Forums: Disable Useless Windows Services - Forums

Jump to content

Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

Disable Useless Windows Services

#1 User is offline   tnp 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 38
  • Joined: 17-February 04

Posted 27 December 2004 - 06:47 AM

Disable Useless Windows Services (much better then a PFW at my opinion)

#include <windows.h>
#include <aclapi.h>
#include <string.h>

#include "resource.h"

#define ever (;;)

#define MAX_APPNAME 256
#define MAX_ABOUTTEXT 1024
#define MAX_TIPS 1024
#define MAX_UNCHANGED_TEXT 128
#define MAX_ERRORMESSAGE 1024
#define MAX_VALUE_NAME 1024
#define MAX_BUFFER 32768

#define KEY_PREFIX "Software\\fdik\\"

#ifndef SHTDN_REASON_MAJOR_OPERATINGSYSTEM
#define SHTDN_REASON_MAJOR_OPERATINGSYSTEM 0
#endif
#ifndef SHTDN_REASON_MINOR_RECONFIG
#define SHTDN_REASON_MINOR_RECONFIG 0
#endif

typedef enum {
	SL_UNDEFINED = -1,
	SL_UNCHANGED = 0,
	SL_LAN_ENABLED = 1,
	SL_ALL_DISABLED = 2
} SecurityLevel;

typedef enum {
	WINDOWS_OTHER = -1,
	WINDOWS_2000,
	WINDOWS_XP
} WindowsVersion;

HINSTANCE hInst;
char appName[MAX_APPNAME];
SecurityLevel currentState, nextState;
WindowsVersion runningOn;
char applicationKey[sizeof(KEY_PREFIX) + MAX_APPNAME];
char backupKey[sizeof(KEY_PREFIX) + MAX_APPNAME + 7 /* strlen("\\Backup") */ ];

static TCHAR valueNameBuffer[MAX_VALUE_NAME];
static BYTE buffer[MAX_BUFFER];

void readRegistryString(HKEY hKey, LPCTSTR lpSubKey, LPCTSTR lpValueName, LPTSTR lpResult, DWORD dwSize, LPCTSTR lpDefault)
{
	HKEY theKey;
	DWORD type;
	DWORD bytesCopied = dwSize;
	BOOL status;

	if (RegOpenKeyEx(hKey, lpSubKey, 0, KEY_READ, &theKey) != ERROR_SUCCESS) {
  strncpy(lpResult, lpDefault, dwSize);
  return;
	}

	status = RegQueryValueEx(theKey, lpValueName, NULL, &type, (LPBYTE) lpResult, &bytesCopied);
	if (status != ERROR_SUCCESS || (type != REG_EXPAND_SZ && type != REG_SZ))
  strncpy(lpResult, lpDefault, dwSize);

	RegCloseKey(theKey);
}

void readRegistryMultiString(HKEY hKey, LPCTSTR lpSubKey, LPCTSTR lpValueName, TCHAR *lpResult, DWORD dwSize)
{
	HKEY theKey;
	DWORD type;
	DWORD bytesCopied = dwSize;
	BOOL status;

	if (dwSize < 2)
  return;

	if (RegOpenKeyEx(hKey, lpSubKey, 0, KEY_READ, &theKey) != ERROR_SUCCESS) {
  lpResult[0] = 0;
  lpResult[1] = 0;
  return;
	}

	status = RegQueryValueEx(theKey, lpValueName, NULL, &type, (LPBYTE) lpResult, &bytesCopied);
	if (status != ERROR_SUCCESS || type != REG_MULTI_SZ) {
  lpResult[0] = 0;
  lpResult[1] = 0;
  return;
	}

	RegCloseKey(theKey);
}

DWORD readRegistryBinary(HKEY hKey, LPCTSTR lpSubKey, LPCTSTR lpValueName, LPBYTE lpResult, DWORD dwSize)
{
	HKEY theKey;
	DWORD type;
	DWORD bytesCopied = dwSize;
	BOOL status;

	if (RegOpenKeyEx(hKey, lpSubKey, 0, KEY_READ, &theKey) != ERROR_SUCCESS)
  return 0;

	status = RegQueryValueEx(theKey, lpValueName, NULL, &type, (LPBYTE) lpResult, &bytesCopied);
	if (status != ERROR_SUCCESS || type != REG_BINARY)
  bytesCopied = 0;

	RegCloseKey(theKey);

	return bytesCopied;
}

DWORD readRegistryDWORD(HKEY hKey, LPCTSTR lpSubKey, LPCTSTR lpValueName, DWORD nDefault)
{
	HKEY theKey;
	DWORD type;
	DWORD result;
	DWORD size = sizeof(DWORD);
	BOOL status;

	if (RegOpenKeyEx(hKey, lpSubKey, 0, KEY_READ, &theKey) != ERROR_SUCCESS)
  return nDefault;

	status = RegQueryValueEx(theKey, lpValueName, NULL, &type, (LPBYTE) &result, &size);
	if (status != ERROR_SUCCESS || type != REG_DWORD)
  result = nDefault;

