| @echo off&setlocal EnableDelayedexpansion |
| ::by cjiabing 2010-05-28 CMD@XP |
| ::from 甲兵时代: http://hi.baidu.com/cjiabing |
| :甲兵时代同名文件夹病毒专杀工具 |
| title 甲兵时代同名文件夹病毒专杀工具（升级版V20100610） |
| if not exist %SYSTEMDRIVE%\可疑文件隔离 md %SYSTEMDRIVE%\可疑文件隔离 |
| if not exist %SYSTEMDRIVE%\可疑文件隔离\%0 copy %0 %SYSTEMDRIVE%\可疑文件隔离>nul |
| for /f "skip=1 " %%a in ('wmic logicaldisk where "drivetype='2'" get deviceid') do (set tvd=%%a) |
| if not exist !tvd!\%0 copy %0 !tvd!>nul |
| MODE con: COLS=80 LINES=30 |
| COLOR 3E |
| cls |
| echo ╭═══════════════╮ |
| echo ║ 甲 兵 时 代 ║ |
| echo ╭══════════┤ 同名文件夹病毒专杀工具 ├══════════╮ |
| echo ║ ║ http://hi.baidu.com/cjiabing ║ ║ |
| echo ║ ╰═══════════════╯ ║ |
| echo ║ ║ |
| echo ║ ★ 使用说明： ║ |
| echo ║ ◇ 中毒特征：1、移动盘和硬盘中的文件夹被隐藏； ║ |
| echo ║ 2、病毒伪装成带EXE结尾的同名“文件夹”； ║ |
| echo ║ 3、病毒扩展名为.EXE，大小为1MB左右； ║ |
| echo ║ 4、出现数字和字母随机组合的6位数进程； ║ |
| echo ║ 5、它潜伏在电脑和移动盘上伺机自动传播； ║ |
| echo ║ 6、新闻报道80%%%的办公电脑和移动盘中过该毒； ║ |
| echo ║ ◇ 本工具几经升级，能有效发现和清除病毒，修复被隐藏的文件夹。 ║ |
| echo ║ ◇ 适用于个人电脑，但并不适用于所有电脑系统，办公电脑请慎用。 ║ |
| echo ║ ◇ 本工具功能有限，使用须自担风险，否则请退出。 ║ |
| echo ║ ◇ 免费共享，敬请关注更新（甲兵时代: http://hi.baidu.com/cjiabing）。 ║ |
| echo ║ ║ |
| echo ╰═════════════════════════════════════╯ |
| :start |
| echo. |
| echo ★ 功能选项： |
| echo 【1】杀毒模式：同时清除系统和优盘中的病毒（推荐）。 |
| echo 【2】修复模式：显示和隐藏文件，清除autoruns和desktop，禁用自动播放。 |
| echo 【3】清理模式：结束非系统进程和清理系统临时文件。 |
| echo 【4】一键模式：一键完全清理进程、启动项、U盘EXE文件（慎用）。 |
| echo 【0】退出。 |
| set /p inf= ◇ 请输入序号，并回车： |
| if "%inf%" == "1" goto yjsd |
| if "%inf%" == "2" goto auto |
| if "%inf%" == "3" call :yjjsps |
| if "%inf%" == "4" goto yjms |
| if "%inf%" == "0" goto exit |
| echo. |
| goto 甲兵时代同名文件夹病毒专杀工具 |
| :yjsd |
| cls |
| echo ╭═══════════════╮ |
| echo ║ 甲 兵 时 代 ║ |
| echo ╭══════════┤ 同名文件夹病毒专杀工具 ├══════════╮ |
| echo ║ ║ http://hi.baidu.com/cjiabing ║ ║ |
| echo ║ ╰═══════════════╯ ║ |
| echo ║ ║ |
| echo ║ ║ |
| echo ║ ◇◇◇杀 毒 模 式◇◇◇ ║ |
| echo ║ ║ |
| echo ║ ★ 使用说明【请认真阅读】： ║ |
| echo ║ ║ |
| echo ║ ◇ 1、以提示和备份的交互方式执行杀毒，你可以知晓程序执行了哪些操作； ║ |
| echo ║ 2、本模式并非绝对安全，只是尽可能地避免误杀； ║ |
| echo ║ ◇ 3、为确保安全，可疑文件被隔离至“%SYSTEMDRIVE%\可疑文件隔离” ║ |
| echo ║ 4、如出现故障可从“可疑文件隔离”中恢复被隔离的文件； ║ |
| echo ║ ◇ 5、进程名称含有数字的除360tray.exe和rundll32.exe外都将被隔离； ║ |
| echo ║ 6、请关闭其它程序后再执行杀毒，杀毒结束后请检查是否存在误杀； ║ |
| echo ║ ◇ 7、启动项将全部清理，自动备份至隔离目录中； ║ |
| echo ║ ◇ 8、移动盘中与文件夹名字相同的EXE程序将被清理； ║ |
| echo ║ 9、移动盘中的EXE程序大小小于2M的将被清理； ║ |
| echo ║ 10、请备份好移动盘后再执行杀毒，杀毒结束后请检查是否存在误杀； ║ |
| echo ║ ║ |
| echo ╰═════════════════════════════════════╯ |
| echo. |
| echo ◇ 确认开始杀毒请输入【 Y 】并回车 |
| echo ◇ 移动盘杀毒请输入【 U 】并回车 |
| set /p yqq= ◇ 返回请输入【 B 】并回车： |
| if /i "%yqq%"=="b" goto 甲兵时代同名文件夹病毒专杀工具 |
| if /i "%yqq%"=="y" goto killxt |
| if /i "%yqq%"=="u" goto killup |
| if /i "%yqq%"=="" goto 甲兵时代同名文件夹病毒专杀工具 |
| goto yjsd |
| :killxt |
| call :killxp |
| call :killup |
| call :killex |
| goto 甲兵时代同名文件夹病毒专杀工具 |
| :yjms |
| cls |
| echo ╭═══════════════╮ |
| echo ║ 甲 兵 时 代 ║ |
| echo ╭══════════┤ 同名文件夹病毒专杀工具 ├══════════╮ |
| echo ║ ║ http://hi.baidu.com/cjiabing ║ ║ |
| echo ║ ╰═══════════════╯ ║ |
| echo ║ ║ |
| echo ║ ║ |
| echo ║ ◇◇◇一 键 模 式◇◇◇ ║ |
| echo ║ ║ |
| echo ║ ★ 使用说明【请认真阅读】： ║ |
| echo ║ ║ |
| echo ║ ◇ 使用前请先阅读“杀毒模式”中的使用说明； ║ |
| echo ║ ◇ 本操作具有一定的风险，请慎用； ║ |
| echo ║ ◇ 一键模式包括以下内容： ║ |
| echo ║ ★一键清理U盘中的EXE、inf、vbe类型文件； ║ |
| echo ║ ★一键结束非系统进程； ║ |
| echo ║ ★一键清理系统临时文件； ║ |
| echo ║ ★一键清理自启动项； ║ |
| echo ║ ★一键清理任务计划： ║ |
| echo ║ ★一键清理常见同名文件夹病毒： ║ |
| echo ║ ★一键免疫（清除autoruns和desktop，禁用自动播放） ║ |
| echo ║ ◇ 请事先做好检查和备份再开始。 ║ |
| echo ║ ║ |
| echo ╰═════════════════════════════════════╯ |
| echo. |
| echo ◇ 确定使用一键模式杀毒并自担风险请输入【 OK 】并回车； |
| echo ◇ 返回请输入【 B 】并回车； |
| echo. |
| set /p ikk= 请选择： |
| if /i %ikk%==b (goto 甲兵时代同名文件夹病毒专杀工具) |
| if /i %ikk%==ok (goto killyy) else (goto 甲兵时代同名文件夹病毒专杀工具) |
| goto yjsd |
| :killyy |
| call :killxp1 |
| call :killtasks |
| call :yxjcxf |
| call :rwglq |
| call :killup121 |
| goto 甲兵时代同名文件夹病毒专杀工具 |
| :killxp |
| cls |
| echo. |
| echo. |
| echo. |
| echo ★ 以下部分是系统杀毒，请关闭其它程序后开始杀毒 |
| echo. |
| echo ◇ 杀毒之后，可疑文件将被隔离至“%SYSTEMDRIVE%\可疑文件隔离” |
| echo ◇ 如出现故障可从“可疑文件隔离”中恢复被隔离的文件 |
| echo ◇ 进程名称含有数字的除360tray.exe和rundll32.exe外都将被隔离 |
| echo. |
| echo. |
| echo. |
| pause |
| :killxp1 |
| if %inf%==4 call :killpr |
| if %inf%==4 call :yjjsps |
| if %inf%==1 call :killpr1 |
| call :killser |
| call :killgl |
| call :killwj |
| call :killxpbd |
| call :killyd |
| call :killqd |
| call :xsycdp |
| goto :eof |
| :killpr |
| echo. |
| echo ◇ 正在检查进程和结束可疑进程…… |
| for /f %%a in ('tasklist') do echo %%a |findstr "[0-9]" |findstr /i /v "360tray.exe rundll32.exe" >>_psyf.txt |
| for /f %%a in (_psyf.txt) do echo 发现可疑进程：%%a &taskkill /f /im %%a |
| echo. |
| echo ◇ 正在关闭桌面进程，稍后为你重新打开…… |
| taskkill /f /im XP* |
| tskill explorer |
| taskkill /f /im explorer.exe |
| taskkill /f /t /im IEXPLORE.EXE |
| taskkill /f /t /im expl0rer.exe |
| taskkill /f /t /im systen.exe |
| goto :eof |
| :killser |
| echo. |
| echo ◇ 正在停止可疑的服务项…… |
| sc stop DNSSystem |
| net stop DNSSystem |
| goto :eof |
| :killpr1 |
| echo. |
| echo ◇ 正在检查进程和结束可疑进程…… |
| echo. |
| echo 常见同名病毒由字母和数字随机组成6位或8位的进程，形如： |
| echo 60B650.EXE、96015E.EXE、XP-F84AA1B5.EXE |
| echo 某些常见系统、驱动和程序的进程数字具有一定的规则和意义，类似： |
| echo 360tray.exe、nvsvc32.exe、rundll32.exe、tsnpstd3.exe、Ati2evxx.exe |
| echo. |
| if exist _psyf1.txt del _psyf1.txt |
| for /f %%a in ('tasklist') do echo %%a |findstr "[0-9]" |findstr /i /v "360tray.exe rundll32.exe" >>_psyf1.txt |
| for /f %%a in (_psyf1.txt) do ( |
| echo.&echo 发现可疑进程：%%a &set /p ugh= 请检查是否病毒，结束并隔离【y】,忽略【n】：&if /i !ugh!==y (taskkill /f /im %%a&echo %%a >>_psyf.txt)&if /i !ugh!==n (echo 忽略 %%a) |
| ) |
| if exist _psyf1.txt del _psyf1.txt |
| echo. |
| echo ◇ 正在关闭桌面进程，稍后为你重新打开…… |
| taskkill /f /im XP* |
| tskill explorer |
| taskkill /f /im explorer.exe |
| taskkill /f /t /im IEXPLORE.EXE |
| taskkill /f /t /im expl0rer.exe |
| taskkill /f /t /im systen.exe |
| goto :eof |
| :killgl |
| echo. |
| echo ◇ 正在创建可疑文件隔离说明…… |
| if not exist %SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt ( |
| echo.>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo.>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo 可疑文件隔离说明>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo.>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo. >>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo 从系统根目录中搜索到的可疑文件被隔离到“%SYSTEMDRIVE%\可疑文件隔离”，它们很可能是病毒，也可能是其它程序文件，为防止误删特将它们备份。假如杀毒后系统出现故障，请重命名相关可疑文件（去掉“_重命名_日期”），根据以下记录的时间和路径拷贝该文件到文件原来所在的目录。>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo. |
| echo 本程序将进程名称含有数字的进程视为可疑进程，除“360tray^.exe”和“rundll32^.exe”外都将被隔离。一些打印机、驱动等进程含有数字的不可避免的被隔离，杀毒前请手动结束这些进程，或者杀毒后手动恢复。假如用于办公电脑，请注意检查和备份驱动程序，并且慎用一键模式。>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo 可信进程举例：360tray.exe、nvsvc32.exe、rundll32.exe、tsnpstd3.exe、Ati2evxx.exe>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo 病毒名称举例：XP-F84AA1B5.EXE；XP-D89C5E64.EXE；XP-23520AE1.EXE……；96015E.exe；5E6694.exe；1F4B56.EXE……>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo 病毒通常位于C:\WINDOWS\system32，病毒自建一个文件夹，名称由六位数字和字母随机组成，比如 C:\WINDOWS\system32\5E6694\1F4B56.EXE……>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo 自愿使用本工具须自担风险，任何使用本工具造成的损失本人一概不负责。>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo by cjiabing>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo.>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo.>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| ) |
| goto :eof |
| :killwj |
| if not exist "%SYSTEMDRIVE%\可疑文件隔离\!date:~0,10!" md %SYSTEMDRIVE%\可疑文件隔离\!date:~0,10! |
| echo. |
| echo ◇ 正在转移可疑文件，请注意弹出的说明…… |
| for /f %%a in (_psyf.txt) do (wmic process where name="%%a" get ExecutablePath |find /i ".exe")>>_fpath.txt |
| for /f %%a in (_fpath.txt) do ( |
| if exist %%a (attrib -h -r -s -a %%a)&echo !date! !time!: %%a>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| set name001=%%~nxa |
| set name002=%%~dpa |
| set name003=!name001!_重命名_!date! |
| if exist %%a ren "%%a" !name003! |
| set name004="!name002!!name003!" |
| move !name004! %SYSTEMDRIVE%\可疑文件隔离\!date:~0,10! |
| ) |
| for /f "delims=" %%a in (_psyf.txt) do ( |
| for /r %SYSTEMROOT%\system32 %%i in (%%a) do ( |
| if exist %%i (attrib -h -r -s -a %%i)&echo !date! !time!: %%i>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| set name001=%%~nxi |
| set name002=%%~dpi |
| set name003=!name001!_重命名_!date! |
| if exist %%i (ren "%%i" "!name003!") |
| set name004="!name002!!name003!" |
| if exist !name004! move !name004! %SYSTEMDRIVE%\可疑文件隔离\!date:~0,10! |
| ) |
| ) |
| goto :eof |
| :killxpbd |
| echo. |
| echo ◇ 正在清理病毒，请稍候…… |
| for /r %SYSTEMROOT%\system32 %%i in (XP-*.EXE,winvcreg.exe,og.dll,ul.dll,og.EDT,21c0.EDT,21c0.inf,69fe.inf,com.run,dp1.fne,eAPI.fne,HtmlView.fne,internet.fne,krnln.fnr,RegEx.fnr,shell.fne,spec.fne,msdll.dll,Wsctf.exe,expl0rer.exe) do ( |
