中国DOS联盟

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
的下面有四项：{1f4de370-d627-11d1-ba4f-00a0c91eedba}
{450D8FBA-AD25-11D0-98A8-0800361B1103}
{645FF040-5081-101B-9F08-00AA002F954E}
{e17d4fc0-5564-11d1-83f2-00a0c90dc849}
这四项都是Windows原有的，是正常项，如果除这四项之外还有其他项的话，肯定是病毒添加的，现在想要的就是让批处理检测是否有多余项，有的话就删除

@echo off

for %%a in ({1f4de370-d627-11d1-ba4f-00a0c91eedba} {450D8FBA-AD25-11D0-98A8-0800361B1103} {645FF040-5081-101B-9F08-00AA002F954E} {e17d4fc0-5564-11d1-83f2-00a0c90dc849}) do set %%a==

for /F "skip=4 delims=" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace"') do if not defined %%~na reg delete "%%a" /f>nul

或：

@echo off

set "{1f4de370-d627-11d1-ba4f-00a0c91eedba}=="

set "{450D8FBA-AD25-11D0-98A8-0800361B1103}=="

set "{645FF040-5081-101B-9F08-00AA002F954E}=="

set "{e17d4fc0-5564-11d1-83f2-00a0c90dc849}=="

set "r=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace"

for /F "skip=4 delims=" %%a in ('reg query "%r%"') do if not defined %%~na reg delete "%%a" /f>nul

[ Last edited by Hanyeguxing on 2010-5-11 at 17:54 ]

非常好用，谢谢