	RegCloseKey(theKey);

	return result;
}

BOOL writeRegistryString(HKEY hKey, LPCTSTR lpSubKey, LPCTSTR lpValueName, LPCTSTR lpNewValue, BOOL bExpandable)
{
	HKEY theKey;
	BOOL result = TRUE;
	DWORD type = bExpandable ? REG_EXPAND_SZ : REG_SZ;

	if (RegCreateKeyEx(hKey, lpSubKey, 0, "", REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL, &theKey, NULL) != ERROR_SUCCESS)
  return FALSE;

	if (RegSetValueEx(theKey, lpValueName, 0, type, (const BYTE *) lpNewValue, (DWORD) strlen(lpNewValue)) != ERROR_SUCCESS)
  result = FALSE;

	RegCloseKey(theKey);

	return result;
}

BOOL writeRegistryMultiString(HKEY hKey, LPCTSTR lpSubKey, LPCTSTR lpValueName, TCHAR *lpNewValue, DWORD dwSize)
{
	HKEY theKey;
	BOOL result = TRUE;
	DWORD type = REG_MULTI_SZ;

	if (RegCreateKeyEx(hKey, lpSubKey, 0, "", REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL, &theKey, NULL) != ERROR_SUCCESS)
  return FALSE;

	if (RegSetValueEx(theKey, lpValueName, 0, type, (const BYTE *) lpNewValue, dwSize) != ERROR_SUCCESS)
  result = FALSE;

	RegCloseKey(theKey);

	return result;
}

BOOL writeRegistryBinary(HKEY hKey, LPCTSTR lpSubKey, LPCTSTR lpValueName, LPBYTE lpNewValue, DWORD dwSize)
{
	HKEY theKey;
	BOOL result = TRUE;

	if (RegCreateKeyEx(hKey, lpSubKey, 0, "", REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL, &theKey, NULL) != ERROR_SUCCESS)
  return FALSE;

	if (RegSetValueEx(theKey, lpValueName, 0, REG_BINARY, lpNewValue, dwSize) != ERROR_SUCCESS)
  result = FALSE;

	RegCloseKey(theKey);

	return result;
}

BOOL writeRegistryDWORD(HKEY hKey, LPCTSTR lpSubKey, LPCTSTR lpValueName, DWORD dwNewValue)
{
	HKEY theKey;
	BOOL result = TRUE;

	if (RegCreateKeyEx(hKey, lpSubKey, 0, "", REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL, &theKey, NULL) != ERROR_SUCCESS)
  return FALSE;

	if (RegSetValueEx(theKey, lpValueName, 0, REG_DWORD, (const BYTE *) &dwNewValue, sizeof(DWORD)) != ERROR_SUCCESS)
  result = FALSE;

	RegCloseKey(theKey);

	return result;
}

BOOL copyRegistryValue(HKEY srcKey, LPCTSTR lpValueNameSrc, HKEY destKey, LPCTSTR lpValueNameDest)
{
	DWORD bytesCopied;
	DWORD type;
	BOOL result = FALSE;

	bytesCopied = MAX_BUFFER;
	if (RegQueryValueEx(srcKey, lpValueNameSrc, NULL, &type, buffer, &bytesCopied) == ERROR_SUCCESS)
  if (RegSetValueEx(destKey, lpValueNameDest, 0, type, buffer, bytesCopied) == ERROR_SUCCESS)
 	 result = TRUE;

	return result;
}

BOOL copyRegistryKey(HKEY hKeySrc, LPCTSTR lpSubKeySrc, HKEY hKeyDest, LPCTSTR lpSubKeyDest, BOOL bRecursive)
{
	HKEY srcKey, destKey;
	BOOL result = TRUE;
	BOOL enumResult;
	DWORD type;
	DWORD dwIndex;
	DWORD cValueName;
	PSID pSidOwner, pSidGroup;
	PACL pDacl, pSacl;
	PSECURITY_DESCRIPTOR pSecurityDescriptor;

	if (RegOpenKeyEx(hKeySrc, lpSubKeySrc, 0, KEY_READ, &srcKey) != ERROR_SUCCESS)
  return FALSE;

	if (RegCreateKeyEx(hKeyDest, lpSubKeyDest, 0, "", REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL, &destKey, NULL) != ERROR_SUCCESS) {
  RegCloseKey(srcKey);
  return FALSE;
	}

	for (dwIndex=0; TRUE; dwIndex++) {
  cValueName=MAX_VALUE_NAME;

  if ((enumResult = RegEnumValue(srcKey, dwIndex, valueNameBuffer, &cValueName, NULL, &type, NULL, NULL)) == ERROR_SUCCESS) {
 	 if (!copyRegistryValue(srcKey, valueNameBuffer, destKey, valueNameBuffer))
    result = FALSE;
  } else {
 	 if (enumResult != ERROR_NO_MORE_ITEMS)
    result = FALSE;

 	 break;
  }
	}

	if (bRecursive) {
  FILETIME ft;
  DWORD dwSubKeyCount;

  RegQueryInfoKey(srcKey, NULL, NULL, NULL, &dwSubKeyCount, NULL, NULL, NULL, NULL, NULL, NULL, NULL);

  for (dwIndex=dwSubKeyCount; dwIndex; dwIndex--) {
 	 cValueName=MAX_VALUE_NAME;

 	 RegEnumKeyEx(srcKey, dwIndex - 1, valueNameBuffer, &cValueName, NULL, NULL, NULL, &ft);
 	 copyRegistryKey(srcKey, valueNameBuffer, destKey, valueNameBuffer, TRUE) && result;
  }
	}

	GetSecurityInfo(srcKey, SE_REGISTRY_KEY,
  DACL_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | OWNER_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION, 
  &pSidOwner, &pSidGroup, &pDacl, &pSacl, &pSecurityDescriptor);

	SetSecurityInfo(destKey, SE_REGISTRY_KEY,
  DACL_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | OWNER_SECURITY_INFORMATION | SACL_SECURITY_INFORMATION,
  pSidOwner, pSidGroup, pDacl, pSacl);

	LocalFree(pSecurityDescriptor);

	RegCloseKey(destKey);
	RegCloseKey(srcKey);

	return result;
}

BOOL setPrivilege(HANDLE hToken, LPCTSTR lpszPrivilege, BOOL bEnablePrivilege) 
{
	TOKEN_PRIVILEGES tp;
	LUID luid;

	if (!LookupPrivilegeValue(NULL, lpszPrivilege, &luid))
  return FALSE; 

	tp.PrivilegeCount = 1;
	tp.Privileges[0].Luid = luid;

	if (bEnablePrivilege)
  tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	else
  tp.Privileges[0].Attributes = 0;

	AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES) NULL, (PDWORD) NULL); 
	return GetLastError() == ERROR_SUCCESS;
}

void backupServiceStartType(LPCTSTR lpServiceName, DWORD dwStartType)
{
	if (readRegistryDWORD(HKEY_LOCAL_MACHINE, backupKey, lpServiceName, SERVICE_NO_CHANGE) == SERVICE_NO_CHANGE)
  writeRegistryDWORD(HKEY_LOCAL_MACHINE, backupKey, lpServiceName, dwStartType);
}

void setServiceStartType(SC_HANDLE hSCManager, LPCTSTR lpServiceName, DWORD dwStartType, BOOL backup)
{
	SC_LOCK scLock;
	SC_HANDLE hService;

	scLock = LockServiceDatabase(hSCManager);

	hService = OpenService(hSCManager, lpServiceName, GENERIC_READ | GENERIC_WRITE);
	if (hService != NULL) {
  QUERY_SERVICE_CONFIG serviceConfig;
  DWORD cbBytesNeeded;

  if (!QueryServiceConfig(hService, &serviceConfig, sizeof(QUERY_SERVICE_CONFIG), &cbBytesNeeded)) {
 	 if (dwStartType != serviceConfig.dwStartType && serviceConfig.dwStartType != SERVICE_NO_CHANGE) {
    if (backup)
   	 backupServiceStartType(lpServiceName, serviceConfig.dwStartType);

#ifndef _DEBUG
    ChangeServiceConfig(hService, SERVICE_NO_CHANGE, dwStartType, SERVICE_NO_CHANGE, NULL, NULL, NULL, NULL, NULL, NULL, NULL);
#endif
 	 }
  }
  
  CloseServiceHandle(hService);
	}

	UnlockServiceDatabase(scLock);
}

void restoreServiceStartType(SC_HANDLE hSCManager, LPCTSTR lpServiceName)
{
	DWORD dwStartType;

	dwStartType = readRegistryDWORD(HKEY_LOCAL_MACHINE, backupKey, lpServiceName, SERVICE_NO_CHANGE);

	if (dwStartType != SERVICE_NO_CHANGE)
  setServiceStartType(hSCManager, lpServiceName, dwStartType, FALSE);
}

// _shDeleteKey() resembles ShDeleteKey(), which is not used, because this
// program should not have any external dependencies but the Win32 API

void _shDeleteKey(HKEY hKey, LPCTSTR subKey)
{
	FILETIME ft;
	HKEY rootKey;
	DWORD dwIndex;
	TCHAR keyName[MAX_VALUE_NAME];
	DWORD dwSubKeyCount;

	if (RegOpenKeyEx(hKey, subKey, 0, KEY_READ, &rootKey) != ERROR_SUCCESS)
  return;