| if exist %%i (attrib -h -r -s %%i) & (DEL /F /Q /A %%i) |
| )>nul |
| for /r %temp% %%i in (XP-*.EXE,winvcreg.exe,og.dll,ul.dll,og.EDT,21c0.EDT,21c0.inf,69fe.inf,com.run,dp1.fne,eAPI.fne,HtmlView.fne,internet.fne,krnln.fnr,RegEx.fnr,shell.fne,spec.fne,msdll.dll,Wsctf.exe,expl0rer.exe) do ( |
| if exist %%i (attrib -h -r -s %%i) & (DEL /F /Q /A %%i) |
| )>nul |
| for /r %temp% %%i in (SuCH0ST.exe,Systen.exe,Systen32.exe,exl0rer.exe,SVCH0S.exe) do ( |
| if exist %%i (attrib -h -r -s %%i) & (DEL /F /Q /A %%i) |
| )>nul |
| attrib -h -r -s %TEMP%\E_4 |
| rd %TEMP%\E_4\ |
| attrib -h -s -r -a "%systemroot%\system32\down.exe" &del /q /f "%systemroot%\system32\down.exe" |
| attrib -h -s -r -a "%systemroot%\system32\ativcox.dll" &del /q /f "%systemroot%\system32\ativcox.dll" |
| attrib -h -s -r -a "%systemroot%\system32\mail3.vbe" &del /q /f "%systemroot%\system32\mail3.vbe" |
| attrib -h -s -r -a "%systemroot%\system32\attusb.dll" &del /q /f "%systemroot%\system32\attusb.dll" |
| attrib -h -s -r -a "%systemroot%\system32\autousb.bat" &del /q /f "%systemroot%\system32\autousb.bat" |
| attrib -h -s -r -a "%systemroot%\system32\win.bat" &del /q /f "%systemroot%\system32\win.bat" |
| attrib -r -h -s -a "C:\RECYCLER\S-1-5-21-796845957-1482476501-682003330-500\Dc9.exe" |
| attrib -r -h -s -a "C:\RECYCLER\S-1-5-21-796845957-1482476501-682003330-500\Dc10.exe" |
| attrib -r -h -s -a "C:\RECYCLER\S-1-5-21-796845957-1482476501-682003330-500\Dc11.exe" |
| DEL /F /Q /A "C:\RECYCLER\S-1-5-21-796845957-1482476501-682003330-500\Dc9.exe" |
| DEL /F /Q /A "C:\RECYCLER\S-1-5-21-796845957-1482476501-682003330-500\Dc10.exe" |
| DEL /F /Q /A "C:\RECYCLER\S-1-5-21-796845957-1482476501-682003330-500\Dc11.exe" |
| attrib -r -h -s -a %systemroot%\system32\wbem\.vbs |
| del /a/f/q %systemroot%\system32\wbem\.vbs |
| attrib -r -h -s -a %systemroot%\system32\.vbs |
| del /a/f/q %systemroot%\system32\.vbs |
| attrib -r -h -s -a c:\windows\system32\wbem\irjit.dll |
| del /a/f/q c:\windows\system32\wbem\irjit.dll |
| goto :eof |
| :killyd |
| echo. |
| echo ◇ 正在全盘搜索同名文件，请稍候…… |
| For %%a In (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) Do ( |
| if exist %%a:\ ( |
| for /f "tokens=3,* delims= " %%i in ('"dir /a /l %%a:\"') do ( |
| if %%i==^<DIR^> ( |
| for /f "tokens=3 delims= " %%e in ('"if exist "%%a:\%%j.exe" dir /a/w "%%a:\%%j.exe""') do ( |
| if %%e lss 2000000 ( |
| if exist "%%a:\%%j.exe" attrib -h -a -s -r "%%a:\%%j.exe" |
| if exist "%%a:\%%j.exe" ren "%%a:\%%j.exe" "%%j.exe_重命名_!date!" |
| echo !date! !time!: "%%a:\%%j.exe">>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| if exist "%%a:\%%j.exe_重命名_!date!" move "%%a:\%%j.exe_重命名_!date!" %SYSTEMDRIVE%\可疑文件隔离\!date:~0,10! |
| if exist "%%a:\%%j" attrib -h -a -s -r "%%a:\%%j" |
| ) |
| ) |
| ) |
| ) |
| ) |
| ) |
| :killqpss |
| echo. |
| echo ◇ 正在全盘搜索可疑文件，请稍候…… |
| For %%a In (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) Do ( |
| if exist %%a:\autorun.inf del /a/f/q %%a:\autorun.inf |
| if exist %%a:\ ( |
| for /f "tokens=4* delims= " %%i in ('"dir /a /l %%a:\"') do ( |
| set ppqq=%%i |
| if "!ppqq:~-4,4!"==".vbe" (attrib -a -r -h -s "%%a:\!ppqq!" &move "%%a:\!ppqq!" %SYSTEMDRIVE%\可疑文件隔离\!date:~0,10!) |
| ) |
| ) |
| ) |
| goto :eof |
| :killqd |
| echo. |
| echo ◇ 正在清理启动项…… |
| set timecd=%time:~0,2%：%time:~3,2% |
| REG EXPORT HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 启动项备份.reg |
| move 启动项备份.reg %SYSTEMDRIVE%\可疑文件隔离\!date:~0,10!\ |
| ren "%SYSTEMDRIVE%\可疑文件隔离\!date:~0,10!\启动项备份.reg" "启动项备份%timecd%.reg" |
| attrib -r -h -s -a "%USERPROFILE%\「开始」菜单\程序\启动\ .lnk" |
| del "%USERPROFILE%\「开始」菜单\程序\启动\ .lnk" /q /f |
| for /f "delims=." %%a in (_psyf.txt) do (reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v %%a /f) |
| Del "%ALLUSERSPROFILE%\「开始」菜单\程序\启动\*.*" /q /f |
| Del "%USERPROFILE%\「开始」菜单\程序\启动\*.*" /q /f |
| Del "C:\Docume~1\Default User\「开始」菜单\程序\启动\*.*" /q /f |
| del _psyf.txt,_fpath.txt |
| echo. |
| echo ◇ 正在为你重新打开桌面，请注意阅读说明…… |
| start %SYSTEMROOT%\explorer.exe |
| start %SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| goto :eof |
| :killtasks |
| echo.>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo !date!任务计划tasks路径：%SYSTEMROOT%\tasks>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| dir /b %SYSTEMROOT%\tasks\*.job>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| echo.>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| move %SYSTEMROOT%\tasks\*.job %SYSTEMDRIVE%\可疑文件隔离\!date:~0,10! |
