Off site wscript.shell √ directive line

The easiest way is to directly delete the proper uninstall program document. Save the following code into a. BAT document, (the following are WIN2000, case in point, if you use 2003, the system folder ought be C: WINDOWS )
regsvr32 / u C: WINNT System32 wshom.ocx
del C: WINNT System32 wshom.ocx
regsvr32 / u C: WINNT system32 shell32.dll
del C: WINNT system32 shell32.dll
then run about, WScript.Shell,Lacoste Swerve Lace Trainers, Shell.application, WScript.Network will be uninstalled. You may be prompted not delete file, do not ignore it, you reset the server, you will find these 3 are prompted to How to Uninstall Wscript.Shell and other objects
1,Lacoste Casual Trainers, uninstall wscript.shell object
run in cmd: regsvr32 WSHom.Ocx / u
2, uninstall the FSO object
run in cmd: regsvr32.exe scrrun.dll / u
3, uninstall the flow object
run in cmd:
regsvr32 / s / u
If you want to re-enable: Please / u parameter on out on the line!
prohibited WScript.Shell
prevent such viruses is to uninstall the Windows scripting host,
characteristic means is: My Computer → Control Panel → Add / Remove Programs to setup WINDOWS → →
Accessories → details → Windows scripting host → OK. In fact, there is a direction extra easy,Lacoste Finham SPM Trainers,
Type the retinue command followed by two
: regsvr32 / u wshom.ocx enter, regsvr32 / u wshext.dll Enter
to connect to the registry. wsh enrolled value of the deleted object. So namely those who must depend on the object by running the virus
not find the object is not run down.

prevention methods Wscript.Shell components:
can modify the registry, the component was renamed.
HKEY_CLASSES_ROOT WScript.Shell and HKEY_CLASSES_ROOT WScript.Shell.1
changed its name to other names, such as: to WScript.Shell_ChangeName or WScript.Shell.1_ChangeName phone when their future use can be normal call this component of the
clsid values ​​must change it
HKEY_CLASSES_ROOT WScript.Shell CLSID item value
HKEY_CLASSES_ROOT WScript.Shell.1 CLSID
likewise the merit of the project can be removed to discourage the injure of such Trojans.
HKEY_CLASSES_ROOT Shell.Application
and
HKEY_CLASSES_ROOT Shell.Application.1
changed its name to other names, such as: to Shell.Application_ChangeName or Shell.Application.1_ChangeName
own After the call when you can use this to call this component of the normal.
clsid values ​​will also change the look
HKEY_CLASSES_ROOT Shell.Application CLSID item value
HKEY_CLASSES_ROOT Shell.Application CLSID
value of the project can be deleted to prevent the risks of such Trojans.
=============================================== =======
above the ocean in the relevant code,Lacoste Radiate Croc Trainers, the code from the above we can penetrate that the common ASP Trojan, Webshell ASP components using primarily the following types:
① WScript.Shell (classid: 72C24DD5-D70A-438B-8A42-98424B88AFB8)
② WScript.Shell.1 (classid: F935DC22-1CF0-11D0-ADB9-00C04FD58A0B)
③ WScript.Network (classid: 093FF999-1EA0-4079-9525-9614C3504B74)
④ WScript.Network.1 (classid: 093FF999-1EA0-4079-9525-9614C3504B74)
⑤ FileSystem Object (classid: 0D43FE01-F093-11CF-8940-00A0C9054228)
⑥ Adodb.stream (classid: 00000566-0000-0010-8000-00AA006D2EA4)
⑦ Shell.applicaiton ....
hehe, but we're aware of the harm to our WEB SERVER IIS is the criminal who had the maximum!! start surgeon, come on ...
2: The solution:
delete or rename the following
① dangerous ASP components:
WScript.Shell, WScript.Shell.1, Wscript.Network, Wscript.Network.1, adodb.stream,
Shell.application
began running -------> ---------> Regedit, open the Registry Editor, reception Ctrl + F to ascertain, enter the above order
Wscript.Shell other component name and the corresponding ClassID, and then delete or change the name (in this circumstance recommend that you renamed, such as
If some pages use ASP agenda, then do the above components, equitable the period apt write ASP code in the component with our label changed
said regular use. Of way, if you are sure your petition does not use ASP or more components, or straight
then delete some of the centers at ease ^ _ ^, it is generally not done routinely these components. Deleted or renamed, iisreset
rose immediately behind restart IIS
effect. )
[NOTE: Because Adodb.Stream this component will be accustomed in numerous pages, so if your virtual host server is open, then
② on the File System Object (classid: 0D43FE01-F093-11CF-8940-00A0C9054228) that is often said that the FSO's
security issues, if your server will absence to use the words of FSO, (part of the virtual host server features normally take to open FSO) can refer to my additional one security solution on the FSO article: Microsoft Windows 2000 Server FSO security risks solution. If you are sure not to use it,Lacoste Running Trainers, can anti-up for this component can be.
③ straight anti-up, method of unloading these dangerous components: (serviceable in ① and ② level do not want such a ponderous method)
uninstall wscript.shell object, or directly under the cmd run: regsvr32 / u% windir% / system32/WSHom.Ocx
uninstall FSO object, alternatively directly beneath the cmd run: regsvr32.exe / u% windir% / system32/scrrun.dll
uninstall stream object, or directly under the cmd run: regsvr32 / s / u
If you want to restore, then just remove the / U or more narrated to re-up components such as ASP: regsvr32.exe% windir% / system32/scrrun.dll
④ Webshell above the use of set domainObject = GetObject (
user information such for hindrance, we can service the Workstation [cater web correlates and communications] service to stop the Lanmanworkstation
and disable then. After this dispose, Webshell exhibit will be vacant by the process.
3 in consensus with the method of 1,2 components of ASP types of hazardous treatment,Lacoste Carnaby Trainers, with Ah Jiang asp needle a mini,
Operating System And then sea test Wsript.Shell to sprint bat command hint is not to establish Active
on the image. Not everybody can not longer harm to the server for the ASP Trojan and restless approximately the security of the system.