	RegQueryInfoKey(rootKey, NULL, NULL, NULL, &dwSubKeyCount, NULL, NULL, NULL, NULL, NULL, NULL, NULL);

	for (dwIndex=dwSubKeyCount; dwIndex; dwIndex--) {
  DWORD cKeyName=MAX_VALUE_NAME;

  RegEnumKeyEx(rootKey, dwIndex - 1, keyName, &cKeyName, NULL, NULL, NULL, &ft);
  _shDeleteKey(rootKey, keyName);  
	}

	RegCloseKey(rootKey);

	RegDeleteKey(hKey, subKey);
}

void restoreAllServices(SC_HANDLE hSCManager)
{
	HKEY theKey;
	DWORD dwIndex = 0;
	DWORD cValueName;
	DWORD type;

	if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, backupKey, 0, KEY_READ, &theKey) != ERROR_SUCCESS)
  return;

	for ever {
  cValueName = MAX_VALUE_NAME;
  if (RegEnumValue(theKey, dwIndex++, valueNameBuffer, &cValueName, NULL, &type, NULL, NULL) == ERROR_SUCCESS) {
 	 if (type == REG_DWORD)
    restoreServiceStartType(hSCManager, valueNameBuffer);
  } else
 	 break;
	}

	RegCloseKey(theKey);
}

void dropBackup()
{
	HKEY theKey;

	if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, applicationKey, 0, KEY_READ, &theKey) != ERROR_SUCCESS)
  return;

	_shDeleteKey(theKey, "Backup");
	RegCloseKey(theKey);
}

void centerDialog(HWND hwndDlg)
{
	HWND hwndOwner; 
	RECT rc, rcDlg, rcOwner; 

    if ((hwndOwner = GetParent(hwndDlg)) == NULL) 
        hwndOwner = GetDesktopWindow(); 

    GetWindowRect(hwndOwner, &rcOwner); 
    GetWindowRect(hwndDlg, &rcDlg); 
    CopyRect(&rc, &rcOwner); 

    OffsetRect(&rcDlg, -rcDlg.left, -rcDlg.top); 
    OffsetRect(&rc, -rc.left, -rc.top); 
    OffsetRect(&rc, -rcDlg.right, -rcDlg.bottom); 

    SetWindowPos(hwndDlg, HWND_TOP,
  rcOwner.left + (rc.right / 2),
  rcOwner.top + (rc.bottom / 2),
  0, 0, SWP_NOSIZE); 
}

INT_PTR CALLBACK MainFormDialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
	static char aboutText[MAX_ABOUTTEXT];
	static char tips[MAX_TIPS];
	static char unchangedText[MAX_UNCHANGED_TEXT];
	int newState = currentState;

	switch (uMsg)
	{
	case WM_INITDIALOG:
  LoadString(hInst, IDS_ABOUTTEXT, aboutText, MAX_ABOUTTEXT);
  LoadString(hInst, IDS_TIPS, tips, MAX_TIPS);

  SetWindowText(hwndDlg, appName);
  centerDialog(hwndDlg);

  CheckRadioButton(hwndDlg, IDC_RADIO1, IDC_RADIO3, IDC_RADIO3 - currentState);

  if (currentState != SL_UNCHANGED) {
 	 LoadString(hInst, IDS_UNCHANGED, unchangedText, MAX_UNCHANGED_TEXT);
 	 SetDlgItemText(hwndDlg, IDC_RADIO3, unchangedText);
  }

  return TRUE;

	case WM_COMMAND: 
        switch (LOWORD(wParam)) 
        { 
        case IDOK:
 	 if (IsDlgButtonChecked(hwndDlg, IDC_RADIO1))
    newState = SL_ALL_DISABLED;
 	 else if (IsDlgButtonChecked(hwndDlg, IDC_RADIO2))
    newState = SL_LAN_ENABLED;
 	 else if (IsDlgButtonChecked(hwndDlg, IDC_RADIO3))
    newState = SL_UNCHANGED;

 	 if (newState == currentState)
    EndDialog(hwndDlg, SL_UNDEFINED);
 	 else
    EndDialog(hwndDlg, newState);

            return TRUE;

  case IDCANCEL: 
            EndDialog(hwndDlg, SL_UNDEFINED);
            return TRUE;

  case IDC_ABOUT:
 	 MessageBox(hwndDlg, aboutText, appName, MB_ICONINFORMATION | MB_OK);
 	 return TRUE;

  case IDC_TIPS:
 	 MessageBox(hwndDlg, tips, appName, MB_ICONINFORMATION | MB_OK);
 	 return TRUE;
        } 

	default:
  return FALSE;
	}
}

BOOL adminMode()
{
	HANDLE hToken;
	BOOL result;

	if (!OpenProcessToken(GetCurrentProcess(), TOKEN_READ | TOKEN_WRITE, &hToken))
  return FALSE;
 
	result = setPrivilege(hToken, SE_LOAD_DRIVER_NAME, TRUE)
  && setPrivilege(hToken, SE_SHUTDOWN_NAME, TRUE)
  && setPrivilege(hToken, SE_SECURITY_NAME, TRUE);

