Server Security in half a minute

This article is organized by the maintainer Ms

: Disable the WS command line component.
Regsvr32/s wshom. ocx

: Prevents Windows vulnerabilities from [Sticky Keys]. "This is a history of the coolest Windows Background sethc.exe"

Cscript.exe xcacls. vbs "% SystemRoot %/system32/sethc.exe"/d everyone: M/E
Cscript.exe xcacls. vbs "% SystemRoot %/servicepackfiles/i386/sethc.exe"/d everyone: M/E

: Delete system32 \ npptools. dll and set npptools. DLL to read-only. permission restrictions can prevent all ARP viruses.

Del % SystemRoot % \ system32 \ npptools. dll/A/f/Q
Dir % SystemRoot % \ system32 \ COM> % SystemRoot % \ system32 \ npptools. dll
Attrib + R + S + H % SystemRoot % \ system32 \ npptools. dll
Cscript.exe xcacls. vbs "% SystemRoot %/system32/npptools. dll"/d everyone: M/E

: Delete system32 \ packet. dll and set packet. DLL to read-only. permission restrictions can prevent all ARP viruses.

Del % SystemRoot % \ system32 \ packet. dll/A/f/Q
Dir % SystemRoot % \ system32 \ COM> % SystemRoot % \ system32 \ packet. dll
Attrib + R + S + H % SystemRoot % \ system32 \ packet. dll
Cscript.exe xcacls. vbs "% SystemRoot %/system32/packet. dll"/d everyone: M/E

: Delete system32 \ pthreadvc. dll, and set new pthreadvc. DLL to read-only. permission restrictions can prevent all ARP viruses.

Del % SystemRoot % \ system32 \ pthreadvc. dll/A/f/Q
Dir % SystemRoot % \ system32 \ COM> % SystemRoot % \ system32 \ pthreadvc. dll
Attrib + R + S + H % SystemRoot % \ system32 \ pthreadvc. dll
Cscript.exe xcacls. vbs "% SystemRoot %/system32/pthreadvc. dll"/d everyone: M/E

: Delete system32 \ wpcap. dll, and set new wpcap. DLL to read-only. permission restrictions can prevent all ARP viruses.

Del % SystemRoot % \ system32 \ wpcap. dll/A/f/Q
Dir % SystemRoot % \ system32 \ COM> % SystemRoot % \ system32 \ wpcap. dll
Attrib + R + S + H % SystemRoot % \ system32 \ wpcap. dll
Cscript.exe xcacls. vbs "% SystemRoot %/system32/wpcap. dll"/d everyone: M/E

: Delete system32 \ NPF. sys and set NPF. sys to read-only. permission restrictions can prevent all ARP viruses.

Del % SystemRoot % \ system32 \ drivers \ NPF. sys/A/f/Q
Dir % SystemRoot % \ system32 \ COM> % SystemRoot % \ system32 \ drivers \ NPF. sys
Attrib + R + S + H % SystemRoot % \ system32 \ NPF. sys
Cscript.exe xcacls. vbs "% SystemRoot %/system32/Drivers/NPF. sys"/d everyone: M/E

Echo disabled loading startup items by restarting and renaming

: The execution priority of restart rename is higher than that of the traditional self-start (HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run ).

After the task is completed, you can delete or rename it back. This method is extremely concealed and cannot be detected by existing security tools.
: The virus is loaded by restarting the rename method, which is located in the Registry HKEY_LOCAL_MACHINE \ SYSTEM \ controlset001 \ Control \ backuprestore \ keysnottorestore

The pending rename operations string.

Reg Delete "HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager"/V pendingfilerenameoperations/F

: Disable event tracking.Program
Reg Add "HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ Windows NT \ reliability"/V shutdownreasonon/T REG_DWORD/d

"00000000"/F

: Prevent Windows from running the program you specified in this setting.
: If this setting is enabled, you cannot run the programs added to the list of applications that are not allowed.

Reg Add "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer"/V disallowrun/T REG_DWORD/d

"00000001"/F
Reg Add "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ disallowrun"/V login. scr/T REG_SZ

/D login. scr/F
Reg Add "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ disallowrun"/V xsiff.exe/T REG_SZ

/D xsiff.exe/F
Reg Add "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ disallowrun"/V xsniff.exe/T

REG_SZ/d xsniff.exe/F
Reg Add "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ disallowrun"/V sethc.exe/T REG_SZ

/D sethc.exe/F
Reg Add "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ disallowrun"/V winpcap.exe/T

REG_SZ/d winpcap.exe/F
Reg Add "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ disallowrun"/V nc.exe/T REG_SZ/d

Nc.exe/F
Reg Add "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ disallowrun"/V SQL .exe/T REG_SZ

/D SQL .exe/F
Reg Add "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ disallowrun"/V su.exe/T REG_SZ/d

Su.exe/F

Regsvr32/S/u wshom. ocx

echo application restricts group policies to further enhance server security performance!
C:
CD \
Cd "% SystemRoot %/system32/grouppolicy/machine"
copy registry. pol registry. old/Y
copy registry. pol "% SystemRoot %/system32/grouppolicy/machine"/Y
gpupdate/force
echo the Application Software Restriction group policy has been set, press any key to return and select another operation to continue...
pause> NUL
exit