| goto :eof |
| :xsycdp |
| echo. |
| echo ◇ 正在恢复被隐藏的文件夹，请稍候…… |
| for /f "skip=1" %%i in ('wmic logicaldisk where "drivetype='3'" get caption') do ( |
| for /f "delims=" %%a in ('dir /b /a:d %%i') do if exist %%i\%%a (attrib -r -h -s -a /s /d "%%i\%%a") |
| if exist "%%i\System Volume Information" (attrib +h +s +a /s /d "%%i\System Volume Information") |
| if exist "%%i\RECYCLER" (attrib +h +s +a /s /d "%%i\RECYCLER") |
| if exist "%%i\RECYCLEd" (attrib +h +s +a /s /d "%%i\RECYCLEd") |
| ) |
| goto :eof |
| :killup |
| cls |
| echo. |
| echo. |
| for /f "skip=1 " %%a in ('wmic logicaldisk where "drivetype='2'" get deviceid') do (set tvd=%%a&echo 你的移动盘是：!tvd! |
| if not exist !tvd!\%0 copy %0 !tvd!>nul 2>nul |
| ) |
| echo. |
| echo. |
| echo ★ 以下清理移动盘中的EXE病毒，请插入移动盘继续！ |
| echo. |
| echo ◇ 移动盘中与文件夹名字相同的EXE程序将被清理。 |
| echo ◇ 移动盘中的EXE程序大小小于2M的将被清理。 |
| echo ◇ 请做好备份后继续。 |
| echo. |
| echo. |
| echo. |
| pause |
| :killup121 |
| echo. |
| echo ◇ 正在检测移动盘…… |
| for /f "skip=1 " %%a in ('wmic logicaldisk where "drivetype='2'" get deviceid') do (set tvd=%%a&call :ydpf) |
| if %inf%==4 call :killuexe |
| if %inf%==4 call :clearauto1 |
| call :killex |
| goto 甲兵时代同名文件夹病毒专杀工具 |
| :ydpf |
| call :killxs |
| call :killupbd |
| goto :eof |
| :killxs |
| echo. |
| echo 当前移动盘是：!tvd! |
| echo. |
| echo ◇ 正在恢复显示移动盘中的文件，请稍候……（移动盘文件过多可能会影响速度。） |
| echo. |
| for /f %%i in ("!tvd!") do attrib %%~di\*.* -s -r -h -a /d /s |
| goto :eof |
| :killupbd |
| echo. |
| echo ◇ 正在清理移动盘病毒…… |
| for /r %tvd% %%e in (.) do ( |
| set w2=%%~fe |
| for /r %tvd% %%i in (*.exe) do ( |
| set w1=%%~dpni |
| if !w1! == !w2! del /f/a/q %%i |
| ) |
| ) |
| for /r %tvd% %%i in (*.exe) do ( |
| if %%~zi lss 2000000 (if exist %%i del /f/q/a %%i) |
| ) |
| del /a/f/q %tvd%\Autorun.inf |
| del /a/f/q %tvd%\Autorun.inf.exe |
| del /a/f/q %tvd%\Autorun.exe |
| del /a/f/q %tvd%\RECYCLER.exe |
| del /a/f/q %tvd%\Recycled.exe |
| del /a/f/q %tvd%\Recycle.exe |
| del /a/f/q %tvd%\Notepad.exe |
| del /a/f/q %tvd%\.vbs |
| del /a/f/q %tvd%\Secret.exe |
| del /a/f/q "%tvd%\NGUYEN TU QUANG.EXE" |
| del /a/f/q %tvd%\Wsctf.exe |
| del /a/f/q %tvd%\expl0rer.exe |
| goto :eof |
| :killuexe |
| echo !date! !time!: >>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt |
| for /r %tvd% %%a in (*.exe) do echo %%a>>%SYSTEMDRIVE%\可疑文件隔离\可疑文件路径.txt&move "%%a" %SYSTEMDRIVE%\可疑文件隔离\!date:~0,10! |
| goto :eof |
| :killex |
| echo 甲.兵,时.代移动盘同名文件夹病毒专杀工具>!tvd!\autorun.inf |
| attrib +a +h +r +s !tvd!\autorun.inf |
| echo. |
| echo ★ 杀毒完毕！ |
| echo. |
| ping /n 5 127.0.1>nul |
| goto 甲兵时代同名文件夹病毒专杀工具 |
| :yjjsps |
| title !%0! |
| echo. |
| echo. |
| echo. |
| echo. |
| echo 一键结束非系统进程 cmd@xp |
| taskkill /f /im explorer.exe |
| for /f "skip=3" %%a in ('tasklist') do echo %%a |findstr /i /v "System smss.exe csrss.exe winlogon.exe services.exe lsass.exe svchost.exe conime.exe cmd.exe explorer.exe wmiprvse.exe Userinit.exe taskkill.exe spoolsv.exe ctfmon.exe alg.exe tasklist.exe qq.exe">>_npslist.txt |
| for /f %%a in (_npslist.txt) do taskkill /f /t /im %%a||NTSD -c q -P %%a |
| start %windir%\explorer.exe |
| del _npslist.txt |
| for /f "usebackq skip=3 tokens=2" %%p in (`tasklist /fi "windowtitle eq !%0!"`) do set prs2=%%p |
| for /f "usebackq skip=1 delims=" %%p in (`"wmic process where(name="cmd.exe") get ProcessId"`) do ( |
| echo %%p |findstr /v "!prs2!">>_prstkill.txt |
| ) |
| for /f %%a in (_prstkill.txt) do taskkill /f /t /pid %%a |
| del _prstkill.txt |
| title 甲兵时代同名文件夹病毒专杀工具（升级版V20100610） |
| :clean |
| echo. |
| echo ★ 清理系统垃圾 |
| del /f /s /q %systemdrive%\*.tmp |
| del /f /s /q %systemdrive%\*._mp |
| del /f /s /q %systemdrive%\*.gid |
| del /f /s /q %systemdrive%\*.chk |
| del /f /s /q %systemdrive%\*.old |
| del /f /s /q %systemdrive%\recycled\*.* |
| del /f /s /q %windir%\*.bak |
| del /f /s /q %windir%\*.log |
| del /f /s /q %windir%\*.tmp |
| del /f /s /q %windir%\prefetch\*.* |
| rd /s /q %windir%\temp & md %windir%\temp |
| rd /s /q %temp% & md %temp% |
| del /f /q %userprofile%\recent\*.* |
| del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*" |
| del /f /s /q "%userprofile%\Local Settings\Temp\*.*" |
| del /f /s /q "%userprofile%\recent\*.*" |
| echo. |
| echo 操作完毕！ |
| echo. |
| goto :eof |
| :yxjcxf |
| echo. |
| echo ◇ 修复映像劫持 |
| cd.>_jcxflist.txt |
| echo 360rpt.exe >>_jcxflist.txt |