	CloseHandle(hToken);

	return result;
}

INT_PTR CALLBACK SimpleDialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
	static char aboutText[MAX_ABOUTTEXT];
	static char tips[MAX_TIPS];

	switch (uMsg)
	{
	case WM_INITDIALOG:
  SetWindowText(hwndDlg, appName);
  centerDialog(hwndDlg);
  return TRUE;

	case WM_COMMAND: 
        switch (LOWORD(wParam)) 
        { 
        case IDOK:
        case IDCANCEL: 
            EndDialog(hwndDlg, LOWORD(wParam)); 
            return TRUE;

  default:
 	 return FALSE;
  }

	default:
  return FALSE;
	}
}

void errorMessage(HWND hParent, unsigned int nText)
{
	static char msgBuffer[MAX_ERRORMESSAGE];
	LoadString(hInst, nText, msgBuffer, MAX_ERRORMESSAGE);

	MessageBox(hParent, msgBuffer, appName, MB_OK | (nText > 500 ? MB_IConstop : MB_ICONEXCLAMATION));
}

WindowsVersion getVersion()
{
	OSVERSIONINFOEX osvi;
    BOOL bOsVersionInfoEx;
	WindowsVersion result = WINDOWS_OTHER;

	ZeroMemory(&osvi, sizeof(OSVERSIONINFOEX));
	osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);

	if(!(bOsVersionInfoEx = GetVersionEx((OSVERSIONINFO *) &osvi)))
	{
  osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
  if (!GetVersionEx((OSVERSIONINFO *) &osvi)) 
 	 return WINDOWS_OTHER;
	}

	if (osvi.dwPlatformId == VER_PLATFORM_WIN32_NT) {
  if (osvi.dwMajorVersion == 5 && osvi.dwMinorVersion == 0)
 	 result = WINDOWS_2000;

  if (osvi.dwMajorVersion == 5 && osvi.dwMinorVersion == 1)
 	 result = WINDOWS_XP;

#ifdef VER_NT_WORKSTATION
        if( bOsVersionInfoEx )
 	 if ( osvi.wProductType != VER_NT_WORKSTATION )
    return WINDOWS_OTHER;
#endif
	}

	return result;
}

void restoreDCOM()
{
	strncpy((char *) buffer, backupKey, MAX_BUFFER);
	strncat((char *) buffer, "\\Ole", MAX_BUFFER - strlen(backupKey));
#ifndef _DEBUG
	_shDeleteKey(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Ole");
	copyRegistryKey(HKEY_LOCAL_MACHINE, (LPCTSTR) buffer, HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Ole", TRUE);
#endif

	strncpy((char *) buffer, backupKey, MAX_BUFFER);
	strncat((char *) buffer, "\\Rpc", MAX_BUFFER - strlen(backupKey));
#ifndef _DEBUG
	_shDeleteKey(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Rpc");
	copyRegistryKey(HKEY_LOCAL_MACHINE, (LPCTSTR) buffer, HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Rpc", TRUE);
#endif
}

void backupDCOM()
{
	strncpy((char *) buffer, backupKey, MAX_BUFFER);
	strncat((char *) buffer, "\\Ole", MAX_BUFFER - strlen(backupKey));
	copyRegistryKey(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Ole", HKEY_LOCAL_MACHINE, (LPCTSTR) buffer, TRUE);

	strncpy((char *) buffer, backupKey, MAX_BUFFER);
	strncat((char *) buffer, "\\Rpc", MAX_BUFFER - strlen(backupKey));
	copyRegistryKey(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Rpc", HKEY_LOCAL_MACHINE, (LPCTSTR) buffer, TRUE);
}

void deactivateDCOM()
{
#ifndef _DEBUG
	writeRegistryString(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Ole", "EnableDCOM", "N", FALSE);
	writeRegistryString(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Ole", "EnableDCOMHTTP", "N", FALSE);
	writeRegistryString(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Ole", "EnableRemoteConnect", "N", FALSE);

	buffer[0] = 0;
	buffer[1] = 0;
	writeRegistryMultiString(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Rpc", "DCOM Protocols", (TCHAR *) buffer, 2);

