#65410 - 2002-05-13 07:06 AM
Harmful extensions - checker - RFC
|
Kdyer
KiX Supporter
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
With Melissa and Goner in the past, I was thinking that has to be a way to help alleviate some of the infections that go on out there.
Here is what has been thrown together:
code:
:extchecks
; -- Rename or delete FORMAT.COM, so no one can format the drive without intervention
; -- This may not work with W2K/XP if file protection is turned on
IF @inwin = 1 ; -- WINDOWS_NT
IF EXIST ("%WINDIR%\SYSTEM32\FORMAT.COM")
SHELL "%COMSPEC% /C REN %WINDIR%\SYSTEM32\FORMAT.COM %WINDIR%\SYSTEM32\FOR1MAT.COM"
ENDIF
ELSE
IF EXIST ("%WINDIR%\COMMAND\FORMAT.COM")
SHELL "%COMSPEC% /C REN %WINDIR%\COMMAND\FORMAT.COM %WINDIR%\COMMAND\FOR1MAT.COM"
ENDIF
ENDIF
; -- Check for extensions that could pose harm.
; -- Disclaimer: These practices are not always guaranteed
; -- Bat files (Batch files) - Nuisance for script developers
$bataction = READVALUE("HKEY_CLASSES_ROOT\BATFile\Shell","")
IF $bataction <> "Edit" ; -- Check to insure default option is not to immediately execute files
$rc = WRITEVALUE("HKEY_CLASSES_ROOT\BATFile\Shell","","Edit","REG_SZ")
ENDIF
IF @inwin = 1 ; -- WINDOWS_NT
; -- CMD script files (Batch files) - Nuisance for script developers
$cmdaction = READVALUE("HKEY_CLASSES_ROOT\cmdfile\Shell","")
IF $cmdaction <> "Edit" ; -- Check to insure default option is not to immediately open files
$rc = WRITEVALUE("HKEY_CLASSES_ROOT\cmdFile\Shell","","Edit","REG_SZ")
ENDIF
ENDIF
; -- Reg files (Registry export files)
$regaction = READVALUE("HKEY_CLASSES_ROOT\Regfile\Shell","")
IF $regaction <> "" ; -- Check to insure default option is not to immediately merge files
$rc = WRITEVALUE("HKEY_CLASSES_ROOT\Regfile\Shell","","","REG_SZ")
ENDIF
; -- Scr files (Screen Saver files) - i.e. GONER.SCR
$scraction = READVALUE("HKEY_CLASSES_ROOT\SCRFile\Shell","")
IF $scraction <> "" ; -- Check to insure default option is not to immediately open files
$rc = WRITEVALUE("HKEY_CLASSES_ROOT\SCRFile\Shell","","","REG_SZ")
ENDIF
; -- VBScript (Visual Basic Script) - i.e. Melissa - Nuisance for script developers
$vbsaction = READVALUE("HKEY_CLASSES_ROOT\VBSFile\Shell","")
IF $vbsaction <> "Edit" ; -- Default action is to Open. Check to insure to not immediately open files
$rc = WRITEVALUE("HKEY_CLASSES_ROOT\VBSFile\Shell","","Edit","REG_SZ")
ENDIF
RETURN
Thanks!
- Kent
[ 13 May 2002, 07:18: Message edited by: kdyer ]
|
|
Top
|
|
|
|
#65411 - 2002-05-15 07:37 AM
Re: Harmful extensions - checker - RFC
|
Kdyer
KiX Supporter
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
* BUMP *
Any comments?
- Kent
|
|
Top
|
|
|
|
|
#65412 - 2002-05-15 03:24 PM
Re: Harmful extensions - checker - RFC
|
Radimus
Moderator
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
isn't one of the command line functions of cscript and vbscript to reassociate the extensions back to default. If so, changing the defaults may not 'stick' to a well designed script virus... dunno, haven't tried it.
What we do (and I suppose most networks SHOULD do) is to block exe, bat, cmd, and some others from going through the mail server. Of course, that doesn't stop someone from going to hotmail, or sneakernetting exe's, or hyperlinks to those types.
