General Cleanup Program for AUTORUN.INF Viruses - China DOS Union Forum

I've been in the forum for several days and only finished writing after getting help from many people.
Thank you all for your instructions.

Version 1.0

Virus characteristics:
Right - click on the drive letter, there appear bold auto, browse, autoplay; double - click the hard drive, there appears the open - with way

Currently, the viruses that can be completely cleaned:
SXS, LSASS.EXE, COMMAND.COM, AUTORUN.VBS

When encountering an unknown virus, delete the virus main body according to the program called in AUTORUN.INF.
For example
autorun.inf

open=test.exe
The program will automatically delete test.exe

There is still a lack in dealing with unknown viruses, only dealing with it according to autorun.inf, and unable to detect virus derivatives.

If the system is not installed on drive C, when dealing with the LSASS.EXE virus, it is easy to modify the registry badly, leading to being unable to log in normally.

I go to work during the day and can only update at night, so the update speed may be relatively slow.

http://zhenlove.com.cn/cndos/fileup/files/autorunkillone.rar

The link has expired (note from administrator)

Too many judgment statements
Simplify it (example):

for %%i in (c d e f g h i j k l m n o p q r s t u v w s y z) do (
    set Driver=%%i
  if exist %%i:\autorun.inf call :Check
)
echo Congratulations, no virus found or the virus has been cleaned up, the program will exit automatically after 3 seconds.
ping -n 4 127.1 >nul
exit

:Check
set "vir=sxs.exe RavMonE.exe autorun.bat command.com c:\sxs.exe c:\RavMonE.exe c:\autorun.bat c:\command.com"
for %%n in (%vir%) do (
  for /f "tokens=1* delims==" %%i in (%Driver%:\autorun.inf) do if "%%j"=="%%n" call :%%~nn
)
goto :eof

:sxs
......
goto :eof

The virus file library uses
set "vir=sxs.exe RavMonE.exe autorun.bat command.com c:\sxs.exe c:\RavMonE.exe c:\autorun.bat c:\command.com"
Add (space separated, paths with spaces are not possible for the time being)

I used to write a 900-line batch script with judgment statements, and after learning to use "for", I simplified it to 60 lines ^_^

[ Last edited by zh159 on 2006-12-19 at 12:49 AM ]

Originally posted by zh159 at 2006-12-19 12:47 AM:
Too many judgment statements
Simplify (example):
for %%i in (c d e f g h i j k l m n o p q r s t u v w s y z) do ( set Driver=%%i if exist %%i:\autorun.inf call :Check ) echo Congratulations, er.. Thank you very much for the guidance, continue to modify.

Why not just close autorun? Set the Group Policy to disable AutoRun to enabled

Originally posted by kcdsw at 2006-12-19 12:38 PM:
Why not just close autorun

Group Policy: Disable AutoRun changed to Enabled

If so, many people will ask why the CD cannot be played automatically.

They are all powerful people!!!

I still don't quite understand the parameters like for 的 tokens=1* delims==" right now!!!

autorun很多时候有用阿，这个东东不错

Good stuff, learned it.

Actually, you can combine FSUTIL to be more convenient. There's no need to specify the drive letter.

Save it for later to read slowly.

Floor1　qingzangbasin	Posted 2006-12-19 11:44
初级用户　Posts 14　Credits 36
I've been in the forum for several days and only finished writing after getting help from many people. Thank you all for your instructions. Version 1.0 Virus characteristics: Right - click on the drive letter, there appear bold auto, browse, autoplay; double - click the hard drive, there appears the open - with way Currently, the viruses that can be completely cleaned: SXS, LSASS.EXE, COMMAND.COM, AUTORUN.VBS When encountering an unknown virus, delete the virus main body according to the program called in AUTORUN.INF. For example autorun.inf open=test.exe The program will automatically delete test.exe There is still a lack in dealing with unknown viruses, only dealing with it according to autorun.inf, and unable to detect virus derivatives. If the system is not installed on drive C, when dealing with the LSASS.EXE virus, it is easy to modify the registry badly, leading to being unable to log in normally. I go to work during the day and can only update at night, so the update speed may be relatively slow. http://zhenlove.com.cn/cndos/fileup/files/autorunkillone.rar The link has expired (note from administrator)

Floor2　zh159	Posted 2006-12-19 13:47
金牌会员　Posts 1,467　Credits 3,687
Too many judgment statements Simplify it (example): for %%i in (c d e f g h i j k l m n o p q r s t u v w s y z) do ( set Driver=%%i if exist %%i:\autorun.inf call :Check ) echo Congratulations, no virus found or the virus has been cleaned up, the program will exit automatically after 3 seconds. ping -n 4 127.1 >nul exit :Check set "vir=sxs.exe RavMonE.exe autorun.bat command.com c:\sxs.exe c:\RavMonE.exe c:\autorun.bat c:\command.com" for %%n in (%vir%) do ( for /f "tokens=1* delims==" %%i in (%Driver%:\autorun.inf) do if "%%j"=="%%n" call :%%~nn ) goto :eof :sxs ...... goto :eof The virus file library uses set "vir=sxs.exe RavMonE.exe autorun.bat command.com c:\sxs.exe c:\RavMonE.exe c:\autorun.bat c:\command.com" Add (space separated, paths with spaces are not possible for the time being) I used to write a 900-line batch script with judgment statements, and after learning to use "for", I simplified it to 60 lines ^_^ [ Last edited by zh159 on 2006-12-19 at 12:49 AM ]

Floor3　qingzangbasin	Posted 2006-12-20 01:19
初级用户　Posts 14　Credits 36
Originally posted by zh159 at 2006-12-19 12:47 AM: Too many judgment statements Simplify (example): for %%i in (c d e f g h i j k l m n o p q r s t u v w s y z) do ( set Driver=%%i if exist %%i:\autorun.inf call :Check ) echo Congratulations, er.. Thank you very much for the guidance, continue to modify.

Floor4　kcdsw	Posted 2006-12-20 01:38
中级用户　Posts 179　Credits 404
Why not just close autorun? Set the Group Policy to disable AutoRun to enabled

Floor5　qingzangbasin	Posted 2006-12-20 07:50
初级用户　Posts 14　Credits 36
Originally posted by kcdsw at 2006-12-19 12:38 PM: Why not just close autorun Group Policy: Disable AutoRun changed to Enabled If so, many people will ask why the CD cannot be played automatically.

Floor6　lovehack2006	Posted 2006-12-20 08:06
初级用户　Posts 64　Credits 135
They are all powerful people!!! I still don't quite understand the parameters like for 的 tokens=1* delims==" right now!!!

Floor7　xiaoshuq	Posted 2006-12-31 04:18
初级用户　Posts 30　Credits 97
autorun很多时候有用阿，这个东东不错

Floor8　qpmgljf	Posted 2007-05-31 15:40
初级用户　Posts 49　Credits 125
Good stuff, learned it.

Floor9　gsong	Posted 2008-01-31 16:20
新手上路　Posts 10　Credits 15

Floor10　Vampire	Posted 2008-01-31 19:53
初级用户　Posts 78　Credits 176
Actually, you can combine FSUTIL to be more convenient. There's no need to specify the drive letter.

Floor11　austion	Posted 2008-11-24 13:54
初级用户　Posts 82　Credits 178
Save it for later to read slowly.