[安全相关] 文件夹带exe病毒专杀批处理(2009.3.27更新)

@echo off
title 甲兵时代移动盘同名文件夹病毒专杀工具（2009.11.20升级版）
COLOR 3C
echo.
echo.
echo        ★ 移动盘同名文件夹专杀
echo        ◇ 优盘文件夹带EXE专杀或者U盘同名文件夹.EXE专杀
echo        ◇ 移动盘病毒XP-*.EXE专杀\96015E.exe专杀
echo.
echo        ★ 批处理杀毒，简单就是好！
echo        ◇ 甲兵时代: http://hi.baidu.com/cjiabing 
echo        ◇ QQ: 272768887   
echo. 
echo        ★ 使用说明:    
echo *******************************************************************************
echo 【1】病毒的图标是文件夹，扩展名为.EXE，大小约为1.20M-1.44M。
echo 【2】移动盘中的文件夹被隐藏，带有.exe结尾的同名文件夹其实是病毒程序。
echo 【3】插入中毒盘后病毒自动运行，并加载到进程、启动、系统根目录和临时文件夹。
echo 【4】病毒通过移动盘自动传播，肆虐于办公电脑和个人电脑，请对你的移动盘杀毒。
echo 【5】请将本工具拷贝到移动盘或公用电脑中以备用，并敬请关注更新。
echo 【6】本工具功能有限，使用需自担风险。
echo *******************************************************************************
echo.
pause
:1
for /f %%a in ('tasklist') do echo %%a |findstr "[0123456789]" >>psyf.txt
for /f %%a in (psyf.txt) do taskkill /f /im %%a
taskkill /f /im XP*
for /l %%a in (10,-1,1) do taskkill /f /im %%a*
taskkill /f /im 0*
tskill explorer
taskkill /f /im explorer.exe
for /f "delims=" %%a in (psyf.txt) do (
for /r %SYSTEMROOT%\system32   %%i in (%%a) do (
if exist %%i echo %%i>nul
if exist %%i (attrib -h -r -s %%i)
(DEL /F /Q /A -R -H -S -A %%i)
)
)
del psyf.txt
for /r %SYSTEMROOT%\system32 %%i in (96015E.EXE,21c0.EDT,21c0.inf,69fe.inf,com.run,dp1.fne,eAPI.fne,internet.fne,krnln.fnr,RegEx.fnr,shell.fne,spec.fne) do    (
if exist %%i (attrib -h -r -s %%i) & (DEL /F /Q /A %%i)
)>nul
attrib -h -r -s %SystemRoot%\System32\XP-*.EXE
attrib -h -r -s %SystemRoot%\System32\og.EDT
attrib -h -r -s %SystemRoot%\System32\ul.dll
attrib -h -r -s %SystemRoot%\System32\og.dll
attrib -h -r -s %SystemRoot%\System32\winvcreg.exe
del %SystemRoot%\System32\XP-*.EXE
del %SystemRoot%\System32\og.EDT
del %SystemRoot%\System32\ul.dll
del %SystemRoot%\System32\og.dll
del %SystemRoot%\System32\winvcreg.exe
del %TEMP%\E_4\com.run /f/s/q/a
del %TEMP%\E_4\dp1.fne /f/s/q/a
del %TEMP%\E_4\eAPI.fne /f/s/q/a
del %TEMP%\E_4\internet.fne /f/s/q/a
del %TEMP%\E_4\krnln.fnr /f/s/q/a
del %TEMP%\E_4\RegEx.fnr /f/s/q/a
del %TEMP%\E_4\shell.fne /f/s/q/a
del %TEMP%\E_4\spec.fne /f/s/q/a
attrib -h -r -s %TEMP%\E_4
rd %TEMP%\E_4\
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f
reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /va /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v ctfmon.exe /d C:\WINDOWS\system32\ctfmon.exe
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /f
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1"
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v command /d ""C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32"
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v hkey /d HKLM
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v inimapping /d 0
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v item /d IMJPMIG
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\IMJPMIG8.1" /v key /d SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A"
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v command /d "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName"
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v hkey /d HKLM
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v inimapping /d 0
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v item /d TINTSETP
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002A" /v key /d SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync"
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v command /d ""C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32"
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v hkey /d HKLM
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v inimapping /d 0
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v item /d TINTSETP
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\PHIME2002ASync" /v key /d SOFTWARE\Microsoft\Windows\CurrentVersion\Run
del "%ALLUSERSPROFILE%\「开始」菜单\程序\启动\*.*" /q /f
del "C:\Documents and Settings\Default User\「开始」菜单\程序\启动\*.*" /q /f
del "%userprofile%\「开始」菜单\程序\启动\*.*" /q /f
copy %0 %SYSTEMDRIVE%
cls&echo.