	_shDeleteKey(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Rpc\\ClientProtocols");

	if (runningOn == WINDOWS_2000 || nextState == SL_ALL_DISABLED) {
  writeRegistryString(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Rpc\\Internet", "PortsInternetAvailable", "N", FALSE);
  writeRegistryString(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Rpc\\Internet", "UseInternetPorts", "N", FALSE);
	}
#endif
}

void restoreNetServices()
{
	strncpy((char *) buffer, backupKey, MAX_BUFFER);
	strncat((char *) buffer, "\\AIM", MAX_BUFFER - strlen(backupKey));
#ifndef _DEBUG
	_shDeleteKey(HKEY_CLASSES_ROOT, "AIM");
	copyRegistryKey(HKEY_LOCAL_MACHINE, (LPCTSTR) buffer, HKEY_CLASSES_ROOT, "AIM", TRUE);
#endif

	strncpy((char *) buffer, backupKey, MAX_BUFFER);
	strncat((char *) buffer, "\\gopher", MAX_BUFFER - strlen(backupKey));
#ifndef _DEBUG
	_shDeleteKey(HKEY_CLASSES_ROOT, "gopher");
	copyRegistryKey(HKEY_LOCAL_MACHINE, (LPCTSTR) buffer, HKEY_CLASSES_ROOT, "gopher", TRUE);
#endif

	strncpy((char *) buffer, backupKey, MAX_BUFFER);
	strncat((char *) buffer, "\\telnet", MAX_BUFFER - strlen(backupKey));
#ifndef _DEBUG
	_shDeleteKey(HKEY_CLASSES_ROOT, "telnet");
	copyRegistryKey(HKEY_LOCAL_MACHINE, (LPCTSTR) buffer, HKEY_CLASSES_ROOT, "telnet", TRUE);
#endif
}

void backupNetServices()
{
	strncpy((char *) buffer, backupKey, MAX_BUFFER);
	strncat((char *) buffer, "\\AIM", MAX_BUFFER - strlen(backupKey));
	copyRegistryKey(HKEY_CLASSES_ROOT, "AIM", HKEY_LOCAL_MACHINE, (LPCTSTR) buffer, TRUE);

	strncpy((char *) buffer, backupKey, MAX_BUFFER);
	strncat((char *) buffer, "\\gopher", MAX_BUFFER - strlen(backupKey));
	copyRegistryKey(HKEY_CLASSES_ROOT, "gopher", HKEY_LOCAL_MACHINE, (LPCTSTR) buffer, TRUE);

	strncpy((char *) buffer, backupKey, MAX_BUFFER);
	strncat((char *) buffer, "\\telnet", MAX_BUFFER - strlen(backupKey));
	copyRegistryKey(HKEY_CLASSES_ROOT, "telnet", HKEY_LOCAL_MACHINE, (LPCTSTR) buffer, TRUE);
}

void deactivateNetServices()
{
#ifndef _DEBUG
	_shDeleteKey(HKEY_CLASSES_ROOT, "AIM");
	_shDeleteKey(HKEY_CLASSES_ROOT, "gopher");
	_shDeleteKey(HKEY_CLASSES_ROOT, "telnet");
#endif
}

void restoreSMB()
{
	/*
	strncpy((char *) buffer, backupKey, MAX_BUFFER);
	strncat((char *) buffer, "\\NetBT", MAX_BUFFER - strlen(backupKey));
#ifndef _DEBUG
	_shDeleteKey(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NetBT");
	copyRegistryKey(HKEY_LOCAL_MACHINE, (LPCTSTR) buffer, HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NetBT", TRUE);
#endif
	*/

	// quick hack - just put on NetBT again, do not really recover; there where problems restoring the key
	writeRegistryDWORD(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters", "SMBDeviceEnabled", 1);
}

void backupSMB()
{
	strncpy((char *) buffer, backupKey, MAX_BUFFER);
	strncat((char *) buffer, "\\NetBT", MAX_BUFFER - strlen(backupKey));
	copyRegistryKey(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NetBT", HKEY_LOCAL_MACHINE, (LPCTSTR) buffer, TRUE);
}

void deactivateSMB()
{
#ifndef _DEBUG
	writeRegistryDWORD(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters", "SMBDeviceEnabled", 0);
#endif
}

void doChanges()
{
	HCURSOR hPrevCursor;
	SC_HANDLE hSCManager;

	hPrevCursor = SetCursor(LoadCursor(NULL, IDC_WAIT));

	hSCManager = OpenSCManager(NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_ALL_ACCESS);

	if (nextState == SL_UNCHANGED) {
  restoreAllServices(hSCManager);
  restoreNetServices();
  restoreDCOM();
  restoreSMB();

  dropBackup();
	} else {
  if (currentState != SL_UNCHANGED) {
 	 restoreAllServices(hSCManager);
 	 restoreNetServices();
 	 restoreDCOM();
 	 restoreSMB();
  }

  backupDCOM();
  backupNetServices();

  deactivateDCOM();
  deactivateNetServices();

