Skip to content

Instantly share code, notes, and snippets.

@galabadi

galabadi/CryptoWorm-remover.ps1

Created May 23, 2018 13:26
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save galabadi/33f1901fbdc96bb74eeb1ceedcf90e20 to your computer and use it in GitHub Desktop.
Save galabadi/33f1901fbdc96bb74eeb1ceedcf90e20 to your computer and use it in GitHub Desktop.
Download ZIP
CryptoWorm remover script
Raw
CryptoWorm-remover.ps1
Get-WmiObject CommandLineEventConsumer -namespace root\subscription | Where-Object {$_.Name -match ('SCM Event Consumer')} | Select-Object -first 1 | Remove-WmiObject
Get-WmiObject __EventFilter -namespace root\subscription | Where-Object {$_.Name -match ('SCM Event Filter')} | Select-Object -first 1 | Remove-WmiObject
netsh.exe ipsec static delete policy name=netbc
netsh.exe ipsec static delete filteraction name=block
netsh.exe ipsec static delete filterlist name=block
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment