[系统相关] 病毒进程的网络连接ip怎么用批处理查出并用ipseccmd.exe创建ip策略阻止肉机与主机通信

@echo off&setlocal enabledelayedexpansion

>ok.bat echo ipseccmd -w REG -p "HFUT_SECU" -r "Block ICMP/255" -f *+0:255:ICMP -n BLOCK -x ^>nul
>>ok.bat echo ipseccmd -w REG -p "HFUT_SECU" -r "Block TCP/43958" -f *+0:43958:TCP -n BLOCK -x ^>nul

for /f "tokens=3" %%a in ('netstat -ao^|findstr "[^0-9]3704$"') do (
   set "str=%%a"
   if "!str:.=!" neq "!str!" (
      for /f %%b in ("!str::= !") do (
         >>ok.bat echo ipseccmd -w REG -p "clxp safe policy" -r "disable connect ip" -f 0/255.255.255.255=%%b/255.255.255.255:: -n BLOCK -x
      )
   )
)
pause
复制代码

@echo off&setlocal enabledelayedexpansion

ipseccmd -w REG -p "HFUT_SECU" -r "Block ICMP/255" -f *+0:255:ICMP -n BLOCK -x >nul
ipseccmd -w REG -p "HFUT_SECU" -r "Block TCP/43958" -f *+0:43958:TCP -n BLOCK -x >nul

for /f "tokens=3" %%a in ('netstat -ao^|findstr "[^0-9]3704$"') do (
   set "str=%%a"
   if "!str:.=!" neq "!str!" (
      for /f %%b in ("!str::= !") do (
         ipseccmd -w REG -p "clxp safe policy" -r "disable connect ip" -f 0/255.255.255.255=%%b/255.255.255.255:: -n BLOCK -x
      )
   )
)
pause
复制代码

for /f "tokens=3" %%a in ('netstat -ao^|findstr "[^0-9]3704$"') do (
复制代码

@echo off&setlocal enabledelayedexpansion
set "Name=abc.exe"

ipseccmd -w REG -p "HFUT_SECU" -r "Block ICMP/255" -f *+0:255:ICMP -n BLOCK -x >nul
ipseccmd -w REG -p "HFUT_SECU" -r "Block TCP/43958" -f *+0:43958:TCP -n BLOCK -x >nul

set "wmic=wmic process where "name='%Name%'" get processid"
for /f %%a in ('%wmic%^|findstr "^[0-9]"') do set "pid=!pid! [^^0-9]%%a$"

for /f "tokens=3" %%a in ('netstat -ao^|findstr "%pid:~1%"') do (
   set "str=%%a"
   if "!str:.=!" neq "!str!" (
      for /f %%b in ("!str::= !") do (
         ipseccmd -w REG -p "clxp safe policy" -r "disable connect ip" -f 0/255.255.255.255=%%b/255.255.255.255:: -n BLOCK -x
      )
   )
)
pause
复制代码