标题: [原创]处理常见病毒并自动免疫打补丁批处理改进版 [打印本页]
作者: qasa 时间: 2007-1-24 09:50 标题: [原创]处理常见病毒并自动免疫打补丁批处理改进版
我就原来的程序上改进了一下，加入了生成“拒绝访问”的假病毒文件。
代码如下，望高人指点一二，谢谢
禁用病毒.bat
@set dbg=
@echo %dbg% off&&setlocal EnableDelayedExpansion
::code by qasa copyright@qknet 1:00 2007-1-23
mode con cols=45 lines=20&color c
set no_=0
set ko_=0
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /f >nul 2>nul
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v "DisallowRun" /t REG_DWORD /d 1 /f >nul 2>nul
echo 正在检查进程中是否有可疑文件运行......
for /f "delims=" %%e in (disable.ini) do (
tasklist|find /i "%%e"&&echo 发现可疑进程 %%e
taskkill /f /im %%e>nul 2>>nul&&echo 已经结束可疑进程 %%e
)
echo.&echo 进程检查结束, 开始导入禁止运行表......
for /f "delims=" %%i in (disable.ini) do (
if %%i neq setup.exe (reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v !no_! /d %%i /f >nul)
set /a no_+=1
)
echo.&echo 有 !no_! 个怀疑病毒文件被列入禁止运行表。
echo.&echo 正在创建病毒免疫文件......
for /f "delims=" %%p in (logo.txt) do (
if exist %%p (
cacls %%p /e /t /p everyone:F >nul 2>nul
attrib -r -s -h -a %%p >nul 2>nul
del /q %%p >nul 2>nul
rd /q %%p>nul
)
md %%p&attrib +s +r +h +a %%p >nul 2>nul
cacls %%p /e /t /d everyone >nul 2>nul
)
echo.&echo 正在安装系统安全补丁包......
for %%1 in (*.exe) do (
%%1 /quiet /passive /norestart /nobackup
set /a ko_+=1
)
echo.&echo 共有 !ko_! 个补丁安装完毕。
ping/n 5 127.1>nul
exit/b
@echo %dbg% off&&setlocal EnableDelayedExpansion
::code by qasa copyright@qknet 1:00 2007-1-23
mode con cols=45 lines=20&color c
set no_=0
set ko_=0
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /f >nul 2>nul
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v "DisallowRun" /t REG_DWORD /d 1 /f >nul 2>nul
echo 正在检查进程中是否有可疑文件运行......
for /f "delims=" %%e in (disable.ini) do (
tasklist|find /i "%%e"&&echo 发现可疑进程 %%e
taskkill /f /im %%e>nul 2>>nul&&echo 已经结束可疑进程 %%e
)
echo.&echo 进程检查结束, 开始导入禁止运行表......
for /f "delims=" %%i in (disable.ini) do (
if %%i neq setup.exe (reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v !no_! /d %%i /f >nul)
set /a no_+=1
)
echo.&echo 有 !no_! 个怀疑病毒文件被列入禁止运行表。
echo.&echo 正在创建病毒免疫文件......
for /f "delims=" %%p in (logo.txt) do (
if exist %%p (
cacls %%p /e /t /p everyone:F >nul 2>nul
attrib -r -s -h -a %%p >nul 2>nul
del /q %%p >nul 2>nul
rd /q %%p>nul
)
md %%p&attrib +s +r +h +a %%p >nul 2>nul
cacls %%p /e /t /d everyone >nul 2>nul
)
echo.&echo 正在安装系统安全补丁包......
