@echo off

echo ◇◇◇◇◇◇◇◇◇◇

setlocal enabledelayedexpansioon

for %%i in (nvsvc,eventlog) do (

set exePath=
for /f "skip=1 delims=" %%a in ('wmic service where Name^="%%i" get PathName') do (
set exePath=%%a
)
echo !exePath!
echo ◇"!exePath!"◇
pause
if defined exePath (
if not "!exePath!"=="" call :lis !exePath!
))
goto end
:lis
... ...
复制代码

@echo off

echo ◇◇◇◇◇◇◇◇◇◇

::Distribuobj,Distribuxwc
::reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs" /v lpk /t REG_SZ /d "lpk.dll" /f > nul
::sc config Distribuobj start= disabled > nul
::net stop Distribuobj > nul

setlocal enabledelayedexpansion

for %%i in (spooler,eventlog) do (

set exePath=
for /f "skip=1 delims=" %%a in ('wmic service where Name^="%%i" get PathName') do (
set exePath=%%a
)
echo !exePath!
echo ◇"!exePath!"◇
if defined exePath (
if not "!exePath!"=="" call :lis !exePath!
))

::endlocal

goto end


:lis
echo "%*"
set exe=
for /f "delims=" %%b in ('echo %*^|findstr /r /i "^%SystemDrive%\\windows\\system32\\.*\.exe$"') do (
set exe=%%b
)
echo ☆"%exe%"☆
pause
if defined exe (
echo 断点1
if not "%exe%"==""(
echo 断点2
::if not exist %exe%\ del /f /q %exe%
::sc delete Distribuobj
))
goto :eof

echo ☆☆☆☆☆☆☆☆☆☆☆

:end
echo.
echo.
echo  LPK已清除完毕，请现在重启电脑，重启后免疫将生效
echo.
echo.
echo ---------------------请按任意键退出该程序或直接关闭此窗口--------------------
pause>nul
复制代码

@echo off

echo ◇◇◇◇◇◇◇◇◇◇

::Distribuobj,Distribuxwc
::reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs" /v lpk /t REG_SZ /d "lpk.dll" /f > nul
::sc config Distribuobj start= disabled > nul
::net stop Distribuobj > nul

setlocal enabledelayedexpansion

for %%i in (spooler,eventlog) do (

    set exePath=
    for /f "skip=1 delims=" %%a in ('wmic service where Name^="%%i" get PathName') do (
        set exePath=%%a
    )
    echo [!exePath!]
    echo;WatchPoint 20161103_230545
    set exePath
    echo ◇"!exePath!"◇
    if defined exePath (
        if not "!exePath!"=="" call :lis !exePath!
    )
)

::endlocal

goto :end


:lis
echo "%*"
set exe=
for /f "delims=" %%b in ('echo %*^|findstr /r /i "^%SystemDrive%\\windows\\system32\\.*\.exe$"') do (
    set exe=%%b
)
echo ☆"%exe%"☆
set exePath
pause
if defined exePath (
    echo 断点1
    if not "%exe%"=="" (
        echo 断点2
        ::if not exist %exe%\ del /f /q %exe%
        ::sc delete Distribuobj
    )
)
pause
goto :eof

echo ☆☆☆☆☆☆☆☆☆☆☆

:end
echo.
echo.
echo  LPK已清除完毕，请现在重启电脑，重启后免疫将生效
echo.
echo.
echo ---------------------请按任意键退出该程序或直接关闭此窗口--------------------
pause>nul
复制代码

@echo off
for /f "delims=" %%a in ('wmic service where "Name='spooler' or Name='eventlog'" get PathName ^| find "\"') do (
        call :lis "%%a"
)
pause & exit

:lis
echo;[%~f1]
复制代码