| echo 360Safe.exe >>_jcxflist.txt |
| echo 360tray.exe >>_jcxflist.txt |
| echo adam.exe >>_jcxflist.txt |
| echo AgentSvr.exe >>_jcxflist.txt |
| echo AppSvc32.exe >>_jcxflist.txt |
| echo ArSwp.exe >>_jcxflist.txt |
| echo AST.exe >>_jcxflist.txt |
| echo autoruns.exe >>_jcxflist.txt |
| echo AvastU3.exe >>_jcxflist.txt |
| echo avconsol.exe >>_jcxflist.txt |
| echo avgrssvc.exe >>_jcxflist.txt |
| echo AvMonitor.exe >>_jcxflist.txt |
| echo avp.exe >>_jcxflist.txt |
| echo CCenter.exe >>_jcxflist.txt |
| echo ccSvcHst.exe >>_jcxflist.txt |
| echo cmd.exe >>_jcxflist.txt |
| echo EGHOST.exe >>_jcxflist.txt |
| echo FileDsty.exe >>_jcxflist.txt |
| echo FTCleanerShell.exe >>_jcxflist.txt |
| echo FYFireWall.exe >>_jcxflist.txt |
| echo ghost.exe >>_jcxflist.txt |
| echo HijackThis.exe >>_jcxflist.txt |
| echo IceSword.exe >>_jcxflist.txt |
| echo iexplore.exe >>_jcxflist.txt |
| echo iparmo.exe >>_jcxflist.txt |
| echo Iparmor.exe >>_jcxflist.txt |
| echo irsetup.exe >>_jcxflist.txt |
| echo isPwdSvc.exe >>_jcxflist.txt |
| echo kabaload.exe >>_jcxflist.txt |
| echo KaScrScn.SCR >>_jcxflist.txt |
| echo KASMain.exe >>_jcxflist.txt |
| echo KASTask.exe >>_jcxflist.txt |
| echo KAV32.EXE >>_jcxflist.txt |
| echo KAVDX.EXE >>_jcxflist.txt |
| echo KAVPF.exe >>_jcxflist.txt |
| echo KAVPFW.exe >>_jcxflist.txt |
| echo KAVSetup.exe >>_jcxflist.txt |
| echo KAVStart.exe >>_jcxflist.txt |
| echo KISLnchr.exe >>_jcxflist.txt |
| echo KMailMon.exe >>_jcxflist.txt |
| echo KMFilter.exe >>_jcxflist.txt |
| echo KPFW32.EXE >>_jcxflist.txt |
| echo KPFW32X.EXE >>_jcxflist.txt |
| echo KPFWSvc.EXE >>_jcxflist.txt |
| echo KRegEx.exe >>_jcxflist.txt |
| echo KRepair.com >>_jcxflist.txt |
| echo KsLoader.exe >>_jcxflist.txt |
| echo KVCenter.kxp >>_jcxflist.txt |
| echo KvDetect.exe >>_jcxflist.txt |
| echo KvfwMcl.exe >>_jcxflist.txt |
| echo KVMonXP.kxp >>_jcxflist.txt |
| echo KVMonXP_1.kxp >>_jcxflist.txt |
| echo kvol.exe >>_jcxflist.txt |
| echo kvolself.exe >>_jcxflist.txt |
| echo KvReport.kxp >>_jcxflist.txt |
| echo KVScan.kxp >>_jcxflist.txt |
| echo KVSrvXP.exe >>_jcxflist.txt |
| echo KVStub.kxp >>_jcxflist.txt |
| echo kvupload.exe >>_jcxflist.txt |
| echo kvwsc.exe >>_jcxflist.txt |
| echo KvXP.kxp >>_jcxflist.txt |
| echo KvXP_1.kxp >>_jcxflist.txt |
| echo KWatch.EXE >>_jcxflist.txt |
| echo KWatch9x.exe >>_jcxflist.txt |
| echo KWatchX.EXE >>_jcxflist.txt |
| echo loaddll.exe >>_jcxflist.txt |
| echo MagicSet.exe >>_jcxflist.txt |
| echo mcconsol.exe >>_jcxflist.txt |
| echo mmqczj.exe >>_jcxflist.txt |
| echo mmsk.exe >>_jcxflist.txt |
| echo msconfig.exe >>_jcxflist.txt |
| echo Navapsvc.exe >>_jcxflist.txt |
| echo Navapw32.exe >>_jcxflist.txt |
| echo NOD32.exe >>_jcxflist.txt |
| echo nod32krn.exe >>_jcxflist.txt |
| echo nod32kui.exe >>_jcxflist.txt |
| echo NPFMntor.exe >>_jcxflist.txt |
| echo PFW.exe >>_jcxflist.txt |
| echo PFWLiveUpdate.exe >>_jcxflist.txt |
| echo process exloprer.exe >>_jcxflist.txt |
| echo procexp.exe >>_jcxflist.txt |
| echo QHSET.exe >>_jcxflist.txt |
| echo QQ.exe >>_jcxflist.txt |
| echo QQDoctor.exe >>_jcxflist.txt |
| echo QQKav.exe >>_jcxflist.txt |
| echo QQSC.exe >>_jcxflist.txt |
| echo Ras.exe >>_jcxflist.txt |
| echo Rav.exe >>_jcxflist.txt |
| echo RavMon.exe >>_jcxflist.txt |
| echo RavMonD.exe >>_jcxflist.txt |
| echo RavStub.exe >>_jcxflist.txt |
| echo RavTask.exe >>_jcxflist.txt |
| echo RegClean.exe >>_jcxflist.txt |
| echo regedit.com >>_jcxflist.txt |
| echo regedit.exe >>_jcxflist.txt |
| echo rfwcfg.exe >>_jcxflist.txt |
| echo rfwmain.exe >>_jcxflist.txt |
| echo rfwProxy.exe >>_jcxflist.txt |
| echo rfwsrv.exe >>_jcxflist.txt |
| echo RsAgent.exe >>_jcxflist.txt |
| echo Rsaupd.exe >>_jcxflist.txt |
| echo rstrui.exe >>_jcxflist.txt |
| echo runiep.exe >>_jcxflist.txt |
| echo safelive.exe >>_jcxflist.txt |
| echo scan32.exe >>_jcxflist.txt |
| echo shcfg32.exe >>_jcxflist.txt |
| echo SmartUp.exe >>_jcxflist.txt |
| echo SREng.com >>_jcxflist.txt |
| echo SREng.EXE >>_jcxflist.txt |
| echo symlcsvc.exe >>_jcxflist.txt |
| echo SysSafe.exe >>_jcxflist.txt |
| echo TrojanDetector.exe >>_jcxflist.txt |
| echo Trojanwall.exe >>_jcxflist.txt |
| echo TrojDie.kxp >>_jcxflist.txt |
| echo UIHost.exe >>_jcxflist.txt |
| echo UmxAgent.exe >>_jcxflist.txt |
| echo UmxAttachment.exe >>_jcxflist.txt |
| echo UmxCfg.exe >>_jcxflist.txt |
