Batch delete virus that deletes all specific files with the same name on the hard drive - China DOS Union Forum

Originally posted by bosskof at 2006-9-22 05:10:
Why not del /s/a _desktop.ini under the drive letter? del /?

Indeed, it's much simpler than finding and deleting first!

Although you can execute the del statement under each drive letter, but doing so loses the advantage of batch processing automatically and batch handling problems.

My computer has also been infected with this hateful virus. In fact, _desktop.ini is a text file, and it can't be the root of the virus. No matter what techniques are used to delete _desktop.ini, it can't completely eliminate the root cause. The real virus roots are in %windir%\rundl132.exe, Logo1_.exe, dll.dll, as well as infected Office program files, QQ, Maxthon, Qianqian Jingting, RealPlayer, etc. As long as these infected software are run, the virus will self-replicate _desktop.ini again... The following is the manual removal method excerpted from the Internet:

　　① End the logo1_.exel and rundl132.exe processes, and delete logo1_.exel and rundl132.exe in %WinDir%;

　　② Find the registry key value: and delete it;

　　③ Find the registry key value rundl132.exe and delete it;

　　④ Restart the computer, do not run any programs, and delete the logo1_.exe, dll.dll, and rundl132.exe files in the C drive;

　　⑤ Uninstall or directly delete the infected QQ, Office series, Qianqian Jingting, RealPlayer, etc., and then reinstall them;

　　⑥ When installing the above software, make sure that the installation program is virus-free. When I reinstalled Office, I found that the Office installation program backed up in the hard drive was also infected with the virus, so I had to find a virus-free Office installation CD to install again.

　　⑦ When installing the program, always open the registry editor to check whether

Here I would like to add that there is another characteristic when this virus attacks: after an exe program is infected, the icon of this exe will become messy (such as ttplayer.exe), or the original true color icon will become a 16-color icon (such as QQ.exe). So if you see some exe icons suddenly have this change in "My Computer", it is very likely that the computer is infected with a virus.

for %%i (c d e f g h i j k l m n) do del /ash /s/q %%i:\_desktop.ini

Alas~ my computer also got this virus. At first I thought it was a system file!
Then later I found that the printer would print by itself, and on each printed paper there was only a line of date at the top, with nothing else. It was a waste of paper. I couldn't find the reason, so I GHOSTed the system, but the _desktop.ini file was still on other disks...
Learned something new.

The code of the moderator and a concise piece of code didn't work for me here! The one from pengfei can be deleted. Passed

The fsutil command must be run with administrator privileges.

for %%i in (c d e f g h i j k l m n o p q r s t u v w x y z) do del /a /s /f /s/q %%i:\_desktop.ini

[ Last edited by qwe1234567 on 2006-10成-14 at 10:19 ]

fsutil command is not available in 2000

Originally posted by qwe1234567 at 2006-10-14 09:22:
for %%i (c d e f g h i j k l m n o p q r s t u v w x y z) do del /a /s /f /s/q %%i:\_desktop.ini

　　The for command of moderator qwe1234567 seems to be missing an "in"?

It was missing an IN, and now it's added.

The two batch files above, I only understand a little bit of each. Hey... it's powerful!

Originally posted by 3742668 at 2006-9-22 12:53 AM:
wmic datafile where "filename='desktop' and Extension='ini'" call delete /NOINTERACTIVE

The moderator's code is indeed quite concise, but I have a question. Why does it seem to work on some computers but not on others, and it prompts "No applicable instances found" on some? Both are XP SP2 systems, and the file does exist!
I hope an expert can give me some pointers?

Floor16　pengfei	Posted 2006-09-22 09:40
银牌会员　Posts 485　Credits 1,218　From 湖南.娄底
Originally posted by bosskof at 2006-9-22 05:10: Why not del /s/a _desktop.ini under the drive letter? del /? Indeed, it's much simpler than finding and deleting first!

Floor17　namejm	Posted 2006-09-22 09:49
荣誉版主　Posts 1,737　Credits 5,226　From 成都
Although you can execute the del statement under each drive letter, but doing so loses the advantage of batch processing automatically and batch handling problems.