for %%1 in (*.exe) do (
%%1 /quiet /passive /norestart /nobackup
set /a ko_+=1
)
echo.&echo 共有 !ko_! 个补丁安装完毕。
ping/n 5 127.1>nul
exit/b
disable.ini
Netrobocop.exe
cnnetcut151.exe
netcut.exe
wnad.exe
bind_40235.exe
gamesetup.exe
FuckJacks.exe
spoclsv.exe
qq2007.exe
intren0t.exe
devgt.exe
iexpl0re.exe
svohost.exe
svhost32.exe
setup.exe
svchqst.exe
llssrv.exe
qdoxjq.exe
iedw.exe
res.exe
SVCH0ST.exe
0Sy.exe
1.com
1Sy.exe
2Sy.exe
3Sy.exe
5Sy.exe
6Sy.exe
EXP10RER.com
finders.com
kill.exe
Logo1_.exe
rundl132.exe
7Sy.exe
8Sy.exe
9Sy.exe
exerouter.exe
4Sy.exe
ePower.exe
nvsc.exe
finder.com
pagefile.com
rose.exe
sxs.exe
sys1.exe
DebugProgramme.exe
iexplore.com
Exeroud.exe
a.exe
Mbbmanager.exe
Mdm.exe
Aboutagirl.exe
Microsoft.exe
Absr.exe
Aplica32.exe
Mprdll.exe
Avconsol.exe
Msabel32.exe
Avp.exe
Msblast.exe
Avp32.exe
Mschv.exe
Avpcc.exe
Msgsrv36.exe
Avpm.exe
Msgsvc.exe
Avserve.exe
Msgsvr16.exe
Bbeagle.exe
Msie5.exe
Brainspy.exe
Msstart.exe
Cfiadmin.exe
Mstesk.exe
Cfiaudit.exe
Netip.exe
Cfinet32.exe
Netspy.exe
Checkdll.exe
Notpa.exe
Cmctl32.exe
Odbc.exe
Pcfwallicon.exe
Diagcfg.exe
Pcx.exe
Dkbdll.exe
Pw32.exe
Dllclient.exe
Dvldr32.exe
Regscan.exe
Esafe.exe
Expiorer.exe
Thing.exe
Feweb.exe
Flcss.exe
Vp32.exe
Frw.exe
Vpcc.exe
Icload95.exe
Vpm.exe
Icloadnt.exe
Vsecomr.exe
Icmon.exe
Icsupp95.exe
Rpcsrv.exe
Sockets.exe
Rundll.exe
Something.exe
Spfw.exe
Runouce.exe
Scanrew.exe
Sysedit32.exe
Intel.exe
Syshelp.exe
Internet.exe
Sysprot.exe
Internet.exe
Sysrunt.exe
Kernel16.exe
Kernel32.exe
System32.exe
Kiss.exe
Krn132.exe
Syswindow.exe
Libupdate.exe
Task_Bar.exe
Load.exe
Lockdown2000.exe
Taskmon.exe
Tds2-98.exe
Tds2-Nt.exe
Tempinetb00st.exe
Tempserver.exe
Vshwin32.exe
Vsstart.exe
Vw32.exe
Windown.exe
Windows.exe
Winfunctions.exe
Wingate.exe
Winl0g0n.exe
Winmgm32.exe
Winmsg32.exe
Winprot.exe
Winprotecte.exe
Winrpc.exe
Winrpcsrv.exe
Winserv.exe
Wubsys.exe
Winupdate.exe
Winver.exe
Wqk.exe
Wscan.exe
Xx.Tmp.exe
Zcn32.exe
Zonealarm.exe
cnnetcut151.exe
netcut.exe
wnad.exe
bind_40235.exe
gamesetup.exe
FuckJacks.exe
spoclsv.exe
qq2007.exe
intren0t.exe
devgt.exe
iexpl0re.exe
svohost.exe
svhost32.exe
setup.exe
svchqst.exe
llssrv.exe
qdoxjq.exe
iedw.exe
res.exe
SVCH0ST.exe
0Sy.exe
1.com
1Sy.exe
2Sy.exe
3Sy.exe
5Sy.exe
6Sy.exe
EXP10RER.com
finders.com
kill.exe
Logo1_.exe
rundl132.exe
7Sy.exe
8Sy.exe
9Sy.exe
exerouter.exe
4Sy.exe
ePower.exe
nvsc.exe
finder.com
pagefile.com
rose.exe
sxs.exe
sys1.exe
DebugProgramme.exe
iexplore.com
Exeroud.exe
a.exe
Mbbmanager.exe
Mdm.exe
Aboutagirl.exe
Microsoft.exe
Absr.exe
Aplica32.exe
Mprdll.exe
Avconsol.exe
Msabel32.exe
Avp.exe
Msblast.exe
Avp32.exe
Mschv.exe
Avpcc.exe
Msgsrv36.exe
Avpm.exe
Msgsvc.exe
Avserve.exe
Msgsvr16.exe
Bbeagle.exe
Msie5.exe
Brainspy.exe
Msstart.exe
Cfiadmin.exe
Mstesk.exe
Cfiaudit.exe
Netip.exe
Cfinet32.exe
Netspy.exe
Checkdll.exe
Notpa.exe
Cmctl32.exe
Odbc.exe
Pcfwallicon.exe
Diagcfg.exe
Pcx.exe
Dkbdll.exe
Pw32.exe
Dllclient.exe
Dvldr32.exe
Regscan.exe
Esafe.exe
Expiorer.exe
Thing.exe
Feweb.exe
Flcss.exe
Vp32.exe
Frw.exe
Vpcc.exe
Icload95.exe
Vpm.exe
Icloadnt.exe
Vsecomr.exe
Icmon.exe
Icsupp95.exe
Rpcsrv.exe
Sockets.exe
Rundll.exe
Something.exe
Spfw.exe
Runouce.exe
Scanrew.exe
Sysedit32.exe
Intel.exe
Syshelp.exe
Internet.exe
Sysprot.exe
Internet.exe
Sysrunt.exe
Kernel16.exe
Kernel32.exe
System32.exe
Kiss.exe
Krn132.exe
Syswindow.exe
Libupdate.exe
Task_Bar.exe
Load.exe
Lockdown2000.exe
Taskmon.exe
Tds2-98.exe
Tds2-Nt.exe
Tempinetb00st.exe
Tempserver.exe
Vshwin32.exe
Vsstart.exe
Vw32.exe
Windown.exe
Windows.exe
Winfunctions.exe
Wingate.exe
Winl0g0n.exe
Winmgm32.exe
Winmsg32.exe
Winprot.exe
Winprotecte.exe
Winrpc.exe
Winrpcsrv.exe
Winserv.exe
Wubsys.exe
Winupdate.exe
Winver.exe
Wqk.exe
Wscan.exe
Xx.Tmp.exe
Zcn32.exe
Zonealarm.exe
logo.txt
C:\WINDOWS\0Sy.exe
C:\WINDOWS\1.com
C:\WINDOWS\1Sy.exe
C:\WINDOWS\2Sy.exe
C:\WINDOWS\3Sy.exe
C:\WINDOWS\5Sy.exe
C:\WINDOWS\6Sy.exe
C:\WINDOWS\EXP10RER.com
C:\WINDOWS\finders.com
C:\WINDOWS\kill.exe
C:\WINDOWS\Logo1_.exe
C:\WINDOWS\rundl132.exe
C:\WINDOWS\Shell.sys
C:\WINDOWS\smss.exe
C:\WINDOWS\smss.exe
C:\WINDOWS\sws.dll
C:\WINDOWS\sws32.dll
C:\WINDOWS\tool.exe
C:\WINDOWS\tool2005.exe
C:\WINDOWS\tool2006.exe
C:\WINDOWS\tools.exe
C:\WINDOWS\vDll.dll
C:\WINDOWS\7Sy.exe
C:\WINDOWS\8Sy.exe
C:\WINDOWS\9Sy.exe
C:\WINDOWS\exerouter.exe
C:\WINDOWS\4Sy.exe
C:\WINDOWS\system32\Logo1_.exe
c:\windows\system32\ePower.exe
c:\windows\system32\dllhost.dll
c:\windows\system32\nvsc.exe
c:\WINDOWS\finder.com
D:\pagefile.com
D:\autorun.inf
D:\rose.exe
D:\sxs.exe
D:\xcopy.exe
D:\setup.exe
D:\go.exe
D:\update.exe
E:\pagefile.com
E:\autorun.inf
E:\rose.exe
E:\sxs.exe
E:\xcopy.exe
E:\setup.exe
E:\go.exe
E:\update.exe
C:\Progra~1\Intern~1\sys1.exe
C:\WINDOWS\Debug\DebugProgramme.exe
C:\Progra~1\Common~1\iexplore.com
C:\WINDOWS\Exeroud.exe
C:\Windows\system32\a.exe
C:\WINDOWS\System32\Drivers\spoclsv.exe
C:\WINDOWS\System32\Drivers\nvscv32.exe
C:\WINDOWS\MY.exe
C:\WINDOWS\iexpl0re.exe
C:\WINDOWS\System32\spcolsv.exe
C:\windows\winlogon.exe
C:\Windows\intren0t.exe
C:\Windows\system32\res.exe
C:\Windows\system32\winsocks.dll
C:\WINDOWS\system32\FuckJacks.exe
C:\WINDOWS\system32\SVCH0ST.exe
C:\WINDOWS\1.com
C:\WINDOWS\1Sy.exe
C:\WINDOWS\2Sy.exe
C:\WINDOWS\3Sy.exe
C:\WINDOWS\5Sy.exe
C:\WINDOWS\6Sy.exe
C:\WINDOWS\EXP10RER.com
C:\WINDOWS\finders.com
C:\WINDOWS\kill.exe
C:\WINDOWS\Logo1_.exe
C:\WINDOWS\rundl132.exe
C:\WINDOWS\Shell.sys
C:\WINDOWS\smss.exe
C:\WINDOWS\smss.exe
C:\WINDOWS\sws.dll
C:\WINDOWS\sws32.dll
C:\WINDOWS\tool.exe
C:\WINDOWS\tool2005.exe
C:\WINDOWS\tool2006.exe
C:\WINDOWS\tools.exe
C:\WINDOWS\vDll.dll
C:\WINDOWS\7Sy.exe
C:\WINDOWS\8Sy.exe
C:\WINDOWS\9Sy.exe
C:\WINDOWS\exerouter.exe
C:\WINDOWS\4Sy.exe
C:\WINDOWS\system32\Logo1_.exe
c:\windows\system32\ePower.exe
c:\windows\system32\dllhost.dll
c:\windows\system32\nvsc.exe
c:\WINDOWS\finder.com
D:\pagefile.com
D:\autorun.inf
D:\rose.exe
D:\sxs.exe
D:\xcopy.exe
D:\setup.exe
D:\go.exe
D:\update.exe
E:\pagefile.com
E:\autorun.inf
E:\rose.exe
E:\sxs.exe
E:\xcopy.exe
E:\setup.exe
E:\go.exe
E:\update.exe
C:\Progra~1\Intern~1\sys1.exe
C:\WINDOWS\Debug\DebugProgramme.exe
C:\Progra~1\Common~1\iexplore.com
C:\WINDOWS\Exeroud.exe
C:\Windows\system32\a.exe
C:\WINDOWS\System32\Drivers\spoclsv.exe
C:\WINDOWS\System32\Drivers\nvscv32.exe
C:\WINDOWS\MY.exe
C:\WINDOWS\iexpl0re.exe
C:\WINDOWS\System32\spcolsv.exe
C:\windows\winlogon.exe
C:\Windows\intren0t.exe
C:\Windows\system32\res.exe
C:\Windows\system32\winsocks.dll
C:\WINDOWS\system32\FuckJacks.exe
C:\WINDOWS\system32\SVCH0ST.exe
删除免疫文件.bat
@echo off
echo.&echo 正在删除病毒免疫文件......
for /f "delims=" %%p in (logo.txt) do (
if exist %%p (
cacls %%p /e /t /p everyone:F >nul 2>nul
attrib -r -s -h -a %%p >nul 2>nul
del /q %%p >nul 2>nul
rd /q %%p>nul
)
)
echo.&echo 正在删除病毒免疫文件......
for /f "delims=" %%p in (logo.txt) do (
if exist %%p (
cacls %%p /e /t /p everyone:F >nul 2>nul
attrib -r -s -h -a %%p >nul 2>nul
del /q %%p >nul 2>nul
rd /q %%p>nul
)
)
[ Last edited by qasa on 2007-1-25 at 04:24 PM ]
附件 1:禁用病毒.part1.rar (2007-1-25 16:23, 185.55 K, 下载附件所需积分 1点 ,下载次数： 371)
附件 2:
附件 3:
作者: qasa 时间: 2007-1-24 09:58
好用之余别忘了加分支持，谢谢~~~~~~~~~~~~:D
附件4:
[ Last edited by qasa on 2007-1-25 at 04:24 PM ]
附件 1:
作者: qasa 时间: 2007-1-24 11:50
经测试，对目前已经染毒的电脑有用，现在我在正一台已经中毒（中的是熊猫烧香），还没有杀毒的机子上发表这贴子的，哈哈。
作者: kkkxtl 时间: 2007-1-25 00:34
进程文件: mdm or mdm.exe
进程名称: Machine Debug Manager
描 述: Debug除错管理用于调试应用程序和Microsoft Office中的Microsoft Script Editor脚本编辑器
用程序名字做查找对象.不可取
作者: tashaxin 时间: 2007-1-25 06:07
很好！支持！·
作者: lzmyst 时间: 2007-1-25 06:23
很多病毒都是取和系统进程相同的文件名；
用文件名查找，真的不可取。
作者: qasa 时间: 2007-1-25 16:26
呵呵，楼上的说得有道理，所以我修改了一下，请重新下载测试，谢谢
作者: kkkxtl 时间: 2007-1-25 23:16
我到是有个建议..但是工作量会加大....在杀毒望站找流行病毒的资料.就能判断出病毒主程序,主程序一般不会和系统程序同名.以免起冲突暴露自己..但是主程序会释放病毒程序可能会和主程序同名或者感染住程序...所以封闭病毒主程序是第一点,另外我的脚本也是和你的一样..给你看看我的脚本...我那个也是不可取的.呵呵
:D
@echo ***********************************************************
@echo * 软件矫正完毕,按任意键执行免疫程序！ *
@echo ***********************************************************
@echo Windows Registry Editor Version 5.00>Fix.reg
@echo [HKEY_CURRENT_USER\Control Panel\Desktop]>>Fix.reg
@echo "AutoEndTasks"="1">>Fix.reg
@echo "HungAppTimeout"="200">>Fix.reg
@echo "WaitToKillAppTimeout"="200">>Fix.reg
@echo "WaitTOKillService"="200">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]>>Fix.reg
@echo "WaitToKillServiceTimeout"="200">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters]>>Fix.reg
@echo "EnablePrefetcher"=dword:00000001>>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]>>Fix.reg
@echo "SFCDisable"=dword:00000001>>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AlwaysUnloadDLL]>>Fix.reg
@echo @="0">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]>>Fix.reg
@echo "AutoShareServer"=dword:00000000>>Fix.reg
@echo "AutoSharewks"=dword:00000000>>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Windows]>>Fix.reg
@echo "NoPopUpsOnBoot"=dword:00000001>>Fix.reg
@echo [HKEY_CLASSES_ROOT\lnkfile]>>Fix.reg
@echo @="快捷方式">>Fix.reg
@echo "EditFlags"=dword:00000001>>Fix.reg
@echo "NeverShowExt"="">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RemoteComputer\NameSpace]>>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RemoteComputer\NameSpace\{2227A280-3AEA-1069-A2DE-08002B30309D}]>>Fix.reg
@echo @="Printers">>Fix.reg
@echo [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer]>>Fix.reg
@echo "Link"=hex:00,00,00,00>>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters]>>Fix.reg
@echo "EnablePrefetcher"=dword:00000003>>Fix.reg
@echo [HKEY_USERS\.DEFAULT\Control Panel\Desktop]>>Fix.reg
@echo "FontSmoothing"="2">>Fix.reg
@echo "FontSmoothingType"=dword:00000002>>Fix.reg
@echo [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]>>Fix.reg
@echo "MaxConnectionsPer1_0Server"=dword:00000008>>Fix.reg
@echo "MaxConnectionsPerServer"=dword:00000008>>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control]>>Fix.reg
@echo "WaitToKillServiceTimeout"="1000">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Shareaza.exe]>>Fix.reg
@echo "Debugger"="c:\\中国超级BT.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\4047.exe]>>Fix.reg
@echo "Debugger"="c:\\中国超级BT捆绑的病毒.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TuoTu.exe]>>Fix.reg
@echo "Debugger"="c:\\P2P类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qqfo1.0_dl.exe]>>Fix.reg
@echo "Debugger"="c:\\P2P类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SuperLANadmin.exe]>>Fix.reg
@echo "Debugger"="c:\\破坏类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Robocop.exe]>>Fix.reg
@echo "Debugger"="c:\\破坏类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diaoxian.exe]>>Fix.reg
@echo "Debugger"="c:\\破坏类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network.exe]>>Fix.reg
@echo "Debugger"="c:\\破坏类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\冰点还原终结者.exe]>>Fix.reg
@echo "Debugger"="c:\\破坏类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3389.exe]>>Fix.reg
@echo "Debugger"="c:\\破坏类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3389.rar]>>Fix.reg
@echo "Debugger"="c:\\破坏类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sc.exe]>>Fix.reg
@echo "Debugger"="c:\\破坏类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstsc.exe]>>Fix.reg
@echo "Debugger"="c:\\破坏类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3389dl.exe]>>Fix.reg
@echo "Debugger"="c:\\破坏类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3389dl.rar]>>Fix.reg
@echo "Debugger"="c:\\破坏类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\黑社会.exe]>>Fix.reg
@echo "Debugger"="c:\\破坏类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\还原精灵密码察看器.exe]>>Fix.reg
@echo "Debugger"="bcvb">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmcc.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bczp.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3721.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PodcastBarMiniStarter.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdnns.dll]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdnns.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setupcnnic.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieup.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SurfingPlus.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ok.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\123.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieup.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IESearch.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSC32.dll]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZComService.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\skin.dll]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrvIst.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSIF1.tmp]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetMon.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LanecatTrial.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LEC_Client.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BTBaby.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebThunder1.0.4.28deluxbeta.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebThunder.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thunder5.1.6.198.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ThunderMini2.0.0.29.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\is-TEQG7.tmp]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TingTing1.1.0.8Beta.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\is-C6R99.tmp]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\is-00KC0.tmp]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BitComet_0.68_setup.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BitComet.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BitComet0.62.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\100baoSetup120.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GLBD.tmp]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DDD4_DXT168.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppstreamsetup.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PPStream.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TV100.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\is-S5LOA.tmp]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\is-S5L0A.tmp]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\teng.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TENG.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\is-RP216.tmp]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rongtv.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hjsetup.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HJSETUP.EXE]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rep.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dudupros.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DuDuAcc.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Dmad-install.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\D-mad.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\004-PPGou-Dmad.EXE]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PPGou.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDUpdate.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PodcastBarMini.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MyShares.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vfp02.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\is-5SKT1.tmp]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bgoomain.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup_L0029.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ns40.tmp]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1032.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yAssistSe.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ddos.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BitTorrent.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwtsn32.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Win98局域网攻击工具.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetThief.exe]>>Fix.reg
@echo "Debugger"="c:\\网络神偷.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RemoteComputer.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQTailer.exe]>>Fix.reg
@echo "Debugger"="c:\\制造出来的QQ病毒.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\傀儡僵尸DDOS攻击集合.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Alchem.exe]>>Fix.reg