:2
echo   ★ 以下清理移动盘中的EXE病毒，请插入移动盘继续！
echo.
echo      ◇ 清动盘中与文件夹名字相同的EXE程序将被清理。
echo      ◇ 移动盘中的EXE程序大小小于2M的将被清理。
echo      ◇ 请做好备份后继续。
echo.
echo.&pause
for /f "skip=1 " %%a in ('wmic logicaldisk where "drivetype='2'" get deviceid') do (
setlocal EnableDelayedexpansion
dir %%a>nul &&IF ERRORLEVEL 0 set tvd=%%a
)
::for /f "skip=1 " %%a in ('wmic logicaldisk where "drivetype='2'" get deviceid') do set tvd=%%a
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t reg_dword /d 1 /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t reg_dword /d 0 /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t reg_dword /d 1 /f
cls&echo.
echo   ★ 正在恢复显示移动盘文件，请稍候……（移动盘中文件过多可能会影响速度。） 
echo.
for /f %%i in ("!tvd!") do attrib %%~di\*.* -s -r -h -a /d /s
setlocal EnableDelayedexpansion
for /r %tvd% %%e in (.) do (
set w2=%%~fe
for /r %tvd% %%i in (*.exe) do (
set w1=%%~dpni
if !w1! == !w2! del /f/a/q %%i
)
)
for /r %tvd% %%i in (*.exe) do (
if %%~zi lss 2000000 (if exist %%i del /f/q/a %%i)
)
del /a/f/q %tvd%\Autorun.inf.exe
del /a/f/q %tvd%\RECYCLER.exe
del /a/f/q %tvd%\Notepad.exe
del /a/f/q %tvd%\autorun.inf
echo 甲兵时代移动盘同名文件夹病毒专杀工具（2009.11.20升级版）>%tvd%\autorun.inf 
attrib +a +h +r +s %tvd%\autorun.inf
copy %0 %tvd%
cls&echo.
echo        ★ 所有任务完成，自动退出。
ping /n 5 127.0.0>nul&exit
复制代码

echo.
echo   ★ 推荐以下三项安全防护，避免再次中毒：
echo.
echo      ◇ 清除Autorun病毒；
echo      ◇ 禁用系统自动播放功能；
echo      ◇ 清除喜欢利用回收站的移动磁盘自动运行病毒。
echo.
echo      如需要请输入【Y】键并按回车键继续；
set /p af=   直接退出请按回车：
rem 以下借用别人的代码，清除Autorun病毒，禁用系统自动播放功能等。
if /i %af%==y start goto 3 else exit
:3
taskkill /F /IM SocksA.exe /IM SVOHOST.exe /IM AdobeR.exe /IM ravmone.exe /IM wincfgs.exe /IM doc.exe /IM rose.exe /IM sxs.exe /IM autorun.exe /IM KB20060111.exe /IM tel.xls.exe>nul 2>nul
For %%a In (C D E F G H I J K L M N O P Q R S T U V W X Y Z) Do (
fsutil fsinfo drivetype %%a: |find /i "固定驱动器" && (
   For /f "tokens=2 delims==" %%b In (%%a:\autorun.inf) Do Del /a /f /q "%%a:\%%b" >nul 2>nul
   Del /a /f /q %%a:\autorun.inf >nul 2>nul
   ) >nul 2>nul
fsutil fsinfo drivetype %%a: |find /i "可移动驱动器" && (
   For /f "tokens=2 delims==" %%b In (%%a:\autorun.inf) Do Del /a /f /q "%%a:\%%b" >nul 2>nul
   Del /a /f /q %%a:\autorun.inf >nul 2>nul
   ) >nul 2>nul
)
cls
taskkill /F /IM SocksA.exe /IM SVOHOST.exe /IM AdobeR.exe /IM ravmone.exe /IM wincfgs.exe /IM doc.exe /IM rose.exe /IM sxs.exe /IM autorun.exe /IM KB20060111.exe /IM tel.xls.exe>nul 2>nul
For %%a In (C D E F G H I J K L M N O P Q R S T U V W X Y Z) Do (
fsutil fsinfo drivetype %%a: |find /i "固定驱动器" && (
   For /f "tokens=2 delims==" %%b In (%%a:\autorun.inf) Do Del /a /f /q "%%a:\%%b" & md "%%a:\%%b\免疫目录不要删除!...\" & attrib +s +h +r "%%a:\%%b" & Echo Y|cacls "%%a:\%%b" /T /C /P everyone:N >nul 2>nul
   Del /a /f /q %%a:\autorun.inf & md "%%a:\autorun.inf\免疫目录不要删除!...\" & attrib +s +h +r %%a:\autorun.inf & Echo Y|cacls "%%a:\autorun.inf" /T /C /P everyone:N >nul 2>nul
   ) >nul 2>nul
fsutil fsinfo drivetype %%a: |find /i "可移动驱动器" && (
   For /f "tokens=2 delims==" %%b In (%%a:\autorun.inf) Do Del /a /f /q "%%a:\%%b" & md "%%a:\%%b\免疫目录不要删除!...\" & attrib +s +h +r "%%a:\%%b" & Echo Y|cacls "%%a:\%%b" /T /C /P everyone:N >nul 2>nul
   Del /a /f /q %%a:\autorun.inf & md "%%a:\autorun.inf\免疫目录不要删除!...\" & attrib +s +h +r %%a:\autorun.inf & Echo Y|cacls "%%a:\autorun.inf" /T /C /P everyone:N >nul 2>nul
   ) >nul 2>nul
)
cls
Echo.
