Board logo

标题: [已结]发现关于隐藏运行的BAT文件的一点问题! [打印本页]

作者: uforange     时间: 2008-3-6 15:28    标题: [已结]发现关于隐藏运行的BAT文件的一点问题!
我是做一个删除拉圾BAT文件
@echo off
if "%1" == "h" goto begin
mshta vbscript:createobject("wscript.shell").run("""%~nx0"" h",0)(window.close)&&exit
:begin



@echo off
color 0a
echo 正在清理系统垃圾文件,请稍等......
del /f /s /q %systemdrive%\*.tmp
del /f /s /q %systemdrive%\*._mp
del /f /s /q %systemdrive%\*.log
del /f /s /q %systemdrive%\*.gid
del /f /s /q %systemdrive%\*.chk
del /f /s /q %systemdrive%\*.old
del /f /s /q %systemdrive%\recycled\*.*
del /f /s /q %windir%\*.bak
del /f /s /q %windir%\prefetch\*.*
del /f /q %userprofile%\cookies\*.*
del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*"
del /f /s /q "%userprofile%\Local Settings\Temp\*.*"
del /f /s /q "%userprofile%\recent\*.*"
del /f /s /q %USERPROFILE%\Local Settings\History\*.*
del /f /s /q %USERPROFILE%\Favorites\*.*
del /f /s /q %WINDIR%\Temp\*.*
del %TMP%\\*.* /q /f /S >nul


REM 清除系统缓存
sfc /purgecache>NUL
IF NOT %ERRORLEVEL%==0 ECHO =========================清除系统缓存失败====================

REM 清除WORD纪录
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List" /va /f 2>nul
IF NOT %ERRORLEVEL%==0 ECHO =========================没WORD垃圾==========================
REM 清除MediaPlayer纪录
reg delete "HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\RecentFileList" /va /f 2>nul
reg delete "HKEY_CURRENT_USER\Software\Gabest\Media Player Classic\Recent File List" /va /f 2>nul
IF NOT %ERRORLEVEL%==0 ECHO =========================没MediaPlayer纪录===================


REM 清除WINRAR纪录
reg delete "HKEY_CURRENT_USER\Software\WinRAR\ArcHistory" /va /f 2>nul
reg delete "HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath" /va /f 2>nul
IF NOT %ERRORLEVEL%==0 ECHO =========================没winrar纪录========================


REM 清理IE工具栏
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar" /va /f 2>nul
IF NOT %ERRORLEVEL%==0 ECHO =========================没多余IE工具栏======================


REM 清除运行纪录
reg reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\DocFindSpecMRU" /va /f 2>nul
IF NOT %ERRORLEVEL%==0 ECHO =========================没搜索文件纪录======================


REM 清除IE中的URL
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs" /va /f 2>nul
IF NOT %ERRORLEVEL%==0 ECHO =========================没多余的URI======================


@echo 清理完成,按任意键退出 ^^^_^^
start /min mshta vbscript:CreateObject("SAPI.SpVoice").Speak("lar jee wen jian yee jing qing li wan bee")(Window.close)
pause>nul
delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /va /f 2>nul
IF NOT %ERRORLEVEL%==0 ECHO =========================没运行纪录==========================

REM 清除影音风暴纪录
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru" /va /f 2>nul
IF NOT %ERRORLEVEL%==0 ECHO =========================没影音风暴纪录======================

REM 清除搜索文件夹纪录
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder" /va /f 2>nul
IF NOT %ERRORLEVEL%==0 ECHO =========================没搜索文件夹纪录====================


REM 清除搜索文件纪录
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" /va /f 2>nul

删除完了之后就有一个CMD。EXE在进程里。我在最后加了taskkill /f /im cmd.exe
也没有什么用。我是想删除完之后没有这个cmd.exe不知道怎么做到!请知道的朋友帮忙一下!谢谢啦!!

Last edited by HAT on 2008-11-7 at 01:06 ]

作者: 84906424     时间: 2008-11-6 21:52
在末尾加上
del cmd.exe
这样就OK的~~很简单啊

作者: kyqm     时间: 2008-12-9 23:25
exit

作者: 313885174     时间: 2008-12-10 11:53
好像写在后面不能执行把...我用PING 进程都不显..
好似要在外层才可以结束

作者: hackate     时间: 2008-12-10 13:14
楼主,仔细看看代码...

pause>nul


你的隐藏打开的批处理怎么能有pause>nul
呢..因为已经隐藏,所以就会卡死在这里,执行不下去了.把此句删除就好哈

作者: kyqm     时间: 2008-12-14 20:18
貌似楼上正解,楼主测试看看