I suppose that a simple thing you could do replace wscript and cscript with notepad during\upon receipt of notification of the latest and greatest script virus... until your AV definitions are updated, then replace the copies with the originals (assuming you use wscript functions regularly)
Nothing is going to be as foolproof as a well maintained AV software... (and basic filtering on the mail server)
like one of my instructors said... "How important is your data?"
|
|
Top
|
|
|
|
|
#65413 - 2002-05-15 10:04 PM
Re: Harmful extensions - checker - RFC
|
New Mexico Mark
Hey THIS is FUN
Registered: 2002-01-03
Posts: 223
Loc: Columbia, SC
|
What I'd really like to see is a script that applies standard security fixes, but runs as follows:
1. Can run interactively or silently. I.e. one could prompt a network administrator about which fixes to apply and expect reasonable answers. But for Joe User, just set some default options and go.
2. Allow all fixes to be controlled from one line. Maybe an array of fix names.
For instance, we routinely disable certain extensions via our logon script. However, we want the flexibility to add another extension almost immediately, if necessary. Here is a code fragment just for file extensions:
code:
:SCRIPTFIX
WriteHeader('SCRIPTFIX')
IF @DAY <> 'Thursday' OR @MDayNo <= 24
Write('INF - This section skipped today.',1)
RETURN
ENDIF
; Disable/enable various script file associations per security requirements.
$sSwitch = 'disable' ; 'enable' or 'disable' script associations here
$sExt = 'VBS,WSH' ; Valid extension strings: VBS,JS,JSE,VBE,WSH,WSF
Write('INF - ScriptFix setting = '+$sSwitch+' '+$sExt,1)
; The following two settings work for windows 2000 or windows NT only
$sWScript = '%systemroot%\system32\wscript.exe "%%1" %%*'
$sCScript = '%systemroot%\system32\cscript.exe "%%1" %%*'
$sRegType = 'reg_expand_sz'
$sRegKey = 'HKCR\txtfile\shell\open\command'
IF KeyExist($sRegKey)
$sTxtFile = ReadValue($sRegKey,'')
FOR EACH $Ext IN Split($sExt,',')
Write('',1)
Write('INF - Setting up variables to ' + $sSwitch + ' ' + $Ext + ' file extensions.',1)
$sDscrptn = '.' + LCase($Ext)
FOR EACH $sCase IN Split('open,open2',',')
$sRegKey = 'HKCR\'+LCase($Ext)+'file\shell\'+$sCase+'\command'
IF InStr($sSwitch,'enab')
IF $sCase='open'
$sEnable=$sWScript
ELSE
$sEnable=$sCScript
ENDIF
ELSE
$sEnable = $sTxtFile
ENDIF
IF KeyExist($sRegKey)
$sRegVal = ReadValue($sRegKey,'')
IF $sRegVal <> '' ; Registry value returned
IF $sRegVal = $sEnable
Write('INF - ' + $sDscrptn+' '+$sCase+' file associations already '+$sSwitch+'d.',1)
ELSE
Write('INF - ' + $sDscrptn+' '+$sCase+' file associations need to be '+$sSwitch+'d.',1)
Write('INF - Reg key is: ' + $sRegKey,1)
Write('INF - Reg val is: ' + $sRegVal,1)
Write('INF - Attempting to change value to: '+$sEnable,1)
IF WriteValue($sRegKey,'',$sEnable,$sRegType)
IF $iLPriv = 3
Write('ERR - Unable to set ' + $sDscrptn + ' extensions to use ' + $sEnable,1)
$iExCode = $iExCode | 65536
ELSE
Write('NFE - Unable to set ' + $sDscrptn + ' extensions to use ' + $sEnable,1)
$iExCode = $iExCode | 512
ENDIF
ELSE
Write('SCC - '+$Ext+' association successfully '+$sSwitch+'d.',1)
$iExCode = $iExCode | 8
ENDIF
ENDIF
ENDIF
ELSE
Write('NFE - ' + $sDscrptn + ' file associations do not appear to be installed on this system.',1)
$iExCode = $iExCode | 512
ENDIF
NEXT
NEXT
ELSE
Write('NFE - Registry key ' + $sRegKey + ' not found.',1)
$iExCode = $iExCode | 512
ENDIF
RETURN
New Mexico Mark
|
|
Top
|
|
|
|
Moderator: Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 837 anonymous users online.
|
|
|
