PowerGhost¶

Write-Host "警告: 此脚本将执行以下操作：" -ForegroundColor Yellow
Write-Host " - 修改 WMI 订阅 (删除恶意绑定、消费者和过滤器)" -ForegroundColor Yellow
Write-Host " - 删除恶意计划任务及相关注册表项" -ForegroundColor Yellow
Write-Host " - 修改 hosts 文件以阻止恶意域名" -ForegroundColor Yellow
Write-Host " - 重启 WMI 服务" -ForegroundColor Yellow
Write-Host " - 重启计划任务服务" -ForegroundColor Yellow
Write-Host ""
Write-Host "这些操作可能会暂时影响系统运行，请确保在执行前已保存所有工作。" -ForegroundColor Yellow
Write-Host "建议在执行前备份系统关键组件。" -ForegroundColor Yellow
Write-Host ""

$confirmation = Read-Host "是否继续执行? (Y/N)"
if ($confirmation -ne 'Y' -and $confirmation -ne 'y') {
    Write-Host "操作已取消。" -ForegroundColor Cyan
    Exit
}

Write-Host "开始清理 PowerGhost 恶意组件..." -ForegroundColor Yellow

Write-Host "正在清理 WMI 持久化..." -ForegroundColor Cyan

$bindings = Get-WmiObject -Namespace 'root\Subscription' -Class '__FilterToConsumerBinding'
$consumers = Get-WmiObject -Namespace 'root\Subscription' -Class 'CommandLineEventConsumer'
$filters = Get-WmiObject -Namespace 'root\Subscription' -Class '__EventFilter'

$maliciousBindings = $bindings | Where-Object { $_.Filter -like '*Systems Manage Filter*' }
if ($maliciousBindings) {
    Write-Host "发现恶意绑定，正在删除..." -ForegroundColor Red
    $maliciousBindings | Remove-WmiObject
    Write-Host "已删除恶意绑定" -ForegroundColor Green
} else {
    Write-Host "未发现恶意绑定" -ForegroundColor Green
}

$maliciousConsumers = $consumers | Where-Object { $_.Name -eq 'Systems Manage Consumer' }
if ($maliciousConsumers) {
    Write-Host "发现恶意消费者，正在删除..." -ForegroundColor Red
    $maliciousConsumers | Remove-WmiObject
    Write-Host "已删除恶意消费者" -ForegroundColor Green
} else {
    Write-Host "未发现恶意消费者" -ForegroundColor Green
}

$maliciousFilters = $filters | Where-Object { $_.Name -eq 'Systems Manage Filter' }
if ($maliciousFilters) {
    Write-Host "发现恶意过滤器，正在删除..." -ForegroundColor Red
    $maliciousFilters | Remove-WmiObject
    Write-Host "已删除恶意过滤器" -ForegroundColor Green
} else {
    Write-Host "未发现恶意过滤器" -ForegroundColor Green
}

$psExecPath = ".\PsExec64.exe"
if (-not (Test-Path $psExecPath)) {
    Write-Host "未找到 PsExec64.exe，请确保它在当前目录中" -ForegroundColor Red
    Write-Host "你可以从 https://docs.microsoft.com/en-us/sysinternals/downloads/psexec 下载" -ForegroundColor Yellow
    Exit
}

Write-Host "正在使用 PsExec64 清理恶意计划任务..." -ForegroundColor Cyan

$tempScriptPath = "$env:TEMP\CleanRegistry.ps1"
@"
# 删除恶意计划任务注册表项
`$taskPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft Assist Job",
    "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SystemFlushDns"
)

foreach (`$path in `$taskPaths) {
    if (Test-Path `$path) {
        `$taskId = (Get-ItemProperty -Path `$path -Name "Id" -ErrorAction SilentlyContinue).Id

        Remove-Item -Path `$path -Force -Recurse
        Write-Output "已删除任务: `$path"

        if (`$taskId) {
            `$taskPlainPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\`$taskId"
            `$taskTasksPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\`$taskId"

            if (Test-Path `$taskPlainPath) {
                Remove-Item -Path `$taskPlainPath -Force -Recurse
            }

            if (Test-Path `$taskTasksPath) {
                Remove-Item -Path `$taskTasksPath -Force -Recurse
            }
        }
    } else {
        Write-Output "未发现计划任务: `$path"
    }
}
"@ | Out-File -FilePath $tempScriptPath -Encoding ASCII

Write-Host "正在以 SYSTEM 权限执行计划任务清理..." -ForegroundColor Yellow
& $psExecPath -s -i powershell.exe -ExecutionPolicy Bypass -File $tempScriptPath
Write-Host "PsExec64 计划任务清理完成" -ForegroundColor Green

Remove-Item -Path $tempScriptPath -Force

Write-Host "正在阻止恶意域名..." -ForegroundColor Cyan
$hostsPath = "$env:windir\System32\drivers\etc\hosts"
$hostContent = Get-Content -Path $hostsPath
if ($hostContent -notcontains "127.0.0.1 auth.to0ls.com") {
    Add-Content -Path $hostsPath -Value "`n127.0.0.1 auth.to0ls.com" -Force
    Write-Host "已在hosts文件中阻止恶意域名" -ForegroundColor Green
} else {
    Write-Host "恶意域名已在hosts文件中被阻止" -ForegroundColor Green
}

Write-Host "正在使用 PsExec64 重启服务以应用更改..." -ForegroundColor Cyan

$tempServiceScriptPath = "$env:TEMP\RestartServices.ps1"
@"
# 重启计划任务服务
Write-Output "重启计划任务服务..."
Restart-Service -Name Schedule -Force
Write-Output "计划任务服务已重启"

Write-Output "重启 WMI 服务..."
Restart-Service -Name Winmgmt -Force
Write-Output "WMI 服务已重启"
"@ | Out-File -FilePath $tempServiceScriptPath -Encoding ASCII

Write-Host "正在以 SYSTEM 权限重启服务..." -ForegroundColor Yellow
& $psExecPath -s -i powershell.exe -ExecutionPolicy Bypass -File $tempServiceScriptPath
Write-Host "PsExec64 服务重启完成" -ForegroundColor Green

Remove-Item -Path $tempServiceScriptPath -Force

Write-Host "清理完成。" -ForegroundColor Green