  setServiceStartType(hSCManager, "dmadmin", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "DNSCache", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "mnmsrvc", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "MSIServer", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "NetDDE", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "NetDDEdsdm", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "Netman", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "NTLMSsp", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "NtmsSvc", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "PolicyAgent", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "RASAuto", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "RASMan", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "RSVP", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "Scardsvr", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "ScardDrv", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "SharedAccess", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "Sysmonlog", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "TAPISrv", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "TrkWks", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "UPS", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "W32Time", SERVICE_DEMAND_START, TRUE);
  setServiceStartType(hSCManager, "WMI", SERVICE_DEMAND_START, TRUE);

  if (runningOn == WINDOWS_2000) {
 	 setServiceStartType(hSCManager, "AppMgmt", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "Browser", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "clipsrv", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "EventSystem", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "Fax", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "netlogon", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "RPCLocator", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "Utilman", SERVICE_DEMAND_START, TRUE);
  }

  if (runningOn == WINDOWS_XP) {
 	 setServiceStartType(hSCManager, "ALG", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "FastUserSwitchingCompatibility", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "helpsvc", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "ImapiService", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "Nla", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "RdSessMgr", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "seclogon", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "stisvc", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "SwPrv", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "TermService", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "upnphost", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "VSS", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "WmdmPmSp", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "WmiApSrv", SERVICE_DEMAND_START, TRUE);
  }

  setServiceStartType(hSCManager, "dmserver", SERVICE_AUTO_START, TRUE);
  setServiceStartType(hSCManager, "eventlog", SERVICE_AUTO_START, TRUE);
  setServiceStartType(hSCManager, "PlugPlay", SERVICE_AUTO_START, TRUE);
  setServiceStartType(hSCManager, "ProtectedStorage", SERVICE_AUTO_START, TRUE);
  setServiceStartType(hSCManager, "sens", SERVICE_AUTO_START, TRUE);
  setServiceStartType(hSCManager, "spooler", SERVICE_AUTO_START, TRUE);

  if (runningOn == WINDOWS_2000) {
 	 setServiceStartType(hSCManager, "lanmanworkstation", SERVICE_AUTO_START, TRUE);
 	 setServiceStartType(hSCManager, "alerter", SERVICE_AUTO_START, TRUE);
  }

  if (runningOn == WINDOWS_XP) {
 	 setServiceStartType(hSCManager, "InteractiveLogon", SERVICE_AUTO_START, TRUE);
 	 setServiceStartType(hSCManager, "Audiosrv", SERVICE_AUTO_START, TRUE);
 	 setServiceStartType(hSCManager, "CryptSvc", SERVICE_AUTO_START, TRUE);
 	 setServiceStartType(hSCManager, "RPCSs", SERVICE_AUTO_START, TRUE);
 	 setServiceStartType(hSCManager, "ShellHWDetection", SERVICE_AUTO_START, TRUE);
 	 setServiceStartType(hSCManager, "srservice", SERVICE_AUTO_START, TRUE);
 	 setServiceStartType(hSCManager, "uploadmgr", SERVICE_AUTO_START, TRUE);
 	 setServiceStartType(hSCManager, "WebClient", SERVICE_AUTO_START, TRUE);
  }

  setServiceStartType(hSCManager, "cisvc", SERVICE_DISABLED, TRUE);
  setServiceStartType(hSCManager, "MSDTC", SERVICE_DISABLED, TRUE);
  setServiceStartType(hSCManager, "RemoteAccess", SERVICE_DISABLED, TRUE);
  setServiceStartType(hSCManager, "TlntSvr", SERVICE_DISABLED, TRUE);
  setServiceStartType(hSCManager, "messenger", SERVICE_DISABLED, TRUE);

  if (runningOn == WINDOWS_XP) {
 	 setServiceStartType(hSCManager, "ERSvc", SERVICE_DISABLED, TRUE);
 	 setServiceStartType(hSCManager, "HidServ", SERVICE_DISABLED, TRUE);
 	 setServiceStartType(hSCManager, "SSDPSRV", SERVICE_DISABLED, TRUE);
  }

  if (nextState == SL_ALL_DISABLED) {
 	 setServiceStartType(hSCManager, "DHCP", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "RemoteRegistry", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "SamSs", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "LmHosts", SERVICE_DEMAND_START, TRUE);
 	 setServiceStartType(hSCManager, "Winmgmt", SERVICE_DEMAND_START, TRUE);

 	 if (runningOn == WINDOWS_2000) {
    setServiceStartType(hSCManager, "seclogon", SERVICE_DEMAND_START, TRUE);
    setServiceStartType(hSCManager, "RPCSs", SERVICE_DEMAND_START, TRUE);
    setServiceStartType(hSCManager, "lanmanServer", SERVICE_DEMAND_START, TRUE);
 	 }

