记录一次清理mssecsvr勒索病毒以及禁用135和445端口

@echo off

echo 关闭445端口与相关服务
sc stop lanmanserver >nul 2>&1
sc config lanmanserver start= disabled >nul 2>&1

echo 关闭135端口与相关服务
reg add HKLM\SOFTWARE\Microsoft\Rpc /v "DCOM Protocols" /t REG_MULTI_SZ /d "" /f >nul 2>&1
reg add HKLM\SOFTWARE\Microsoft\Rpc\Internet /f >nul 2>&1

echo 添加IPSec安全策略,过滤不安全的端口

REM 删除旧的策略
netsh ipsec static delete policy name=SECGUEST >nul 2>&1

REM 禁用危险端口
netsh ipsec static add policy name=SECGUEST >nul 2>&1
netsh ipsec static add filteraction name=Block action=block >nul 2>&1
netsh ipsec static add filterlist name=SECCPF >nul 2>&1
netsh ipsec static add filter filterlist=SECCPF srcaddr=Any dstaddr=Me dstport=135 protocol=TCP >nul 2>&1
netsh ipsec static add filter filterlist=SECCPF srcaddr=Any dstaddr=Me dstport=445 protocol=TCP >nul 2>&1
netsh ipsec static add rule name=SECCPR policy=SECGUEST filterlist=SECCPF filteraction=Block >nul 2>&1
netsh ipsec static set policy name=SECGUEST assign=y >nul 2>&1

echo 关闭并删掉与mssecsvr.exe相关服务与文件
sc stop mssecsvc2.1 >nul 2>&1
sc config mssecsvc2.1 start= disabled >nul 2>&1
sc delete mssecsvc2.1 >nul 2>&1
for /f "tokens=2,3*" %%i in ('tasklist ^| findstr "tasksche.exe"') do (@taskkill /pid %%i /f)
for /f "tokens=2,3*" %%i in ('tasklist ^| findstr "mssecsvr.exe"') do @set mssecsvr_pid=%%i >nul 2>&1
if defined mssecsvr_pid (echo mssecsvr.exe's pid : %mssecsvr_pid% && taskkill /pid %mssecsvr_pid% /f) else (echo mssecsvr.exe未启动)

REM 删除mssecsvr.exe,tasksche.exe,qeriuwjhrf
REM del c:\windows\tasksche.exe
REM del c:\windows\mssecsvr.exe
REM del c:\windows\qeriuwjhrf

pause