|
jiaju8
初级用户
积分 74
发帖 30
注册 2007-3-9
状态 离线
|
『楼 主』:
运行了个免疫 U盘病毒的，现在免疫文件删除不了了
运行了个批处理免疫 U盘病毒的，现在免疫文件删除不了了
用来免疫的文件删除不了
那位研究下，给个方法删除
===============================
===============================
@Echo Off
color 9f
REM title 移动介质病毒免疫工具
:reg
Rem 无条件禁止自动运行特性防范病毒
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveAutoRun /t REG_BINARY /d ffffff03 /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000df /f>nul 2>nul
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t REG_DWORD /d 0x00000001 /f>nul 2>nul
rem 修复磁盘打开关联
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" /f>nul 2>nul
rem 杀除U盘病毒進程
taskkill /F /IM ctfmon.exe /IM ctfmon.exe /IM SVOHOST.exe /IM AdobeR.exe /IM ravmone.exe /IM wincfgs.exe /IM doc.exe /IM rose.exe /IM sxs.exe /IM autorun.exe /IM KB20060111.exe>nul 2>nul
rem 免疫自动运行
echo Y|cacls "%USERPROFILE%\「开始」菜单\程序\启动" /C /P everyone:F>nul 2>nul
echo Y|cacls "%ALLUSERSPROFILE%\「开始」菜单\程序\启动" /C /P everyone:F>nul 2>nul
attrib -s -h -r "%USERPROFILE%\「开始」菜单\程序\启动\*.exe">nul 2>nul
attrib -s -h -r "%ALLUSERSPROFILE%\「开始」菜单\程序\启动\*.exe">nul 2>nul
del /A /F /S /Q "%USERPROFILE%\「开始」菜单\程序\启动\*.exe">nul 2>nul
del /A /F /S /Q "%ALLUSERSPROFILE%\「开始」菜单\程序\启动\*.exe">nul 2>nul
rem echo Y|cacls "%USERPROFILE%\「开始」菜单\程序\启动" /C /P everyone:N>nul 2>nul
rem echo Y|cacls "%ALLUSERSPROFILE%\「开始」菜单\程序\启动" /C /P everyone:N>nul 2>nul
:menu1
cls
Echo.
Echo.
Echo 磁盘 Autorun 病毒清除/免疫工具 for TX
Echo.
Echo 移动磁盘容易受到利用移动设备的自动运行特性而感染和发作的病毒
Echo 的侵袭，而我们无法保证其他的机器中没有这类病毒。
Echo.
Echo 本工具可对移动磁盘進行特别的免疫处理，使得它的自动运行特性完
Echo 失效，从而避免带毒的移动磁盘插入本机后病毒立即自动执行。
Echo 当然，您也完全可以对硬盘分区進行免疫处理。
Echo.
Echo.
Echo [1] 免疫当前系统中所有磁盘
Echo [2] 只免疫指定磁盘或移动磁盘
Echo [3] 退出
Set Choice=
Echo.
Set /P Choice= 请输入要执行的操作，然后按回车：
Echo.
If '%Choice%'=='' goto other
If /I '%Choice%'=='1' GOTO alldisk
If /I '%Choice%'=='2' GOTO setlet
If /I '%Choice%'=='3' GOTO end
Goto menu1
:alldisk
Echo.
Echo 正在免疫！可能需要一小会时间，请稍候……
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do echo Y|cacls %%a:\autorun.inf /C /P everyone:F>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do attrib -s -h -r %%a:\Autorun.inf>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do del /A /F /S /Q %%a:\Autorun.inf>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do md %%a:\Autorun.inf\>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do md %%a:\Autorun.inf\病毒免疫目录不要删除！..\>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do attrib +s +h +r %%a:\Autorun.inf>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do echo Y|cacls %%a:\autorun.inf /C /P everyone:R>nul 2>nul
rem 杀除U盘病毒進程
taskkill /F /IM ctfmon.exe /IM ctfmon.exe /IM SVOHOST.exe /IM AdobeR.exe /IM ravmone.exe /IM wincfgs.exe /IM doc.exe /IM rose.exe /IM sxs.exe /IM autorun.exe /IM KB20060111.exe>nul 2>nul
rem 免疫自动运行
echo Y|cacls "%USERPROFILE%\「开始」菜单\程序\启动" /C /P everyone:F>nul 2>nul
echo Y|cacls "%ALLUSERSPROFILE%\「开始」菜单\程序\启动" /C /P everyone:F>nul 2>nul
attrib -s -h -r "%USERPROFILE%\「开始」菜单\程序\启动\*.exe">nul 2>nul
attrib -s -h -r "%ALLUSERSPROFILE%\「开始」菜单\程序\启动\*.exe">nul 2>nul
del /A /F /S /Q "%USERPROFILE%\「开始」菜单\程序\启动\*.exe">nul 2>nul
del /A /F /S /Q "%ALLUSERSPROFILE%\「开始」菜单\程序\启动\*.exe">nul 2>nul
rem echo Y|cacls "%USERPROFILE%\「开始」菜单\程序\启动" /C /P everyone:N>nul 2>nul
rem echo Y|cacls "%ALLUSERSPROFILE%\「开始」菜单\程序\启动" /C /P everyone:N>nul 2>nul
rem 清除自动加载键值
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SoundMam /f>nul 2>nul
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wincfgs /f>nul 2>nul
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /f>nul 2>nul
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /f>nul 2>nul
rem 清除喜欢利用回收站的移动磁盘自动运行病毒
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do echo Y|cacls "%%a:\Recycler\*.exe" /C /P everyone:F>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do echo Y|cacls "%%a:\Recycler\*.pif" /C /P everyone:F>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do echo Y|cacls "%%a:\Recycler\*.com" /C /P everyone:F>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do echo Y|cacls "%%a:\Recycled\*.exe" /C /P everyone:F>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do echo Y|cacls "%%a:\Recycled\*.pif" /C /P everyone:F>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do echo Y|cacls "%%a:\Recycled\*.com" /C /P everyone:F>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do echo Y|cacls "%%a:\Recycled\Recycled\*.exe" /C /P everyone:F>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do echo Y|cacls "%%a:\Recycled\Recycled\*.pif" /C /P everyone:F>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do echo Y|cacls "%%a:\Recycled\Recycled\*.com" /C /P everyone:F>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do del /A /F /S /Q "%%a:\Recycled\*.exe">nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do del /A /F /S /Q "%%a:\Recycled\*.com">nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do del /A /F /S /Q "%%a:\Recycled\*.pif">nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do del /A /F /S /Q "%%a:\Recycler\*.exe">nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do del /A /F /S /Q "%%a:\Recycler\*.com">nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do del /A /F /S /Q "%%a:\Recycler\*.pif">nul 2>nul
cls
Echo.
Echo 当前系统的所有磁盘已经成功地進行了自动运行病毒免疫！
Echo 任意键退出……
pause>nul
goto end
:setlet
echo.
Echo.
Set Choice=
Set /P Choice= 请输入要免疫的移动磁盘的盘符，如 F: 然后按回车：
If '%Choice%'=='' goto setlet
echo Y|cacls %Choice%\autorun.inf /C /P everyone:F>nul 2>nul
If Exist %Choice%\Autorun.inf Del /A /F /S /Q %Choice%\Autorun.inf>nul 2>nul
md %Choice%\Autorun.inf\>nul 2>nul
md %Choice%\Autorun.inf\病毒免疫目录不要删除！..\>nul 2>nul
attrib +s +h +r %Choice%\Autorun.inf>nul 2>nul
echo Y|cacls %Choice%\Autorun.inf /P everyone:N>nul
rem 清除回收站可能的病毒
cacls "%Choice%\Recycler\*.exe" /C /P everyone:F>nul 2>nul
cacls "%Choice%\Recycler\*.pif" /C /P everyone:F>nul 2>nul
cacls "%Choice%\Recycler\*.com" /C /P everyone:F>nul 2>nul
cacls "%Choice%\Recycled\*.exe" /C /P everyone:F>nul 2>nul
cacls "%Choice%\Recycled\*.pif" /C /P everyone:F>nul 2>nul
cacls "%Choice%\Recycled\*.com" /C /P everyone:F>nul 2>nul
cacls "%Choice%\Recycled\Recycled\*.exe" /C /P everyone:F>nul 2>nul
cacls "%Choice%\Recycled\Recycled\*.pif" /C /P everyone:F>nul 2>nul
cacls "%Choice%\Recycled\Recycled\*.com" /C /P everyone:F>nul 2>nul
del /A /F /S /Q "%Choice%\Recycled\*.exe">nul 2>nul
del /A /F /S /Q "%Choice%\Recycled\*.com">nul 2>nulcls
del /A /F /S /Q "%Choice%\Recycled\*.pif">nul 2>nul
Echo.
Echo 指定的磁盘 %Choice% 已经成功地進行了病毒免疫！
:other
Echo.
Echo [1] 继续免疫其他的磁盘 [2] 退出
Set Choice=
Echo.
Set /P Choice= 请输入要执行的操作，然后按回车：
Echo.
If '%Choice%'=='' goto other
If /I '%Choice%'=='1' GOTO setlet
If /I '%Choice%'=='2' GOTO end
Goto other
:End
cls
Echo.
Echo 友情提示：
Echo 如果系统中已经感染了打开磁盘分区即自动运行的病毒，请用本工具
Echo 对所有磁盘進行免疫处理后，立即重启计算机，然后这类病毒就不会
Echo 在打开磁盘时自动运行了。此时只需直接删除病毒文件即可！
Echo.
Echo 任意键退出……
pause>nul
Exit
=================================
=================================
=================================
|
|
 2007-10-22 21:56 |
|
|
peace
新手上路
积分 8
发帖 4
注册 2006-10-25
状态 离线
|
『第
2 楼』:
这段代码再运行一次试试
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do echo Y|cacls %%a:\autorun.inf /C /P everyone:F>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do attrib -s -h -r %%a:\Autorun.inf>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do del /A /F /S /Q %%a:\Autorun.inf>nul 2>nul
|
|
|
2007-11-3 23:56 |
|
|
313885174
中级用户
积分 206
发帖 100
注册 2007-7-9
状态 离线
|
『第
3 楼』:
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do attrib -s -h -r %%a:\Autorun.inf>nul 2>nul
for %%a in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do rd /q /s %%a:\Autorun.inf>nul 2>nul
换成RD /Q /S 不就行了?
|
|
|
2008-2-11 13:46 |
|
|