| echo UmxFwHlp.exe >>_jcxflist.txt |
| echo UmxPol.exe >>_jcxflist.txt |
| echo upiea.exe >>_jcxflist.txt |
| echo UpLive.exe >>_jcxflist.txt |
| echo USBCleaner.exe >>_jcxflist.txt |
| echo vsstat.exe >>_jcxflist.txt |
| echo webscanx.exe >>_jcxflist.txt |
| echo WoptiClean.exe >>_jcxflist.txt |
| echo zjb.exe >>_jcxflist.txt |
| echo Windows Registry Editor Version 5.00>xfyxjc.reg |
| echo.>>xfyxjc.reg |
| echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DownloadManager]>>xfyxjc.reg |
| for /f "tokens=*" %%a in (_jcxflist.txt) do echo [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%%a]>>xfyxjc.reg |
| echo [-HKEY_USERS\S-1-5-21-1757745196-1676693376-65411059-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\35]>>xfyxjc.reg |
| start /w regedit.exe /s xfyxjc.reg |
| del xfyxjc.reg,_jcxflist.txt |
| goto :eof |
| :rwglq |
| echo. |
| echo ◇ 修复任务管理器 |
| echo REGEDIT4 >>_xfrwglq.reg |
| echo [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] >>_xfrwglq.reg |
| echo "DisableTaskmgr"=dword:00000000. >>_xfrwglq.reg |
| echo.>>_xfrwglq.reg |
| start /w regedit.exe /s _xfrwglq.reg |
| del _xfrwglq.reg |
| goto :eof |
| :exit |
| exit |
| :auto |
| |
| taskkill /F /IM SocksA.exe /IM SVOHOST.exe /IM AdobeR.exe /IM ravmone.exe /IM wincfgs.exe /IM doc.exe /IM rose.exe /IM sxs.exe /IM autorun.exe /IM KB20060111.exe /IM tel.xls.exe>nul 2>nul |
| :clearauto |
| cls |
| Echo. |
| Echo Autorun 病毒清除与免疫工具 |
| |
| Echo. |
| Echo [1] 一键免疫(推荐!) |
| Echo [2] 禁用系统的 Autorun 机制以避免 Autorun 病毒的再次感染 |
| Echo [3] 仅仅删除所有盘符下的 Autorun 病毒 |
| Echo [4] 删除并免疫指定盘符的 Autorun 病毒 |
| Echo [5] 取消免疫指定盘符 |
| Echo [6] 取消所有盘符的 Autorun 病毒免疫 |
| Echo [7] 恢复相关注册表项默认值 |
| Echo [8] 显示被隐藏的文件 |
| Echo [9] 不显示被隐藏的文件 |
| Echo [10] 恢复文件的显示隐藏设置功能 |
| Echo [11] 显示盘符下被隐藏的文件夹（如D盘） |
| Echo [12] 映像劫持修复 |
| echo [13] 任务管理器修复 |
| echo [14] 恢复显示指定路径的文件 |
| Echo [0] 返回 |
| Echo. |
| Set /p clearslt= 请输入您的选择(1/2/3/4/5/6/7/8/9/10/0): |
| If "%clearslt%"=="" Goto clearauto |
| If "%clearslt%"=="1" call :clearauto1 |
| If "%clearslt%"=="2" call :clearauto2 |
| If "%clearslt%"=="3" Goto clearauto3 |
| If "%clearslt%"=="6" Goto clearauto4 |
| If "%clearslt%"=="4" Goto clearauto5 |
| If "%clearslt%"=="5" Goto clearauto6 |
| If "%clearslt%"=="7" Goto clearauto7 |
| if "%clearslt%"=="8" goto xians |
| if "%clearslt%"=="9" goto yinc |
| if %clearslt%==10 goto hhsz |
| if %clearslt%==11 call :xsycdp |
| If %clearslt%==12 call :yxjcxf |
| If %clearslt%==13 call :rwglq |
| If %clearslt%==14 call :hfxslj |
| If "%clearslt%"=="0" cls&goto start |
| goto clearauto |
| :clearauto1 |
| cls |
| echo. |
| echo. |
| echo ★ 一键免疫，预防病毒自动传播。 |
| echo. |
| echo ★ 清除Autorun.inf和_desktop.ini病毒并免疫，禁用自动播放。 |
| echo. |
| echo ★ 假如弹出对话框提示“WINDOWS-没有软盘”，请点取消即可。 |
| echo. |
| echo. |
| taskkill /F /IM SocksA.exe /IM SVOHOST.exe /IM AdobeR.exe /IM ravmone.exe /IM wincfgs.exe /IM doc.exe /IM rose.exe /IM sxs.exe /IM autorun.exe /IM KB20060111.exe /IM tel.xls.exe>nul 2>nul |
| For %%a In (C D E F G H I J K L M N O P Q R S T U V W X Y Z) Do ( |
| fsutil fsinfo drivetype %%a: |find /i "固定驱动器" && ( |
| For /f "tokens=2 delims==" %%b In (%%a:\autorun.inf) Do Del /a /f /q "%%a:\%%b" & md "%%a:\%%b\免疫目录不要删除!...\" & attrib +s +h +r "%%a:\%%b" & Echo Y|cacls "%%a:\%%b" /T /C /P everyone:N >nul 2>nul |
| Del /a /f /q %%a:\autorun.inf & md "%%a:\autorun.inf\免疫目录不要删除!...\" & attrib +s +h +r %%a:\autorun.inf & Echo Y|cacls "%%a:\autorun.inf" /T /C /P everyone:N >nul 2>nul |
| ) >nul 2>nul |
| fsutil fsinfo drivetype %%a: |find /i "可移动驱动器" && ( |
| For /f "tokens=2 delims==" %%b In (%%a:\autorun.inf) Do Del /a /f /q "%%a:\%%b" & md "%%a:\%%b\免疫目录不要删除!...\" & attrib +s +h +r "%%a:\%%b" & Echo Y|cacls "%%a:\%%b" /T /C /P everyone:N >nul 2>nul |
| Del /a /f /q %%a:\autorun.inf & md "%%a:\autorun.inf\免疫目录不要删除!...\" & attrib +s +h +r %%a:\autorun.inf & Echo Y|cacls "%%a:\autorun.inf" /T /C /P everyone:N >nul 2>nul |
| ) >nul 2>nul |
| ) |
| :desk |
| echo ★ 全盘删除所有文件夹下的_desktop.ini |
| @echo off |
| setlocal enabledelayedexpansion |
| for /f "delims=\" %%i in ('fsutil fsinfo drives^|find /v ""') do ( |
| set var=%%i |
| set drive=!var:~-2! |
| fsutil fsinfo drivetype !drive!|find "固定">nul && del /a /f /s !drive!\_desktop.ini |
| ) |
| echo. |
| :clearauto2 |
| cls |
| echo. |
| Echo. |
| echo ★ 禁用自动播放，正在停止相关服务…… |
| echo. |
| echo. |
| reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000ff /f >nul 2>nul |
| reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000ff /f >nul 2>nul |
| net stop ShellHWDetection >nul 2>nul |
| sc config ShellHWDetection start= disabled >nul 2>nul |
| |
| Set REGPATH=HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths |
| Set SFLAG=/v SaferFlags /t REG_DWORD /d 0x00000000 /f |
| Set IDATA=/f /v ItemData /d "?:\Recyc? |
| reg add %REGPATH%\{00ffa5bf-abe7-4901-aacf-4f58aa31217a} %SFLAG%>nul |
| reg add %REGPATH%\{00ffa5bf-abe7-4901-aacf-4f58aa31217a} %IDATA%\*\*\*\*.*">nul |
| reg add %REGPATH%\{41fe7eed-c47a-46f6-840a-240796fd03cf} %SFLAG%>nul |
| reg add %REGPATH%\{41fe7eed-c47a-46f6-840a-240796fd03cf} %IDATA%\*\*\*.*">nul |
| reg add %REGPATH%\{4e93c91c-a40e-462e-9b89-3b0832d222d9} %SFLAG%>nul |
| reg add %REGPATH%\{4e93c91c-a40e-462e-9b89-3b0832d222d9} %IDATA%\*.*">nul |
| reg add %REGPATH%\{5bfc100b-d3fb-450e-88ec-6819ab56a9ff} %SFLAG%>nul |
| reg add %REGPATH%\{5bfc100b-d3fb-450e-88ec-6819ab56a9ff} %IDATA%\*\*\*\*.*">nul |
| reg add %REGPATH%\{5c5e2bcd-7057-43f4-830c-e4361d2afadd} %SFLAG%>nul |
| reg add %REGPATH%\{5c5e2bcd-7057-43f4-830c-e4361d2afadd} %IDATA%\*.*">nul |
| reg add %REGPATH%\{5f8ff865-0638-4c6e-98de-923e7bc6b330} %SFLAG%>nul |
| reg add %REGPATH%\{5f8ff865-0638-4c6e-98de-923e7bc6b330} %IDATA%\*\*\*.*">nul |
| reg add %REGPATH%\{649c1429-0e79-453c-abe9-b5682e035ae7} %SFLAG%>nul |
| reg add %REGPATH%\{649c1429-0e79-453c-abe9-b5682e035ae7} %IDATA%\*\*.*">nul |
| reg add %REGPATH%\{718f54b2-c669-4d7b-aeff-18d69f100034} %SFLAG%>nul |
| reg add %REGPATH%\{718f54b2-c669-4d7b-aeff-18d69f100034} %IDATA%\*\*.*">nul |
| reg add %REGPATH%\{8385d9d2-80c9-4ac1-a100-ed3e62863d97} %SFLAG%>nul |
| reg add %REGPATH%\{8385d9d2-80c9-4ac1-a100-ed3e62863d97} %IDATA%\*.*">nul |
| reg add %REGPATH%\{af2a4fcf-441c-421e-9663-52cd3502cfd7} %SFLAG%>nul |
| reg add %REGPATH%\{af2a4fcf-441c-421e-9663-52cd3502cfd7} %IDATA%\*\*\*.*">nul |
| reg add %REGPATH%\{b997f4b2-c037-4e97-b051-31f5d86df802} %SFLAG%>nul |
| reg add %REGPATH%\{b997f4b2-c037-4e97-b051-31f5d86df802} %IDATA%\*\*.*">nul |
| reg add %REGPATH%\{d4e7b6ff-d76f-407f-b8bb-ea0835f5babc} %SFLAG%>nul |
| reg add %REGPATH%\{d4e7b6ff-d76f-407f-b8bb-ea0835f5babc} /f /v ItemData /d "RECYC*.*">nul |
| |
| For %%a In (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) Do ( |
| For %%b In (exe pif com) Do ( |
| Echo Y|cacls "%%a:\Recycler\*.%%b" /C /T /P everyone:F>nul 2>nul&Echo Y|cacls "%%a:\Recycled\*.%%b" /C /T /P everyone:F>nul 2>nul&Echo Y|cacls "%%a:\Recycled\Recycled\*.%%b" /C /T /P everyone:F>nul 2>nul |
| Del /A /F /S /Q "%%a:\Recycler\*.%%b">nul 2>nul&Del /A /F /S /Q "%%a:\Recycled\*.%%b">nul 2>nul&Del /A /F /S /Q "%%a:\Recycled\Recycled\*.%%b">nul 2>nul |
| ) |
| )>nul 2>nul |
| cls |
| Echo. |
| echo. |
| echo ★ 相关服务已停止并禁用，任意键返回…… |
| echo. |
| echo. |
| goto :eof |
| :clearauto3 |
| taskkill /F /IM SocksA.exe /IM SVOHOST.exe /IM AdobeR.exe /IM ravmone.exe /IM wincfgs.exe /IM doc.exe /IM rose.exe /IM sxs.exe /IM autorun.exe /IM KB20060111.exe /IM tel.xls.exe>nul 2>nul |
| For %%a In (C D E F G H I J K L M N O P Q R S T U V W X Y Z) Do ( |
| fsutil fsinfo drivetype %%a: |find /i "固定驱动器" && ( |
| For /f "tokens=2 delims==" %%b In (%%a:\autorun.inf) Do Del /a /f /q "%%a:\%%b" >nul 2>nul |
| Del /a /f /q %%a:\autorun.inf >nul 2>nul |
| ) >nul 2>nul |
| fsutil fsinfo drivetype %%a: |find /i "可移动驱动器" && ( |
| For /f "tokens=2 delims==" %%b In (%%a:\autorun.inf) Do Del /a /f /q "%%a:\%%b" >nul 2>nul |
| Del /a /f /q %%a:\autorun.inf >nul 2>nul |
| ) >nul 2>nul |
| ) |
| cls |
| Echo Autorun 病毒清除完毕，任意键返回…… |
| pause>nul |
| Goto clearauto |
| :clearauto4 |
| For %%a In (C D E F G H I J K L M N O P Q R S T U V W X Y Z) Do ( |
| fsutil fsinfo drivetype %%a: |find /i "固定驱动器" && ( |
| cacls "%%a:\autorun.inf" /T /C /P everyone:F&Del /a /f /q "%%a:\autorun.inf" & rd /s /q "%%a:\autorun.inf">nul 2>nul |
| )>nul 2>nul |
| fsutil fsinfo drivetype %%a: |find /i "可移动驱动器" && ( |
| cacls "%%a:\autorun.inf" /T /C /P everyone:F&Del /a /f /q "%%a:\autorun.inf" & rd /s /q "%%a:\autorun.inf">nul 2>nul |
| )>nul 2>nul |
| ) |
| cls |
| Echo. |
| Echo 已经解除全部盘符的免疫，任意键返回…… |
| pause>nul |
| Goto clearauto |
| :clearauto5 |
| cls |
| Echo. |
| Set /p pf= 请输入盘符，如"F:"(不包括引号) |
| Echo 即将免疫%pf%盘……|find /i ":"||Set pf=%pf%:&&Echo 即将免疫%pf%盘…… |
| taskkill /F /IM SocksA.exe /IM SVOHOST.exe /IM AdobeR.exe /IM ravmone.exe /IM wincfgs.exe /IM doc.exe /IM rose.exe /IM sxs.exe /IM autorun.exe /IM KB20060111.exe /IM tel.xls.exe>nul 2>nul |
