Autorun 病毒清除工具

e62863d97} %IDATA%\*.*">nulreg add %REGPATH%\{af2a4fcf-441c-421e-9663-52cd3502cfd7} %SFLAG%>nulreg add %REGPATH%\{af2a4fcf-441c-421e-9663-52cd3502cfd7} %IDATA%\*\*\*.*">nulreg add %REGPATH%\{b997f4b2-c037-4e97-b051-31f5d86df802} %SFLAG%>nulreg add %REGPATH%\{b997f4b2-c037-4e97-b051-31f5d86df802} %IDATA%\*\*.*">nulreg add %REGPATH%\{d4e7b6ff-d76f-407f-b8bb-ea0835f5babc} %SFLAG%>nulreg add %REGPATH%\{d4e7b6ff-d76f-407f-b8bb-ea0835f5babc} /f /v ItemData /d "RECYC*.*">nulRem 清除喜欢利用回收站的移动磁盘自动运行病毒For %%a In (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) Do (For %%b In (exe pif com) Do (Echo Y|cacls "%%a:\Recycler\*.%%b" /C /T /P everyone:F>nul 2>nul&Echo Y|cacls "%%a:\Recycled\*.%%b" /C /T /P everyone:F>nul 2>nul&Echo Y|cacls "%%a:\Recycled\Recycled\*.%%b" /C /T /P everyone:F>nul 2>nulDel /A /F /S /Q "%%a:\Recycler\*.%%b">nul 2>nul&Del /A /F /S /Q "%%a:\Recycled\*.%%b">nul 2>nul&Del /A /F /S /Q "%%a:\Recycled\Recycled\*.%%b">nul 2>nul))>nul 2>nulEcho.Echo相关服务已停止并禁用，任意键返回……pause >nulGoto clearauto:clearauto4For %%a In (C D E F G H I J K L M N O P Q R S T U V W X Y Z) Do (fsutil fsinfo drivetype %%a: |find /i "固定驱动器" && (cacls "%%a:\autorun.inf" /T /C /P everyone:F&Del /a /f /q "%%a:\autorun.inf" & rd /s /q "%%a:\autorun.inf">nul 2>nul)>nul 2>nulfsutil fsinfo drivetype %%a: |find /i "可移动驱动器" && (cacls "%%a:\autorun.inf" /T /C /P everyone:F&Del /a /f /q "%%a:\autorun.inf" & rd /s /q "%%a:\autorun.inf">nul 2>nul)>nul 2>nul)clsEcho.Echo已经解除全部盘符的免疫，任意键返回……pause>nulGoto clearauto:clearauto5clsEcho.Set /p pf=请输入盘符，如"F:"(不包括引号)Echo 即将免疫%pf%盘……|find /i ":"||Set pf=%pf%:&&Echo 即将免疫%pf%盘……taskkill /F /IM SocksA.exe /IM SVOHOST.exe /IM AdobeR.exe /IM ravmone.exe /IM wincfgs.exe /IM doc.exe /IM rose.exe /IM sxs.exe /IM autorun.exe /IM KB20060111.exe /IM tel.xls.exe>nul 2>nulfsutil fsinfo drivetype %pf% |find /i "固定驱动器" && (For /f "tokens=2 delims==" %%a In (%pf%\autorun.inf) Do Del /a /f /q "%pf%\%%a" & md "%pf%\%%a\免疫目录不要删除!...\" & attrib +s +h +r "%pf%\%%a" & Echo Y|cacls "%pf%\%%a" /T /C /P everyone:N >nul 2>nulDel /a /f /q %pf%\autorun.inf & md "%pf%\autorun.inf\免疫目录不要删除!...\" & attrib +s +h +r %pf%\autorun.inf & Echo Y|cacls "%pf%\autorun.inf" /T /C /P everyone:N >nul 2>nulGoto DoneclearAuto) >nul 2>nulfsutil fsinfo drivetype %pf% |find /i "可移动驱动器" && (For /f "tokens=2 delims==" %%a In (%pf%\autorun.inf) Do Del /a /f /q "%pf%\%%a" & md "%pf%\%%a\免疫目录不要删除!...\" & attrib +s +h +r "%pf%\%%a" & Echo Y|cacls "%pf%\%%a" /T /C /P everyone:N >nul 2>nulDel /a /f /q %pf%\autorun.inf & md "%pf%\autorun.inf\免疫目录不要删除!...\" & attrib +s +h +r %pf%\autorun.inf & Echo Y|cacls "%pf%\autorun.inf" /T /C /P everyone:N >nul 2>nulGoto DoneclearAuto) >nul 2>nulEcho.Echo您所输入的盘符不存在或者是只读设备，Echo请重新输入Goto clearauto5:DoneclearAutoclsEcho.Echo指定的磁盘 %pf% 已经成功进行了 Autorun 病毒的清除及免疫Echo.Echo[1] 继续免疫其他磁盘Echo[0] 返回主菜单Set /p choice=请输入您的选择(1/0):If %choice%="" Goto DoneclearAutoIf %choice%="1" Goto clearauto5If %choice%="0" Goto clearauto:clearauto6clsEcho.Set /p pf=请输入盘符，如"F:"(不包括引号)Echo 即将取消免疫%pf%盘……|find /i ":"||Set pf=%pf%:&&Echo 即将取消免疫%pf%盘……fsutil fsinfo drivetype %pf% |find /i "固定驱动器" && (cacls "%pf%\autorun.inf" /T /C /P everyone:F&Del /a /f /q "%pf%\autorun.inf" & rd /s /q "%pf%\autorun.inf">nul 2>nulGoto DoneUnauto)>nul 2>nulfsutil fsinfo drivetype %pf% |find /i "可移动驱动器" && (cacls "%pf%\autorun.inf" /T /C /P everyone:F&Del /a /f /q "%pf%\autorun.inf" & rd /s /q "%pf%\autorun.inf">nul 2>nulGoto DoneUnauto)>nul 2>nulEcho.Echo您所输入的盘符不存在或者是只读设备，Echo请重新输入Goto clearauto6:DoneUnautoclsEcho.Echo指定的磁盘 %pf% 已经成功解除了 Autorun 病毒免疫Echo.Echo[1] 继续解除免疫其他磁盘Echo[0] 返回主菜单Set choice=Set /p choice=请输入您的选择(1/0):If %choice%="" Goto DoneUnautoIf %choice%="1" Goto clearauto6If %choice%="0" Goto clearauto:clearauto7clsRem 防止在资源管理器中彻底隐藏文件、禁止文件等reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t REG_DWORD /d 0x00000001 /f>nul 2>nulreg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f>nul 2>nulreg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /f>nul 2>nulreg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /f>nul 2>nulRem 防止转移启动组位置reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Startup /d "%USERPROFILE%\「开始」菜单\程序\启动" /f>nul 2>nulreg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Common Startup" /d "%ALLUSERSPROFILE%\「开始」菜单\程序\启动" /f>nul 2>nulEcho.Echo相关注册表恢复完毕，任意键返回……pause>nulGoto clearauto