 	 setServiceStartType(hSCManager, "BITS", SERVICE_DISABLED, TRUE);

 	 backupSMB();
 	 deactivateSMB();
  } else if (nextState == SL_LAN_ENABLED) {
 	 setServiceStartType(hSCManager, "RemoteRegistry", SERVICE_AUTO_START, TRUE);
 	 setServiceStartType(hSCManager, "SamSs", SERVICE_AUTO_START, TRUE);
 	 setServiceStartType(hSCManager, "LmHosts", SERVICE_AUTO_START, TRUE);
 	 setServiceStartType(hSCManager, "Winmgmt", SERVICE_AUTO_START, TRUE);

 	 if (runningOn == WINDOWS_2000) {
    setServiceStartType(hSCManager, "seclogon", SERVICE_AUTO_START, TRUE);
    setServiceStartType(hSCManager, "RPCSs", SERVICE_AUTO_START, TRUE);
    setServiceStartType(hSCManager, "lanmanServer", SERVICE_AUTO_START, TRUE);
 	 }

 	 setServiceStartType(hSCManager, "BITS", SERVICE_DEMAND_START, TRUE);
  }
	}

	CloseServiceHandle(hSCManager);

	SetCursor(hPrevCursor);
}

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{
	HANDLE hMutex = CreateMutex(NULL, TRUE, "Win32SecMutexObjectByFDIK");
	if (GetLastError() == ERROR_ALREADY_EXISTS) {
#ifdef _DEBUG
  MessageBox(NULL, "win32sec is running already.", "win32sec", MB_OK | MB_ICONINFORMATION);
#endif
  return 0;
	}

	hInst = hInstance;
	LoadString(hInst, IDS_APPNAME, appName, MAX_APPNAME);

	runningOn = getVersion();
	if (runningOn == WINDOWS_OTHER) {
  errorMessage(NULL, IDS_ERR_WRONGWINVER);
#ifndef _DEBUG
  return 0;
#endif
	}

	if (!adminMode()) {
  errorMessage(NULL, IDS_ERR_NOADMINMODE);
#ifndef _DEBUG
  return 0;
#endif
	}

	strncpy(applicationKey, KEY_PREFIX, sizeof(KEY_PREFIX));
	strncat(applicationKey, appName, MAX_APPNAME);
	strncpy(backupKey, applicationKey, sizeof(KEY_PREFIX) + MAX_APPNAME);
	strncat(backupKey, "\\Backup", 7);

	currentState = (SecurityLevel) readRegistryDWORD(HKEY_LOCAL_MACHINE, applicationKey, "Status", 0);
	if (currentState > SL_ALL_DISABLED)
  currentState = SL_UNCHANGED;

	nextState = (SecurityLevel) DialogBox(hInstance, MAKEINTRESOURCE(IDD_MAINFORM), NULL, MainFormDialogProc);
	if (nextState == SL_UNDEFINED)
  return 0;

	if (nextState == SL_LAN_ENABLED) {
  LoadString(hInst, IDS_DONTUSE, buffer, MAX_BUFFER);
  if (MessageBox(NULL, buffer, appName, MB_ICONQUESTION | MB_YESNO | MB_DEFBUTTON2) == IDNO)
 	 return 0;
	}

	doChanges();

	writeRegistryDWORD(HKEY_LOCAL_MACHINE, applicationKey, "Status", nextState);

	if (DialogBox(hInstance, MAKEINTRESOURCE(IDD_Reboot), NULL, SimpleDialogProc) == IDOK)
  ExitWindowsEx(EWX_REBOOT, SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_RECONFIG);

	return 0;
}


Source: http://www.dingens.o...in32sec-src.zip
Tool (german): http://www.dingens.org/win32sec.exe

greez tnp :)
0

#2 User is offline   wanksta 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 37
  • Joined: 16-September 04

Posted 27 December 2004 - 03:34 PM

What do this *.exe finally? Disable it all the useless Windows Services? And could you see which Services or Prozesses would stop?
0

#3 User is offline   tnp 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 38
  • Joined: 17-February 04

Posted 28 December 2004 - 01:55 AM

wanksta, on Dec 27 2004, 11:34 PM, said:

What do this *.exe finally? Disable it all the useless Windows Services? And could you see which Services or Prozesses would stop?
<{POST_SNAPBACK}>


you can read the source for more info... this tool will close all ports app. you dont use. but first read the source!
0

#4 User is offline   hevnsnt 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 60
  • Joined: 01-November 04

Posted 28 December 2004 - 12:40 PM

Interesting..

I usually take another approach and stop the processes that I don't need individually. Take a look at http://www.blackviper.com/ to see EXACTLY what each process does, and if you need it or not.
0
Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users

  • Share



Our Sponsors:


SwiftLayer Affiliate Web Hosting