| fsutil fsinfo drivetype %pf% |find /i "固定驱动器" && ( |
| For /f "tokens=2 delims==" %%a In (%pf%\autorun.inf) Do Del /a /f /q "%pf%\%%a" & md "%pf%\%%a\免疫目录不要删除!...\" & attrib +s +h +r "%pf%\%%a" & Echo Y|cacls "%pf%\%%a" /T /C /P everyone:N >nul 2>nul |
| Del /a /f /q %pf%\autorun.inf & md "%pf%\autorun.inf\免疫目录不要删除!...\" & attrib +s +h +r %pf%\autorun.inf & Echo Y|cacls "%pf%\autorun.inf" /T /C /P everyone:N >nul 2>nul |
| Goto DoneclearAuto |
| ) >nul 2>nul |
| fsutil fsinfo drivetype %pf% |find /i "可移动驱动器" && ( |
| For /f "tokens=2 delims==" %%a In (%pf%\autorun.inf) Do Del /a /f /q "%pf%\%%a" & md "%pf%\%%a\免疫目录不要删除!...\" & attrib +s +h +r "%pf%\%%a" & Echo Y|cacls "%pf%\%%a" /T /C /P everyone:N >nul 2>nul |
| Del /a /f /q %pf%\autorun.inf & md "%pf%\autorun.inf\免疫目录不要删除!...\" & attrib +s +h +r %pf%\autorun.inf & Echo Y|cacls "%pf%\autorun.inf" /T /C /P everyone:N >nul 2>nul |
| Goto DoneclearAuto |
| ) >nul 2>nul |
| Echo. |
| Echo 您所输入的盘符不存在或者是只读设备， |
| Echo 请重新输入 |
| Goto clearauto5 |
| :DoneclearAuto |
| cls |
| Echo. |
| Echo 指定的磁盘 %pf% 已经成功进行了 Autorun 病毒的清除及免疫 |
| Echo. |
| Echo [1] 继续免疫其他磁盘 |
| Echo [0] 返回主菜单 |
| Set /p choice= 请输入您的选择(1/0): |
| If %choice%="" Goto DoneclearAuto |
| If %choice%="1" Goto clearauto5 |
| If %choice%="0" Goto clearauto |
| :clearauto6 |
| cls |
| Echo. |
| Set /p pf= 请输入盘符，如"F:"(不包括引号) |
| Echo 即将取消免疫%pf%盘……|find /i ":"||Set pf=%pf%:&&Echo 即将取消免疫%pf%盘…… |
| fsutil fsinfo drivetype %pf% |find /i "固定驱动器" && ( |
| cacls "%pf%\autorun.inf" /T /C /P everyone:F&Del /a /f /q "%pf%\autorun.inf" & rd /s /q "%pf%\autorun.inf">nul 2>nul |
| Goto DoneUnauto |
| )>nul 2>nul |
| fsutil fsinfo drivetype %pf% |find /i "可移动驱动器" && ( |
| cacls "%pf%\autorun.inf" /T /C /P everyone:F&Del /a /f /q "%pf%\autorun.inf" & rd /s /q "%pf%\autorun.inf">nul 2>nul |
| Goto DoneUnauto |
| )>nul 2>nul |
| Echo. |
| Echo 您所输入的盘符不存在或者是只读设备， |
| Echo 请重新输入 |
| Goto clearauto6 |
| :DoneUnauto |
| cls |
| Echo. |
| Echo 指定的磁盘 %pf% 已经成功解除了 Autorun 病毒免疫 |
| Echo. |
| Echo [1] 继续解除免疫其他磁盘 |
| Echo [0] 返回主菜单 |
| Set choice= |
| Set /p choice= 请输入您的选择(1/0): |
| If %choice%="" Goto DoneUnauto |
| If %choice%="1" Goto clearauto6 |
| If %choice%="0" Goto clearauto |
| :clearauto7 |
| cls |
| |
| reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t REG_DWORD /d 0x00000001 /f>nul 2>nul |
| reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f>nul 2>nul |
| reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /f>nul 2>nul |
| reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /f>nul 2>nul |
| |
| reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Startup /d "%USERPROFILE%\「开始」菜单\程序\启动" /f>nul 2>nul |
| reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Common Startup" /d "%ALLUSERSPROFILE%\「开始」菜单\程序\启动" /f>nul 2>nul |
| Echo. |
| Echo 相关注册表恢复完毕，任意键返回…… |
| pause>nul |
| Goto clearauto |
| :xians |
| reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t reg_dword /d 1 /f |
| reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t reg_dword /d 0 /f |
| reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t reg_dword /d 1 /f |
| cls&echo. |
| Echo 操作完毕，任意键返回…… |
| pause>nul |
| Goto clearauto |
| :yinc |
| reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t reg_dword /d 00000000 /f |
| reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t reg_dword /d 00000001 /f |
| reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t reg_dword /d 00000000 /f |
| cls&echo. |
| Echo 操作完毕，任意键返回…… |
| pause>nul |
| Goto clearauto |
| :hhsz |
| echo. |
| echo 恢复注册表中不给设置显示隐藏文件的项目,请稍侯...... |
| echo. |
| echo. |
| ECHO Windows Registry Editor Version 5.00>SHOWALL.reg |
| ECHO [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]>>SHOWALL.reg |
| ECHO "CheckedValue"=->>SHOWALL.reg |
| ECHO [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]>>SHOWALL.reg |
| ECHO "CheckedValue"=dword:00000001>>SHOWALL.reg |
| cls&echo. |
| Echo 操作完毕，任意键返回…… |
| pause>nul |
| Goto clearauto |
| :hfxslj |
| cls |
| echo. |
| echo 恢复显示指定路径下的文件 |
| echo. |
| echo. |
| set /p hfxsljj= 输入路径或拖入文件，退出【b】： |
| echo. |
| if %hfxsljj%==b Goto clearauto |
| attrib -h -s -a -r /s /d "%hfxsljj%" |
| attrib -h -s -a -r "%hfxsljj%" |
| echo. |
| pause |
| Goto hfxsljCOPY |
发表于 2010-5-29 12:34
| 
发表于 2010-6-19 13:15
| 
发表于 2010-7-28 12:58
| 