Echo   正在停止相关服务……
Echo.
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000ff /f >nul 2>nul
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000ff /f >nul 2>nul
net stop ShellHWDetection >nul 2>nul
sc config ShellHWDetection start= disabled >nul 2>nul
Rem 添加防止从回收站或仿回收站的目录中直接运行可执行文件的策略
Set REGPATH=HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
Set SFLAG=/v SaferFlags /t REG_DWORD /d 0x00000000 /f
Set IDATA=/f /v ItemData /d "?:\Recyc?
reg add %REGPATH%\{00ffa5bf-abe7-4901-aacf-4f58aa31217a} %SFLAG%>nul
reg add %REGPATH%\{00ffa5bf-abe7-4901-aacf-4f58aa31217a} %IDATA%\*\*\*\*.*">nul
reg add %REGPATH%\{41fe7eed-c47a-46f6-840a-240796fd03cf} %SFLAG%>nul
reg add %REGPATH%\{41fe7eed-c47a-46f6-840a-240796fd03cf} %IDATA%\*\*\*.*">nul
reg add %REGPATH%\{4e93c91c-a40e-462e-9b89-3b0832d222d9} %SFLAG%>nul
reg add %REGPATH%\{4e93c91c-a40e-462e-9b89-3b0832d222d9} %IDATA%\*.*">nul
reg add %REGPATH%\{5bfc100b-d3fb-450e-88ec-6819ab56a9ff} %SFLAG%>nul
reg add %REGPATH%\{5bfc100b-d3fb-450e-88ec-6819ab56a9ff} %IDATA%\*\*\*\*.*">nul
reg add %REGPATH%\{5c5e2bcd-7057-43f4-830c-e4361d2afadd} %SFLAG%>nul
reg add %REGPATH%\{5c5e2bcd-7057-43f4-830c-e4361d2afadd} %IDATA%\*.*">nul
reg add %REGPATH%\{5f8ff865-0638-4c6e-98de-923e7bc6b330} %SFLAG%>nul
reg add %REGPATH%\{5f8ff865-0638-4c6e-98de-923e7bc6b330} %IDATA%\*\*\*.*">nul
reg add %REGPATH%\{649c1429-0e79-453c-abe9-b5682e035ae7} %SFLAG%>nul
reg add %REGPATH%\{649c1429-0e79-453c-abe9-b5682e035ae7} %IDATA%\*\*.*">nul
reg add %REGPATH%\{718f54b2-c669-4d7b-aeff-18d69f100034} %SFLAG%>nul
reg add %REGPATH%\{718f54b2-c669-4d7b-aeff-18d69f100034} %IDATA%\*\*.*">nul
reg add %REGPATH%\{8385d9d2-80c9-4ac1-a100-ed3e62863d97} %SFLAG%>nul
reg add %REGPATH%\{8385d9d2-80c9-4ac1-a100-ed3e62863d97} %IDATA%\*.*">nul
reg add %REGPATH%\{af2a4fcf-441c-421e-9663-52cd3502cfd7} %SFLAG%>nul
reg add %REGPATH%\{af2a4fcf-441c-421e-9663-52cd3502cfd7} %IDATA%\*\*\*.*">nul
reg add %REGPATH%\{b997f4b2-c037-4e97-b051-31f5d86df802} %SFLAG%>nul
reg add %REGPATH%\{b997f4b2-c037-4e97-b051-31f5d86df802} %IDATA%\*\*.*">nul
reg add %REGPATH%\{d4e7b6ff-d76f-407f-b8bb-ea0835f5babc} %SFLAG%>nul
reg add %REGPATH%\{d4e7b6ff-d76f-407f-b8bb-ea0835f5babc} /f /v ItemData /d "RECYC*.*">nul
Rem 清除喜欢利用回收站的移动磁盘自动运行病毒
For %%a In (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) Do (
For %%b In (exe pif com) Do (
   Echo Y|cacls "%%a:\Recycler\*.%%b" /C /T /P everyone:F>nul 2>nul&Echo Y|cacls "%%a:\Recycled\*.%%b" /C /T /P everyone:F>nul 2>nul&Echo Y|cacls "%%a:\Recycled\Recycled\*.%%b" /C /T /P everyone:F>nul 2>nul
   Del /A /F /S /Q "%%a:\Recycler\*.%%b">nul 2>nul&Del /A /F /S /Q "%%a:\Recycled\*.%%b">nul 2>nul&Del /A /F /S /Q "%%a:\Recycled\Recycled\*.%%b">nul 2>nul
   )
)>nul 2>nul
cls&echo.
复制代码