[port139ml:03080] Re: ウィルス対策（Re: Re: 5/18 内容と今後の予定）

[yoggy <yoggy@xxxxxxxxxxxxx>]

よぎ〜です．

>最近の Virus は PC 内部に入ってる対策ソフトを削除する機能を大抵が
>もってる気がしますが流行なんでしょうか。

    #!C:\perl\bin\perl.exe
    #
    #   stop_service.pl
    #
    #   see also
    #   http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/win32_service.asp
    #
    use Win32::OLE;

    $target_service = "Norton AntiVirus Auto Protect Service";

    die "usage: $0 host username password\n" if( @ARGV!=3 );
    ($host,$user,$pass) = @ARGV;
    $wbem = Win32::OLE->CreateObject( "WbemScripting.SWbemLocator" ) or die;
    $ns = $wbem->ConnectServer( $host, 'root\cimv2', $user, $pass ) or die;
    $win32_service = $ns->InstancesOf("Win32_Service") or die;

    foreach $s ( Win32::OLE::Enum->All( $win32_service ) ){
            if( $s->Name eq $target_service ){
                $s->StopService;
                $s->ChangeStartMode("Disabled");
                #$s->Delete;
            }
    }

...WMIって，いろんな意味で便利ですね．(^^;;