注册表，添加/删除程序都试了，都不行。我是这样做的：再次安装，并在安装的时候打开得知的那个安装目标文件夹的上级文件夹，这时会出现那个文件夹。因为在安装完成之后大约5秒之后这个文件夹就会消失，所以我就在安装刚完成的时候迅速打开它，并把它里的文件拷出来研究。
运行其中的一个批处理文件，里面就有删除安全策略的选项。所以重新启用Ping的问题就算解决了。
可新的问题有来了：为什么安装的目标文件夹在安装后会消失，而且在cmd中用dir /a命令都没法看到？而且我发现如果重复安装，它的名字都在改变（由RarSFX0，到RarSFX1,RarSFX2,RarSFX3……）
本来想把拷出来的东西让高手们参考一下，可是太大了，传不上……
下面就是我说的那个批处理文件的程序（另外还有两个批处理，两个exe,一个dll):
@ECHO OFF
REM For Windows 2000 systems this script requires ipsecpol.exe to be in the system path or in the same
REM directory as the script.
REM
REM IPSecpol.exe can be downloaded for Windows 2000 from:
REM http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/ipsecpol-o.asp
REM
REM For Windows XP and Windows Server 2003 systems this script requires ipseccmd.exe in the system path
REM or in the same directory as the script.
REM This tool can be found in the Windows XP Support Tools directory on the Windows XP installation CD.
REM BEGIN
REM
REM Figure out what operating system we're running on before doing anything.
REM If running on Win9x, NT 4.0 or lower, throw error and exit.
REM detect Windows NT vs. 9x
if (%OS%)==(Windows_NT) goto NT
goto Unsupported
:NT
REM determine build of NT (if necessary)
for /f "delims=[] tokens=2" %%i in ('ver') do set MyVer=%%i
for /f "tokens=2" %%i in ('echo %MyVer%') do set MyVer=%%i
for /f "tokens=1,2,3 delims=." %%i in ('echo %MyVer%') do (
set MajorVer=%%i
set MinorVer=%%j
set BuildNum=%%k
)
set MyVer=
REM echo MajorVer == %MajorVer%
REM echo MinorVer == %MinorVer%
REM echo BuildNum == %BuildNum%
REM Check if they are running on NT 4.0, the code above returns 'is' on NT 4.0
IF /I %MajorVer%==is GOTO Unsupported
IF /I '%1'=='' GOTO GetChoice
SET Choice=%1
GOTO CreateIPSecPolicyBasedOnOS
:GetChoice
cls
echo --------------------------------------------------------------------------------
echo RPC Port Blocker Script version 2.0
echo Created by Microsoft PSS Security
echo.
echo This batch file creates an IPSec policy that can block DCOM / RPC and ICMP
echo connection attempts over the following NetBIOS, SMB, RPC or blaster ports:
echo.
echo RPC Ports: UDP/TCP 135+445, UDP 137+138 and TCP 139+593
echo Blaster Ports: TCP 135, UDP 69, TCP 4444, ICMP Protocol
echo.
echo Windows 2000 and higher operating system options (NT 4.0 is not supported):
echo Press '1' to block access to RPC ports listed above (inbound direction only)
echo Press '2' to block access to RPC ports listed above (inbound and outbound)
echo Press '3' to block ONLY ports used by Blaster (inbound direction only).
echo Press '4' to unassign and delete the IPSec policy created by this script.
echo --------------------------------------------------------------------------------
echo.
