@echo off
title 憶林子
color 0a
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
echo.
echo 該病毒資料
echo 瑞星對此暫無報(bào)告
echo.
echo 該病毒建立的包括的源文件如下:
echo.
echo 病毒文件全路徑 大小(字節(jié))
echo C:\Program Files\meex.exe 36,219
echo C:\Program Files\Common Files\Microsoft Shared\gvdetru.inf 169
echo c:\Program Files\Common Files\Microsoft Shared\tygxhqb.exe 36,219
echo c:\Program Files\Common Files\System\gvdetru.inf 169
echo C:\Program Files\Common Files\System\hmbduoj.exe 36,219
echo 其它所有分區(qū):\autorun.inf 169
echo 其它所有分區(qū):\pfcexkt.exe 36,219
echo 其它所有分區(qū):\niu.exe 30,625
echo.
echo autorun.inf和gvdetru.inf文件里的內(nèi)容
echo.
echo [AutoRun]
echo open=pfcexkt.exe
echo shell\open=打開(^&O)
echo shell\open\Command=pfcexkt.exe
echo shell\open\Default=1
echo shell\explore=資源管理器(^&X)
echo shell\explore\Command=pfcexkt.exe
echo.
echo 該病毒的后果:
echo 你的殺毒軟件會無法打開,另外只要你的文件名中如果是"病毒","殺毒","瑞星"等和病毒.
echo 有關(guān)的字眼時(shí),你這個(gè)文件打開之后會馬上被關(guān)閉.網(wǎng)頁中一搜索這些字眼也會馬上關(guān)閉.
echo 可能還有其它的情況,我這里就不詳細(xì)說明了.
echo.
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
echo.
set /p tmp=以上是該病毒的信息，如果要清除該病毒，請回車鍵開始?xì)⒍?..
rem 結(jié)束病毒進(jìn)程
for %%d in (
tygxhqb.exe,hmbduoj.exe
pfcexkt.exe,meex.exe
) do (
taskkill /im %%d /f 2>nul
)
rem 去除病毒源文件的 系統(tǒng)、隱藏、只讀 屬性,然后刪除它們。
for %%d in (meex.exe) do if exist "C:\Program Files\%%d" (
attrib -s -h -r "C:\Program Files\%%d"
del "C:\Program Files\%%d" /q
)
for %%d in (tygxhqb.exe,gvdetru.inf) do (
if exist "C:\Program Files\Common Files\Microsoft Shared\%%d" (
attrib -s -h -r "C:\Program Files\Common Files\Microsoft Shared\%%d"
del "C:\Program Files\Common Files\Microsoft Shared\%%d" /q
)
)
for %%d in (hmbduoj.exe,gvdetru.inf) do (
if exist "C:\Program Files\Common Files\System\%%d" (
attrib -s -h -r "C:\Program Files\Common Files\System\%%d"
del "C:\Program Files\Common Files\System\%%d" /q
)
)
for %%f in (autorun.inf,pfcexkt.exe,niu.exe) do (
for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\%%f (
attrib -s -h -r %%d:\%%f
del %%d:\%%f /q
)
)
rem 添加進(jìn)入安全模式的注冊表項(xiàng)
reg add "HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /ve /d DiskDrive /f
reg add "HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /ve /d DiskDrive /f
reg add "HKLM\SYSTEM\ControlSet003\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /ve /d DiskDrive /f
reg add "HKLM\SYSTEM\ControlSet003\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /ve /d DiskDrive /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /ve /d DiskDrive /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /ve /d DiskDrive /f
rem 添加被病毒刪除的注冊表項(xiàng)
reg add "HKLM\SYSTEM\ControlSet003\Services\kmixer\Enum" /v 0 /d "SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}" /f
reg add "HKLM\SYSTEM\ControlSet001\Services\kmixer\Enum" /v 0 /d "SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\kmixer\Enum" /v 0 /d "SW\{b7eafdc0-a680-11d0-96d8-00aa0051e51d}\{9B365890-165F-11D0-A195-0020AFD156E4}" /f
rem 添加顯示隱藏文件的注冊表項(xiàng)
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v CheckedValue /t reg_dword /d 1 /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /d 1 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden" /v Type /d checkbox /f
rem 刪除由病毒添加的啟動(dòng)項(xiàng)
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v pfcexkt /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v gvdetru /f
rem 刪除病毒在注冊表中添加的關(guān)聯(lián)
if exist test.憶林子 del test.憶林子
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options">test.憶林子
for /f "tokens=* delims= skip=4" %%j in (test.憶林子) do (
reg delete "%%j" /v debugger /f
cls
if exist test.憶林子 del test.憶林子
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
echo.
echo 正在清除由病毒添加的注冊表項(xiàng),請稍候...
echo.
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
)
if exist test.憶林子 del test.憶林子
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path" /v Debugger /d "ntsd -d" /f
cls
color a0
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
echo.
echo 病毒清除完畢，按回車鍵開始解決分區(qū)無法雙擊打開的問題.
echo.
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
set /p test=
cls
@echo off
title 憶林子--解決分區(qū)無法打開
color a0
rem 刪除引起磁盤無法雙擊打開的autorun.inf文件
for /d %%i in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%i:\autorun.inf (
cacls %%i:\autorun.inf /c /e /p everyone:f
attrib -s -h -r %%i:\autorun.inf
del %%i:\autorun.inf /q
)
rem 進(jìn)行磁盤檢查，恢復(fù)雙擊打開功能
for /d %%i in (d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%i: chkdsk %%i: /f /x
cls
color ec
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
echo.
echo 操作結(jié)束,按回車鍵退出該程序...
echo.
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
set /p temp=
:exit
exit
