Skip to content

Instantly share code, notes, and snippets.

@gitty8
Forked from bantya/stop_badrabbit.bat
Last active October 30, 2017 09:41
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
Save gitty8/a9b5db294655af5602004f3db5cba400 to your computer and use it in GitHub Desktop.
bat: Stop BadRabbit Ransomeware
@echo off
:: For BadRabbit
type NUL > c:\windows\cscc.dat
type NUL > c:\windows\infpub.dat
icacls "c:\windows\cscc.dat" /inheritance:r /remove Administrators
icacls "c:\windows\infpub.dat" /inheritance:r /remove Administrators
:: For Petya/NotPetya/SortaPetya
type NUL > c:\windows\perfc.dll
type NUL > c:\windows\perfc.dat
type NUL > c:\windows\perfc
icacls "c:\windows\perfc.dll" /inheritance:r /remove Administrators
icacls "c:\windows\perfc.dat" /inheritance:r /remove Administrators
icacls "c:\windows\perfc" /inheritance:r /remove Administrators
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment