为了搞定我们这里的logo_1(威金)病毒.我费了好大功夫写了个批处理,因能力有限,还有很多不明之处,请大家指教!!
@echo off
net share c$ /del
net share d$ /del
net share e$ /del
net share f$ /del
net share admin$ /del
net share ipc$ /del
wmic process where name="logo1_.exe" call terminate
wmic process where name="rundl132.exe" call terminate
wmic process where name="0Sy.exe" call terminate
wmic process where name="1Sy.exe" call terminate
wmic process where name="2Sy.exe" call terminate
wmic process where name="3Sy.exe" call terminate
taskkill /fi "imagename eq 4Sy.exe"
taskkill /fi "imagename eq 5Sy.exe"
taskkill /fi "imagename eq 6Sy.exe"
taskkill /fi "imagename eq 7Sy.exe"
taskkill /fi "imagename eq 8Sy.exe"
taskkill /fi "imagename eq 9Sy.exe"
wmic process where name="VM_STI.ESE" call terminate
wmic process where name="svchsOt.exe" call terminate
wmic process where name="svchs0t.exe" call terminate
wmic process where name="logo1_.exe" call terminate
wmic process where name="rundl132.exe" call terminate
del c:\windows\logo1_.exe
del c:\windows\rundl132.exe
del c:\windows\0Sy.exe
del c:\windows\1Sy.exe
del c:\windows\2Sy.exe
del c:\windows\3Sy.exe
del c:\windows\4Sy.exe
del c:\windows\5Sy.exe
del c:\windows\6Sy.exe
del c:\windows\7Sy.exe
del c:\windows\8Sy.exe
del c:\windows\9Sy.exe
del c:\windows\logo1_.exe
del c:\windows\rundl132.exe
del c:\windows\svchsO.exe
del c:\windows\svchs0.exe
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v load
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Soft\DownloadWWW /v auto
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows /v ver_down0
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows /v ver_down1
pause
taskkill /fi "imagename eq cmd.exe"
taskkill /fi "imagename eq cmd.exe"
刚才测试开机运行一切还算正常,但是问题立马出来了,这个病毒是通过局网传播的,就算开机OK,但是过一会又会被网内其他的机器连累了.
该怎么办?总不能十分钟运行一次吧!
上次把网内机器的挨个清了一次(将近八十台啊,累的我~~~),暂时OK了
不到一天,又有了!!
该怎么办啊??同志们帮帮俺啊!!!
[ Last edited by chineselgs on 2006-6-10 at 13:47 ]
@echo off
net share c$ /del
net share d$ /del
net share e$ /del
net share f$ /del
net share admin$ /del
net share ipc$ /del
wmic process where name="logo1_.exe" call terminate
wmic process where name="rundl132.exe" call terminate
wmic process where name="0Sy.exe" call terminate
wmic process where name="1Sy.exe" call terminate
wmic process where name="2Sy.exe" call terminate
wmic process where name="3Sy.exe" call terminate
taskkill /fi "imagename eq 4Sy.exe"
taskkill /fi "imagename eq 5Sy.exe"
taskkill /fi "imagename eq 6Sy.exe"
taskkill /fi "imagename eq 7Sy.exe"
taskkill /fi "imagename eq 8Sy.exe"
taskkill /fi "imagename eq 9Sy.exe"
wmic process where name="VM_STI.ESE" call terminate
wmic process where name="svchsOt.exe" call terminate
wmic process where name="svchs0t.exe" call terminate
wmic process where name="logo1_.exe" call terminate
wmic process where name="rundl132.exe" call terminate
del c:\windows\logo1_.exe
del c:\windows\rundl132.exe
del c:\windows\0Sy.exe
del c:\windows\1Sy.exe
del c:\windows\2Sy.exe
del c:\windows\3Sy.exe
del c:\windows\4Sy.exe
del c:\windows\5Sy.exe
del c:\windows\6Sy.exe
del c:\windows\7Sy.exe
del c:\windows\8Sy.exe
del c:\windows\9Sy.exe
del c:\windows\logo1_.exe
del c:\windows\rundl132.exe
del c:\windows\svchsO.exe
del c:\windows\svchs0.exe
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v load
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Soft\DownloadWWW /v auto
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows /v ver_down0
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows /v ver_down1
pause
taskkill /fi "imagename eq cmd.exe"
taskkill /fi "imagename eq cmd.exe"
刚才测试开机运行一切还算正常,但是问题立马出来了,这个病毒是通过局网传播的,就算开机OK,但是过一会又会被网内其他的机器连累了.
该怎么办?总不能十分钟运行一次吧!
上次把网内机器的挨个清了一次(将近八十台啊,累的我~~~),暂时OK了
不到一天,又有了!!
该怎么办啊??同志们帮帮俺啊!!!
[ Last edited by chineselgs on 2006-6-10 at 13:47 ]
饮马恒河畔，剑指天山西,碎叶城揽月，库叶岛赏雪,黑海之滨垂钓，贝尔加湖面张弓；中南半岛访古，东京废墟祭祖!
