peet47

## Kill-Ransomware.ps1
# Ransomware Killer v0.1 by Thomas Patzke <thomas@patzke.org>
# Kill all parent processes of the command that tries to run "vssadmin Delete Shadows"
# IMPORTANT: This must run with Administrator privileges!
Register-WmiEvent -Query "select * from __instancecreationevent within 0.1 where targetinstance isa 'win32_process' and targetinstance.CommandLine like '%vssadmin%Delete%Shadows%'" -Action {
    # Kill all parent processes from detected vssadmin process
    $p = $EventArgs.NewEvent.TargetInstance
    while ($p) {
       $ppid = $p.ParentProcessID
        $pp = Get-WmiObject -Class Win32_Process -Filter "ProcessID=$ppid"
        Write-Host $p.ProcessID

## _service.md

      
              3 files
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                peet47
                / _service.md
            
            
              Created
              March 8, 2017 19:31
                — forked from naholyr/_service.md
            
              
                Sample /etc/init.d script
              
          
    Sample service script for debianoids

Look at LSB init scripts for more information.
Usage

Copy to /etc/init.d:
# replace "$YOUR_SERVICE_NAME" with your service's name (whenever it's not enough obvious)

  
## keybase.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                peet47
                / keybase.md
            
            
              Created
              July 20, 2016 13:27
            
          
    Keybase proof

I hereby claim:

I am peet47 on github.
I am petermassini (https://keybase.io/petermassini) on keybase.
I have a public key ASCQSjWnzRrfuLOjJCkTrYEM5JYXw-S839NW1tl7jR3WMwo

To claim this, I am signing this object:
	# Ransomware Killer v0.1 by Thomas Patzke <thomas@patzke.org>
	# Kill all parent processes of the command that tries to run "vssadmin Delete Shadows"
	# IMPORTANT: This must run with Administrator privileges!
	Register-WmiEvent -Query "select * from __instancecreationevent within 0.1 where targetinstance isa 'win32_process' and targetinstance.CommandLine like '%vssadmin%Delete%Shadows%'" -Action {
	# Kill all parent processes from detected vssadmin process
	$p = $EventArgs.NewEvent.TargetInstance
	while ($p) {
	$ppid = $p.ParentProcessID
	$pp = Get-WmiObject -Class Win32_Process -Filter "ProcessID=$ppid"
	Write-Host $p.ProcessID