SET Choice=
SET /P Choice=Please select an option number from above and then press Enter:
goto CreateIPSecPolicyBasedOnOS
:CreateIPSecPolicyBasedOnOS
IF /I '%Choice%' GEQ '5' goto ERROR
IF /I '%Choice%'=='1' (
If '%MinorVer%'=='00' goto Choice1_OSmv00
)
IF /I '%Choice%'=='2' (
If '%MinorVer%'=='00' goto Choice2_OSmv00
)
IF /I '%Choice%'=='3' (
If '%MinorVer%'=='00' goto Choice3_OSmv00
)
IF /I '%Choice%'=='4' (
If '%MinorVer%'=='00' goto Choice4_OSmv00
)
IF /I '%Choice%'=='1' (
If '%MinorVer%'=='1' goto Choice1_OSmv1
)
IF /I '%Choice%'=='2' (
If '%MinorVer%'=='1' goto Choice2_OSmv1
)
IF /I '%Choice%'=='3' (
If '%MinorVer%'=='1' goto Choice3_OSmv1
)
IF /I '%Choice%'=='4' (
If '%MinorVer%'=='1' goto Choice4_OSmv1
)
IF /I '%Choice%'=='1' (
If '%MinorVer%'=='2' goto Choice1_OSmv1
)
IF /I '%Choice%'=='2' (
If '%MinorVer%'=='2' goto Choice2_OSmv1
)
IF /I '%Choice%'=='3' (
If '%MinorVer%'=='2' goto Choice3_OSmv1
)
IF /I '%Choice%'=='4' (
If '%MinorVer%'=='2' goto Choice4_OSmv1
)
:Choice1_OSmv00
cls
echo "You have chosen to block only inbound RPC connections . . . "
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 135 Rule" -f *+0:135:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 135 Rule" -f *+0:135:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 137 Rule" -f *+0:137:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 138 Rule" -f *+0:138:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 139 Rule" -f *+0:139:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 445 Rule" -f *+0:445:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 445 Rule" -f *+0:445:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 593 Rule" -f *+0:593:TCP -n BLOCK
REM - Assign the policy
ipsecpol -w REG -p "Block RPC Attack Vectors" -x
IF /I '%ERRORLEVEL%' EQU '0' (echo "IPSec Policy created and assigned successfully!")
IF /I '%ERRORLEVEL%' NEQ '0' (echo "There were problems creating or assigning the IP Security Policy")
goto end
:Choice2_OSmv00
cls
echo "You have chosen to block both inbound and outbound RPC connections . . ."
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 135 Rule" -f *+0:135:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 135 Rule" -f *+0:135:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 137 Rule" -f *+0:137:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 138 Rule" -f *+0:138:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 139 Rule" -f *+0:139:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 445 Rule" -f *+0:445:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 445 Rule" -f *+0:445:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 593 Rule" -f *+0:593:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Outbound UDP 135 Rule" -f 0+*:135:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Outbound TCP 135 Rule" -f 0+*:135:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Outbound UDP 137 Rule" -f 0+*:137:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Outbound UDP 138 Rule" -f 0+*:138:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Outbound TCP 139 Rule" -f 0+*:139:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Outbound TCP 445 Rule" -f 0+*:445:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Outbound UDP 445 Rule" -f 0+*:445:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Outbound TCP 593 Rule" -f 0+*:593:TCP -n BLOCK
REM - Assign the policy
ipsecpol -w REG -p "Block RPC Attack Vectors" -x
IF /I '%ERRORLEVEL%' EQU '0' (echo "IPSec Policy created and assigned successfully!")
IF /I '%ERRORLEVEL%' NEQ '0' (echo "There were problems creating or assigning the IP Security Policy")
goto end
:Choice3_OSmv00
cls
echo "You have chosen to block only the ports used by blaster and variants . . . "
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 135 Rule" -f *+0:135:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 4444 Control Channel Rule" -f *+0:4444:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Outbound TCP 4444 Control Channel Rule" -f 0+*:4444:TCP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 69 TFTP Rule" -f *+0:69:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Outbound UDP 69 TFTP Rule" -f 0+*:69:UDP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Inbound ICMP Rule" -f *+0:0:ICMP -n BLOCK
ipsecpol -w REG -p "Block RPC Attack Vectors" -r "Block Outbound ICMP Rule" -f 0+*:0:ICMP -n BLOCK
REM - Assign the policy
ipsecpol -w REG -p "Block RPC Attack Vectors" -x
IF /I '%ERRORLEVEL%' EQU '0' (echo "IPSec Policy created and assigned successfully!")
IF /I '%ERRORLEVEL%' NEQ '0' (echo "There were problems creating or assigning the IP Security Policy")
goto end
:Choice4_OSmv00
cls
echo You have chosen to unassign and remove the IPSec policy created by this script.
REM - Unassign the policy
ipsecpol -w REG -p "Block RPC Attack Vectors" -y
ipsecpol -w REG -p "Block RPC Attack Vectors" -o
IF /I '%ERRORLEVEL%' EQU '0' (echo "IPSec Policy unassigned and removed successfully!")
IF /I '%ERRORLEVEL%' NEQ '0' (echo "There were problems unassigning or removing the IP Security Policy")
goto end
:Choice1_OSmv1
cls
echo "You have chosen to block only inbound RPC connections . . . "
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 135 Rule" -f *+0:135:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 135 Rule" -f *+0:135:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 137 Rule" -f *+0:137:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 138 Rule" -f *+0:138:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 139 Rule" -f *+0:139:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 445 Rule" -f *+0:445:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 445 Rule" -f *+0:445:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 593 Rule" -f *+0:593:TCP -n BLOCK
REM - Assign the policy
ipseccmd -w REG -p "Block RPC Attack Vectors" -x
IF /I '%ERRORLEVEL%' EQU '0' (echo "IPSec Policy created and assigned successfully!")
IF /I '%ERRORLEVEL%' NEQ '0' (echo "There were problems creating or assigning the IP Security Policy")
goto end
:Choice2_OSmv1
cls
echo "You have chosen to block both inbound and outbound RPC connections . . ."
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 135 Rule" -f *+0:135:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 135 Rule" -f *+0:135:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 137 Rule" -f *+0:137:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 138 Rule" -f *+0:138:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 139 Rule" -f *+0:139:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 445 Rule" -f *+0:445:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 445 Rule" -f *+0:445:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 593 Rule" -f *+0:593:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Outbound UDP 135 Rule" -f 0+*:135:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Outbound TCP 135 Rule" -f 0+*:135:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Outbound UDP 137 Rule" -f 0+*:137:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Outbound UDP 138 Rule" -f 0+*:138:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Outbound TCP 139 Rule" -f 0+*:139:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Outbound TCP 445 Rule" -f 0+*:445:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Outbound UDP 445 Rule" -f 0+*:445:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Outbound TCP 593 Rule" -f 0+*:593:TCP -n BLOCK
REM - Assign the policy
ipseccmd -w REG -p "Block RPC Attack Vectors" -x
IF /I '%ERRORLEVEL%' EQU '0' (echo "IPSec Policy created and assigned successfully!")
IF /I '%ERRORLEVEL%' NEQ '0' (echo "There were problems creating or assigning the IP Security Policy")
goto end
:Choice3_OSmv1
cls
echo "You have chosen to block only the ports used by blaster and variants . . . "
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 135 Rule" -f *+0:135:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound TCP 4444 Control Channel Rule" -f *+0:4444:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Outbound TCP 4444 Control Channel Rule" -f 0+*:4444:TCP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound UDP 69 TFTP Rule" -f *+0:69:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Outbound UDP 69 TFTP Rule" -f 0+*:69:UDP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Inbound ICMP Rule" -f *+0:0:ICMP -n BLOCK
ipseccmd -w REG -p "Block RPC Attack Vectors" -r "Block Outbound ICMP Rule" -f 0+*:0:ICMP -n BLOCK
REM - Assign the policy
ipseccmd -w REG -p "Block RPC Attack Vectors" -x
IF /I '%ERRORLEVEL%' EQU '0' (echo "IPSec Policy created and assigned successfully!")
IF /I '%ERRORLEVEL%' NEQ '0' (echo "There were problems creating or assigning the IP Security Policy")
goto end
:Choice4_OSmv1
cls
echo You have chosen to unassign and remove the IPSec policy created by this script.
REM - Unassign the policy
ipseccmd -w REG -p "Block RPC Attack Vectors" -y
ipseccmd -w REG -p "Block RPC Attack Vectors" -o
IF /I '%ERRORLEVEL%' EQU 0 (echo "IPSec Policy unassigned and removed successfully!")
IF /I '%ERRORLEVEL%' NEQ 0 (echo "There were problems unassigning or removing the IP Security Policy")
goto end
:Unsupported
cls
ECHO You appear to be running this script on an un-supported operating system.
ECHO This script can only run on Windows 2000 or later operating systems.
ECHO NT 4.0 does not contain support for IPSec.
goto end
:ERROR
ECHO You have entered an invalid choice. Please enter an option from 1-4
goto GetChoice
:end
IF /I '%1'=='' (pause)
我看不懂，高手能指点一下吗？
谢谢！！！ |
