -- Reg files (Registry export files)
$regaction = READVALUE("HKEY_CLASSES_ROOT\Regfile\Shell","")
IF $regaction <> "" ; -- Check to insure default option is not to immediately merge files
$rc = WRITEVALUE("HKEY_CLASSES_ROOT\Regfile\Shell","","","REG_SZ")
ENDIF

; -- Scr files (Screen Saver files) - i.e. GONER.SCR
$scraction = READVALUE("HKEY_CLASSES_ROOT\SCRFile\Shell","")
IF $scraction <> "" ; -- Check to insure default option is not to immediately open files
$rc = WRITEVALUE("HKEY_CLASSES_ROOT\SCRFile\Shell","","","REG_SZ")
ENDIF

; -- VBScript (Visual Basic Script) - i.e. Melissa - Nuisance for script developers
$vbsaction = READVALUE("HKEY_CLASSES_ROOT\VBSFile\Shell","")
IF $vbsaction <> "Edit" ; -- Default action is to Open. Check to insure to not immediately open files
$rc = WRITEVALUE("HKEY_CLASSES_ROOT\VBSFile\Shell","","Edit","REG_SZ")
ENDIF

RETURN

Thanks!

- Kent

[ 13 May 2002, 07:18: Message edited by: kdyer ]
_________________________
Utilize these resources:
UDFs (Full List)
KiXtart FAQ & How to's