@echo "Debugger"="c:\\以下是存在风险病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\actalert.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adaware.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aqadcup.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\archive.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arr.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ARUpdate.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\asm.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avserve.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avserve2.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\backWeb.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bargains.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\basfipm.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\belt.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Biprep.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blss.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bokja.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootconf.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpc.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brasil.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BRIDGE.DLL]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Buddy.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BUGSFIX.EXE]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundle.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bvt.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cashback.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdaEngine.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd32.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmesys.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conime.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\conscorr.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crss.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cxtpls.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\datemanager.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dcomx.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Desktop.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\directs.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dllreg.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dmserver.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpi.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dssagent.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvdkeyauth.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\emsw.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exdl.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exec.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXP.EXE]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explore.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explored.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Fash.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logo_1.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logo_2.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\worm.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\worm.htm]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1_.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\2_.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3_.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pif.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FuckJacks.exe]>>Fix.reg
@echo "Debugger"="c:\\病毒类.exe">>Fix.reg
@echo.
@pause
start /w regedit /s Fix.reg
del Fix.reg
作者: kkkxtl 时间: 2007-1-25 23:24
当然.我那个是给网吧做母盘用到的东西...网吧要求高的什么都要禁止掉..有些可以针对程序EXE
作者: qasa 时间: 2007-1-26 00:48
谢谢楼上提供的这个方案，我可以把你这个方案的工作量减少，有空的话我改好了再放上来。
作者: zhenyun168 时间: 2007-1-27 13:32
好东西~学习~~~
作者: mmx525100 时间: 2007-1-27 23:25
ddddddddddddddddddddddddd学习了
作者: theoldman 时间: 2007-1-31 00:27
好像看天书：（
作者: juwenbin 时间: 2007-1-31 22:47
好东西~学习学习
作者: electronixtar 时间: 2007-2-1 01:27
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
这个重复了那么次，用一个 %RegPath% 代替不是可以省多少事啊
作者: flykiss8 时间: 2007-2-1 01:49
太厉害了~ 我一点也看不懂~
作者: senffon 时间: 2007-2-1 06:20
@echo off
title 流氓程序限制工具
cls
color 1f
echo.
echo 流氓程序限制工具
echo =========================================================
echo.
echo ★★★★★ 杀人免口 居家必备 ★★★★★
echo.
echo 禁止流氓程序的运行可以让系统更加稳定快速，避免个人隐私泄露，
echo 节省大量系统资源，增强系统安全性，对系统及正常程序的运行没有
echo 任何负面影响！
echo.
echo 【注意】
echo ----------------------------------------------------------
echo ①铲除流氓，人人有责，因此暂不提供卸载！
echo ②已经中毒的系统请设置后立即重启。
echo ③工具制作人仅提供工具功能模块，不对列表内容负任何责任。
echo ----------------------------------------------------------
echo.
echo. 请按任一键开始对流氓程序进行免疫
echo 正在限制流氓程序的运行,请稍候……
set KEY=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
for /F %%a in (\\bxpgame\cscript$\rogulist.txt) do reg add "%KEY%\%%a" /v Debugger /d svchost.exe /f &echo %%a 免疫成功!
REG DELETE "%key%\pig.exe" /f
REG DELETE "%key%\game.exe" /f
REG DELETE "%key%\conime.exe" /f
echo.
echo 限制流氓程序设置完成！任意键退出！
exit
作者: senffon 时间: 2007-2-1 11:48 标题: 做了点小小的改进!不用MD,而用COPY NUL
@echo off
title 流行病毒免疫程序
@set dbg=
@echo %dbg% off&&setlocal EnableDelayedExpansion
mode con cols=35 lines=30&color 0b
set no_=0
set ko_=0
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /f >nul 2>nul
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v "DisallowRun" /t REG_DWORD /d 1 /f >nul 2>nul
@echo.
echo 正在检测是否有可疑进程......
for /f "delims=" %%e in (disable.ini) do (
tasklist|find /i "%%e"&&echo 发现可疑进程 %%e
taskkill /f /im %%e>nul 2>>nul&&echo 已经结束可疑进程 %%e
)
echo.&echo 进程检查结束, 开始导入禁止运行表......
for /f "delims=" %%i in (disable.ini) do (
if %%i neq setup.exe (reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v !no_! /d %%i /f >nul)
set /a no_+=1
)
echo.&echo 有 !no_! 个怀疑病毒文件被列入禁止运行表。
echo.&echo 正在创建病毒免疫文件......
for /f "delims=" %%p in (logo.txt) do (
if exist %%p (
cacls %%p /e /t /p everyone:F >nul
attrib -r -s -h -a %%p >nul 2>nul
del /q %%p >nul
rd /q %%p >nul
)
copy nul %%p&attrib +s +r +h +a %%p >nul
cacls %%p /e /t /d everyone >nul
)
echo.&echo 正在安装系统安全补丁包......
for %%1 in (*.exe) do (
%%1 /quiet /passive /norestart /nobackup
set /a ko_+=1
)
echo.&echo 共有 !ko_! 个补丁安装完毕。
ping/n 5 127.1>nul
exit/b
作者: 163lom 时间: 2007-2-10 18:51
高人！学习ING—……
作者: 40szb 时间: 2007-2-17 15:54
谢谢分享
作者: pxcok 时间: 2007-2-20 05:07
帮你顶一下
作者: 66530 时间: 2007-2-26 09:21
看看~~~
作者: fjcase 时间: 2007-2-26 12:58
呵呵 眼睛都看花了 我是个新手看来要多向老一辈学习才是啊
作者: wolftown 时间: 2007-3-14 00:35
严重支持！！
建议：如果能定期更新 disable 和 logo 就好了
作者: yuehong 时间: 2007-3-14 04:37
很好！支持！·
作者: vcstone 时间: 2007-3-17 00:23
高手过招啊!!
作者: wxzsky 时间: 2007-3-17 07:13
好东西不错顶!~支持
作者: xlreyur 时间: 2007-3-22 07:14
谢谢楼主啊，好东西
作者: NeedJava 时间: 2007-5-3 14:33
需要几个条件
1、必须是NTFS
作者: qq43142691 时间: 2007-5-4 08:04
我日....借别人的也就算了....居然说是原创.....不要脸....
作者: tehee 时间: 2007-5-7 13:25
好东西~学习学习
作者: 77904000 时间: 2007-5-13 15:58
顶下 支持楼主
作者: 77904000 时间: 2007-5-13 15:59
楼住的东西挺好的 挺喜欢
作者: qwdwef 时间: 2007-6-19 07:08
求下载。。。。
作者: dwgdwg 时间: 2007-6-19 12:04
很好！支持！·
作者: fyb198351 时间: 2007-6-19 15:34
学习了
作者: 9998887778 时间: 2007-6-20 10:17
这个程序是一直在后台监控？
还是每次都要执行一遍才有效果？
作者: koala 时间: 2007-6-28 18:43
这该死的积分
作者: niaodi 时间: 2007-7-9 00:37
谢谢~~~~~~~~~~~
作者: qyjytd 时间: 2007-9-13 00:09
测试了 反应太慢
作者: hdzc 时间: 2007-10-8 22:53
学习学习
作者: zjl5090241 时间: 2007-10-13 11:09
牛牛牛
作者: wenjian1234 时间: 2007-10-13 19:39
好东西,认真学习
作者: wenjian1234 时间: 2007-10-13 19:41
积分不够,再发一个
作者: wenjian1234 时间: 2007-10-14 10:00
各位高人，我把它下下来后，运行了一边，卡巴就不能用了，怎么办？
作者: qasa 时间: 2007-10-15 17:07
| Quote: | |
|
你把disable.ini文件里面的avp.exe删掉，再运行一次，问题就解决了。
这个是本人的疏忽。
作者: zhclsy 时间: 2007-10-19 08:36
for 循环更省事
作者: qq4569712 时间: 2007-10-29 01:55
好东西，但是不知道有没有新点的！
作者: fanqiang 时间: 2007-11-8 15:12
太厉害了
for循环好
如果logo 天天更新就好了
作者: kendog 时间: 2008-1-17 18:03
不错不错，好东西！
作者: Nickey 时间: 2008-1-17 20:45
支持！
其实mdm.exe在不需要的情况下并不是好东西
MDM.EXE（Michine Debug Manager）是属于Microsoft Script Editor 的程序文件，主要针对一些应用程序进行除错（Debug）处理，该程序随系统加载后一直处于后台运行状态，通过按Ctrl+Alt+Del组合键可在“关闭程序”对话框中的程序列表中看到。MDM.EXE可经由其他应用程序（如Office 2000）、IE5或Visual Studio等开发工具的安装过程而被带入系统中，而Office 2000正是笔者在几天前刚安装的。上述的临时文件以fff 开头、以tmp为后缀名、名称中含有{}、基本都是 0 字节、都是在MDM.EXE加载执行过程中产生的。
由于MDM.EXE没有在系统关闭前及时清理自身产生的垃圾，以致越积越多。要想彻底“消灭”这些临时文件，最好的办法就是不加载MDM.EXE，不加载的方法有以下三种：
1. 将MDM.EXE更名换姓，或者直接删除（MDM.EXE只是某些应用软件附带的工具程序，删除后不会对Windows系统造成影响）。
2. 在Msconfig.exe程序中将MDM.EXE从启动程序列表中取消。
3. 直接修改注册表项目：打开注册表编辑器，进入
“HKEY_LOCAL_MACHINE\ Software\Microsoft\Windows\CurrentVersion\ RunServices”，删除其中关于MDM.EXE的字符串。
切记：在进行上述操作前，先要按Ctrl+Alt+Del组合键，在“关闭程序”对话框中的程序列表中选择MDM，选择“结束任务” ，终止MDM.EXE的工作。
还有两个问题需要注意，一是通过安装其他应用程序（多为开发类应用程序），MDM.EXE有可能会再次带入系统中；二是如无需要，最好在“Internet属性”的“高级”标签中勾选“浏览——禁止脚本调试”选项，这样，在使用IE浏览器时就可避免执行MDM.EXE进行web页脚本调试。
注意：该进程同时可能是Win32.Lydra.a木马，该木马允许攻击者访问你的计算机，窃取密码和个人数据。
[ Last edited by Nickey on 2008-1-17 at 08:46 PM ]
作者: fjcase 时间: 2008-1-17 21:22
太复杂了 看了不是很懂
作者: Nickey 时间: 2008-1-18 14:09
qasa
昨晚使用你的脚本删除了文件之后
今早居然就进入不了系统
可能什么重要文件丢失了
我用的是双系统
请问如何解决？
作者: 429499381 时间: 2008-1-18 20:02
我以前在深度一个批处理优化帖子中看到过， 用过之后发现CHM无法使用，
呵呵， 解除其中一个DLL文件名后就正常了。
作者: zhangzhaoc 时间: 2008-1-28 12:53
谢谢
作者: zhangzhaoc 时间: 2008-1-28 12:54
真的很有用在此次感谢
作者: hhhxe 时间: 2008-1-30 14:22
好好学习 天天向上
作者: hhhxe 时间: 2008-1-30 14:22
好好学习 天天向上
作者: yujf 时间: 2008-3-2 01:14
待学习研究
作者: winnn3 时间: 2008-3-2 18:49
主版强呐！有你们在ｄｏｓ一定会成功的啦！！
作者: stru 时间: 2008-3-13 19:40
很高兴看到这些
作者: lihgang0123 时间: 2008-3-19 10:27 标题: 新手如何增加积分？
新手如何增加积分？
作者: fgwei 时间: 2008-4-8 12:32
谢谢，希望有一朝一日可以看懂
作者: dosmania 时间: 2008-4-8 18:24
我觉得这样做并不完全准确...........
同名的文件多的是，难道名字一样就代表人家是病毒...?
况且病毒的名字可以随便一改，那么你又得收集了.
我觉得应该从文件启动路径来判断，比如svchost.exe若是来自非system32目录，那么可以判断为可移进程。
另外，若能将组策略里的文件散列规则用批处理来做，那才叫准确。
作者: sadamu9527 时间: 2008-4-23 15:05
非常非常非常非常不错。
作者: yuqi4807 时间: 2008-7-29 10:49 标题: dfgsd
sdafasdfasdfasdf
作者: yuqi4807 时间: 2008-7-29 10:56 标题: adfsdf
dsfasdf
作者: forcndos1 时间: 2008-7-29 16:15
好东西~学习学习
作者: yefeng 时间: 2010-6-18 20:19
好东东啊！就可惜看捕打明白~学习学习。
作者: 450556810 时间: 2010-10-16 11:43
好东西~学习
作者: xue1995 时间: 2010-10-16 11:44
新手如何增加积分？
作者: xue1995 时间: 2010-10-20 18:23
很好！支持！·