Floor18　JonePeng	Posted 2006-09-22 10:55
金牌会员　Posts 1,883　Credits 4,562　From 广东广州
My computer has also been infected with this hateful virus. In fact, _desktop.ini is a text file, and it can't be the root of the virus. No matter what techniques are used to delete _desktop.ini, it can't completely eliminate the root cause. The real virus roots are in %windir%\rundl132.exe, Logo1_.exe, dll.dll, as well as infected Office program files, QQ, Maxthon, Qianqian Jingting, RealPlayer, etc. As long as these infected software are run, the virus will self-replicate _desktop.ini again... The following is the manual removal method excerpted from the Internet: 　　① End the logo1_.exel and rundl132.exe processes, and delete logo1_.exel and rundl132.exe in %WinDir%; 　　② Find the registry key value: and delete it; 　　③ Find the registry key value rundl132.exe and delete it; 　　④ Restart the computer, do not run any programs, and delete the logo1_.exe, dll.dll, and rundl132.exe files in the C drive; 　　⑤ Uninstall or directly delete the infected QQ, Office series, Qianqian Jingting, RealPlayer, etc., and then reinstall them; 　　⑥ When installing the above software, make sure that the installation program is virus-free. When I reinstalled Office, I found that the Office installation program backed up in the hard drive was also infected with the virus, so I had to find a virus-free Office installation CD to install again. 　　⑦ When installing the program, always open the registry editor to check whether Here I would like to add that there is another characteristic when this virus attacks: after an exe program is infected, the icon of this exe will become messy (such as ttplayer.exe), or the original true color icon will become a 16-color icon (such as QQ.exe). So if you see some exe icons suddenly have this change in "My Computer", it is very likely that the computer is infected with a virus.

Floor19　xg911335	Posted 2006-09-22 11:50
初级用户　Posts 50　Credits 134
for %%i (c d e f g h i j k l m n) do del /ash /s/q %%i:\_desktop.ini

Floor20　jieok3375	Posted 2006-10-09 00:48
中级用户　Posts 130　Credits 282　From 广东
Alas~ my computer also got this virus. At first I thought it was a system file! Then later I found that the printer would print by itself, and on each printed paper there was only a line of date at the top, with nothing else. It was a waste of paper. I couldn't find the reason, so I GHOSTed the system, but the _desktop.ini file was still on other disks... Learned something new.

Floor21　qcqtye	Posted 2006-10-14 07:46
初级用户　Posts 14　Credits 26
The code of the moderator and a concise piece of code didn't work for me here! The one from pengfei can be deleted. Passed

Floor22　namejm	Posted 2006-10-14 08:25
荣誉版主　Posts 1,737　Credits 5,226　From 成都
The fsutil command must be run with administrator privileges.

Floor23　不得不爱	Posted 2006-10-14 09:22
超级版主　Posts 2,044　Credits 5,310　From 四川南充
for %%i in (c d e f g h i j k l m n o p q r s t u v w x y z) do del /a /s /f /s/q %%i:\_desktop.ini [ Last edited by qwe1234567 on 2006-10成-14 at 10:19 ]

Floor24　不得不爱	Posted 2006-10-14 09:38
超级版主　Posts 2,044　Credits 5,310　From 四川南充
fsutil command is not available in 2000

Floor25　lxmxn	Posted 2006-10-14 10:09
版主　Posts 4,938　Credits 11,386
Originally posted by qwe1234567 at 2006-10-14 09:22: for %%i (c d e f g h i j k l m n o p q r s t u v w x y z) do del /a /s /f /s/q %%i:\_desktop.ini 　　The for command of moderator qwe1234567 seems to be missing an "in"?

Floor26　不得不爱	Posted 2006-10-14 10:20
超级版主　Posts 2,044　Credits 5,310　From 四川南充
It was missing an IN, and now it's added.

Floor27　sanhu35	Posted 2006-10-25 11:08
初级用户　Posts 15　Credits 31
The two batch files above, I only understand a little bit of each. Hey... it's powerful!

Floor28　regvip2008	Posted 2008-03-05 12:42
初级用户　Posts 87　Credits 187
Originally posted by 3742668 at 2006-9-22 12:53 AM: wmic datafile where "filename='desktop' and Extension='ini'" call delete /NOINTERACTIVE The moderator's code is indeed quite concise, but I have a question. Why does it seem to work on some computers but not on others, and it prompts "No applicable instances found" on some? Both are XP SP2 systems, and the file does exist! I hope an expert can give me some pointers?