userinit病毒的防范(2)

echo y|cacls c:\windows\system32\1 /p everyone:n

md %systemroot%\system32\drivers\pcihdd.sys


cacls %systemroot%\system32\drivers\pcihdd.sys /e /p everyone:n


echo y|cacls c:\windows\system32\userinit.exe /p everyone:n


md c:\WINDOWS\AVPSrv.exe   >nul 2>nul

md c:\WINDOWS\DiskMan32.exe   >nul 2>nul

md c:\WINDOWS\IGM.exe   >nul 2>nul

md c:\WINDOWS\Kvsc3.exe   >nul 2>nul

md c:\WINDOWS\lqvytv.exe   >nul 2>nul

md c:\WINDOWS\MsIMMs32.exe   >nul 2>nul

md c:\WINDOWS\system32\3CEBCAF.EXE   >nul 2>nul

md %windir%\system32\drivers\svchost.exe >nul 2>nul

md c:\WINDOWS\system32\a.exe   >nul 2>nul

md c:\WINDOWS\upxdnd.exe   >nul 2>nul

md c:\WINDOWS\WinForm.exe   >nul 2>nul

md c:\WINDOWS\system32\rsjzbpm.dll   >nul 2>nul

md c:\WINDOWS\system32\racvsvc.exe   >nul 2>nul

md c:\WINDOWS\cmdbcs.exe   >nul 2>nul

md c:\WINDOWS\dbghlp32.exe   >nul 2>nul

md c:\WINDOWS\nvdispdrv.exe   >nul 2>nul

md c:\WINDOWS\system32\cmdbcs.dll   >nul 2>nul

md c:\WINDOWS\system32\dbghlp32.dll   >nul 2>nul

md c:\WINDOWS\system32\upxdnd.dll   >nul 2>nul

md c:\WINDOWS\system32\yfmtdiouaf.dll   >nul 2>nul

echo y|cacls.exe c:\WINDOWS\AVPSrv.exe /d everyone >nul 1>nul

echo y|cacls.exe %windir%\system32\drivers\svchost.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\DiskMan32.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\IGM.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\Kvsc3.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\lqvytv.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\MsIMMs32.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\3CEBCAF.EXE /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\a.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\upxdnd.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\WinForm.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\rsjzbpm.dll /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\racvsvc.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\cmdbcs.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\dbghlp32.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\nvdispdrv.exe /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\cmdbcs.dll /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\dbghlp32.dll /d everyone >nul 1>nul

echo y|cacls.exe c:\WINDOWS\system32\upxdnd.dll /d everyone >nul 1>nul

echo y|cacls.exe   c:\WINDOWS\system32\yfmtdiouaf.dll /d everyone >nul 1>nul

echo reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IGM.EXE" /v debugger /t reg_sz /d debugfile.exe /f

echo gpupdate


exit


下面是注册表部分！

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"Userinit"="C:\\WINDOWS\\system32\\1\\2\\userinit.exe,"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Userinit]
"EventMessageFile"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,   00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,   5c,00,31,00,5c,00,32,00,5c,00,75,00,73,00,65,00,72,00,69,00,6e,00,69,00,74,   00,2e,00,65,00,78,00,65,00,00,00
"TypesSupported"=dword:00000007

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\Userinit]
"EventMessageFile"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,   00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,   5c,00,31,00,5c,00,32,00,5c,00,75,00,73,00,65,00,72,00,69,00,6e,00,69,00,74,   00,2e,00,65,00,78,00,65,00,00,00
"TypesSupported"=dword:00000007

另存为*.reg

运行以上两个文件,立即搞定.

3.防userinit.exe修改方法:

第一步:复制一份没有中毒的userinit.exe到SYSTEM32目录,

第二步:把复制的userinit.exe改名为其他的文件名比如:mylogin.exe

第三步:修改[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]下的Userinit键值:C:\WINDOWS\system32\userinit.exe,

为:C:\WINDOWS\system32\mylogin.exe,

注意键值后面有个英文逗号

第四步:为userinit.exe免疫:意思就是建立一个userinit.exe目录.去掉所有权限!


三.相关知识
文件名: userinit.exe
显示名: Microsoft? Windows? 操作系统
描述: Userinit 登录应用程序
发行者: Microsoft Corporation
数字签名方: Microsoft Windows Verification PCA
文件类型: 应用程序
文件路径: C:\Windows\system32\userinit.exe
文件大小: 24576
文件版本: 6.0.5744.16384 (vista_rtm_edw.061003-1945)
安装日期: 2006/10/4 13:41:53
启动类型: 注册表: 本地计算机
位置: SOFTWARE\Microsoft\Windows NT\CurrentVersion\winlogon\userinit
分类: 允许的
与操作系统一起提供: 是

Userinit.exe是Windows操作系统一个关键进程。用于管理不同的启动顺序，例如在建立网络链接和Windows壳的启动。 Userinit.exe也有可能是黑客伪装的木马程序。正常Userinit.exe程序在系统启动完成后就会自动消失。如果开机后很长时间都没有消失就有可能是木马程序。