Skip to content

Instantly share code, notes, and snippets.

@galabadi
Created May 23, 2018 13:26
Show Gist options
  • Save galabadi/33f1901fbdc96bb74eeb1ceedcf90e20 to your computer and use it in GitHub Desktop.
Save galabadi/33f1901fbdc96bb74eeb1ceedcf90e20 to your computer and use it in GitHub Desktop.
CryptoWorm remover script
Get-WmiObject CommandLineEventConsumer -namespace root\subscription | Where-Object {$_.Name -match ('SCM Event Consumer')} | Select-Object -first 1 | Remove-WmiObject
Get-WmiObject __EventFilter -namespace root\subscription | Where-Object {$_.Name -match ('SCM Event Filter')} | Select-Object -first 1 | Remove-WmiObject
netsh.exe ipsec static delete policy name=netbc
netsh.exe ipsec static delete filteraction name=block
netsh.exe ipsec static delete filterlist name=block
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment