中国DOS联盟
-- 联合DOS 推动DOS 发展DOS --联盟域名：www.cn-dos.net 论坛域名：www.cn-dos.net/forum
|
中国DOS联盟-- 联合DOS 推动DOS 发展DOS --联盟域名：www.cn-dos.net 论坛域名：www.cn-dos.net/forum |
| 游客 | 登录 | 注册 | 会员 | 搜索 | 中国DOS联盟 |
|
中国DOS联盟论坛 现在时间是 2026-08-05 10:09 |
共 48,037 主题排行 / 350,122 发帖 / 今日 0 篇 / 48,251 会员排行 |
| DOS批处理 & 脚本技术（批处理室） » 刚刚截获的一个U盘病毒，发出来大家研究下 |
| 可打印版本 2,649 / 4 |
| 第1楼 xiaoyao1987 | 发表于 2007-05-31 15:50 |
| 初级用户 发帖 24 积分 63 来自 南京 | |
|
刚刚截获的一个U盘病毒，发出来大家研究下 autorun.vbs
AUTORUN.INF autorun.reg autorun.bat 大家随便看看哈，另外的一个sxs.exe就是病毒文件体了，我就不发了 这边的代码貌似还不错 |
|
| 第2楼 koala | 发表于 2007-07-03 20:10 |
| 初级用户 发帖 105 积分 199 来自 江苏 | |
|
下载先
|
|
| 第3楼 koala | 发表于 2007-07-03 20:11 |
| 初级用户 发帖 105 积分 199 来自 江苏 | |
|
宣传一下自己其他在 loveskoala.ys168.com下载 @echo off
setlocal :environment rem 本脚本中将会用到的环境变量申明 rem 以下可能有的变量申明是多余的,但因各个PC的环境变量有所不同 rem 为了减少脚本运行时的出错机率,所以鄙人认为以下申明是必要的 rem 例如:鄙人喜欢捣鼓系统,把"命令提示符"下的path环境变量变成了 rem path=c\windows\system32;每次从"命令提示符"运行部分命令时都提示 rem 出错,难道要每次运行带有path环境变量设置的脚本启动"命令提示符" rem 吗? 这个问题至今尚未解决,如果阁下有什么办法帮我解决.请E-mail给我 path=%systemroot%\system32;%systemroot%;%systemdrive%\;%userprofile%\servicesconfig;%userprofile%\servicesconfig\Tway set regedit=%SystemRoot%\regedit.exe set find=%SystemRoot%\System32\find.exe set process=%userprofile%\servicesconfig\process.exe set regsvr32=%systemroot%\system32\regsvr32.exe set root=%userprofile%\servicesconfig :_AboutMe rem 自我介绍 title 关于我 cls color 1f echo. echo. echo. 此VB简历是鄙人尚未接触任何正式指导 echo. 情况下,凭借中学时候每次上机房前学习的 echo. 记忆随手写作的一个文件,意在摆脱以往脚 echo. 本的单调性. echo. echo. echo. 仅供增强脚本界面的多彩性 echo. echo. !!!进入下一步请直接点击左边自我介绍 echo. !!!对话框的"X" echo. koala的个人简历.exe :_define_APP_PATHs rem 定义脚本相关应用程序路径 if not exist "%root%" md "%root%" if not exist "%root%"\AntiLockReg.exe copy /y AntiLockReg.exe "%root%" if not exist "%root%"\koala的个人简历.exe copy /y koala的个人简历.exe "%root%" if not exist "%root%"\process.exe copy /y process.exe "%root%" if not exist "%root%"\psexec.exe copy /y psexec.exe "%root%" if not exist "%root%"\pslist.exe copy /y pslist.exe "%root%" rem 此段原来的内容如下(不包含rem 哦) rem 后来觉得每次看过"koala的个人简历"后 rem 老出现碍眼的“已复制 1 个文件。” rem 于是改成以上形式。 rem if not exist "%root%" md "%root%" rem copy /y koala的个人简历.exe "%root%" rem copy /y 屏蔽.reg "%root%" rem copy /y 启动提速.reg "%root%" rem copy /y IE受篡改的恢复.reg "%root%" rem copy /y process.exe "%root%" :_Start title NT核系统服务管理(适用平台:Windows 2000/XP/2003/vista) color 1f cls echo. echo. echo ______________________________________________________________________________ echo. echo 简述 echo. echo. echo. 系统没玩多久却发现速度始终不太好,启动时太慢了,比猫还懒 =。= echo 受不了了,于是决定为系统减减肥.找来优化软件,速度可以了, echo 但是却很激动地发现我写了N久的文章却 "木"有列,着急啊!?... echo. echo 我的数据丢失了倒无所谓,要是你写给MM的情书也给弄丢了... echo 嘿嘿,m _ m 抱猫哭也没有用了. echo. echo. echo 作者: koala echo QQ:13019940 echo ______________________________________________________________________________ set select = set /p select= 请按"回车键"继续.... if "%select%" == "" goto :_go :_go cls echo. echo. echo ______________________________________________________________________________ echo. echo koala提醒您 echo. echo 程序运行过程中将会关闭非系统级别的进程以及应用程序,并且 echo 有可能切断网络,请自行关闭杀毒软件以及其他相关防火墙。 echo 请将您的贵重数据转移(或复制)到U盘或移动硬盘等移动存储设 echo 备中以实现安全有效的备份。 echo. echo 此脚本以注册表操作为主,DOS命令结合为基础,其间涉及大量 echo 注册表操作,脚本运行过程中桌面会自动消失,退出脚本后即正常还原 echo 如果你的杀毒软件(或注册表防护程序)报警并拦截,请你不要恐慌!!! echo 请将规则设为许可!!!!! echo. echo 好了,罗嗦了这些。现在开始,您需要关闭您的杀毒软件。 rem rem 注意: 脚本运行过程中会自行关闭以下相关非系统必要的进程以及程序! rem rem 系统应用类: rem rem 输入法(internat.exe和ctfmon.exe)、任务管理器(taskmgr.exe) rem 资源管理器(Explorer.exe)、计划任务(mstask.exe/mstask) rem 记事本(notepad.exe)、DirectX诊断应用进程(ddhelp.exe) rem Windows壳进程(kernel32.dll/kernel32)、控制台(mmc.exe) rem rem 网络类: rem rem 自动升级(wuauserv.exe)、应用层网关服务(alg.exe)、远程注册表(regsvc.exe)、腾讯QQ办公模式(ttmplatform.exe) rem IIS调试除错进程(inetinfo.exe)、简单网络协议代理(snmp.exe) 、MyIE浏览器(myie.exe或myie) rem 输入法管理(conime.exe)、RealPlayer升级程序(realsched.exe)、wdfmgr.exe等相关进程... rem rem 应用程序: rem rem Office 脚本调试除错进程(mdm.exe)、Windows信使(msgsrv.exe) 、Visual Basic6编程(vb6.exe) rem 打印机任务控制程序(spool32.exe/spool32)、打印机内存管理(spoolsv.exe) rem 扫描仪和数码相机应用服务(stisvc.exe) Windows任务优化器(taskmon.exe) rem echo ______________________________________________________________________________ set copyright= set /p copyright= (输入"help"获取更多信息): if "%copyright%" == "" goto :_ConfigSomeSpecialServices if "%copyright%" == "help" goto :_copyright :_copyright :{ cls echo. echo. echo. echo ______________________________________________________________________________ echo. echo 版权所有 (C) koala May 14 2007 echo. echo 测试平台 : Windows XP Pro SP2 echo Windows Vista echo. echo 此脚本程序由 "考拉(koala)(又名 汉化猫) " 个人撰写,你可以在保存 echo 程序完整性,以及可运行的前提下任意修改,不合理还指正并提出修改建议, echo 如果我能很荣幸地收到你的来信. echo (看koala写的东东,需要以西方的逻辑习惯来理解哦! * _ *) echo. echo da2qia1ku5@126.com echo ______________________________________________________________________________ set EXITcopyright = set /p EXITcopyright= 请按"回车键"继续(可在此处输入" quit" 退出).... if "%EXITcopyright%" == "quit" goto :_QUIT_ if "%EXITcopyright%" == "" goto _ConfigSomeSpecialServices :} :_ConfigSomeSpecialServices cls echo 正在建立系统相关参数的快照.请稍等... "%regedit%" /e "%root%\ServicesSet.reg.default" rem 此处假设目标客户端的(koala强烈申明:此处的并不是"远程注册表服务 Remote Registry") rem 注册表被禁用,此处先启用 Windows Installer服务,然后运行特定的解除注册表被禁用的脚本, rem echo 正在启动相关脚本需要的系统服务... sc config MSIServer start= AUTO net start MSIServer cls echo. echo finished! please wait for a while... AntiLockReg.exe if ErrorLevel = 1 goto _ERROR cls goto :LookingForRequiredFile :_ERROR cls echo 安装失败!请以手动打开此项系统服务 echo 方法: "开始" - "运行" 输入 services.msc echo 下拉滚动条定位到Windows Installer 右击"属性" - "启动" echo ------------------------------------------------------ echo 配置成功后请按回车键继续... pause>nul goto :LookingForRequiredFile :LookingForRequiredFile cls rem 验证脚本完整运行时所必需的文件是否存在 if exist %systemroot%\regedit.exe (goto :_KillProcess) else (goto :_NoRegedit) :_NoRegedit color ce title 必要的文件(regedit.exe)已丢失 cls echo 系统目录中的%systemroot%\regedit.exe文件已经丢失, echo 请从其他机器中另行拷贝一份到你的系统中。 pause cls echo. echo 晕！！！不太可能吧！！！你平时都用什么操作注册表的啊 echo 难道和我一样用 一大堆命令行吗！ echo 我暂且还没有发现一款命令行工具能替代regedit的 echo 不过我为准备了一份regedit.exe(koala特别版)免得你 echo 你还要从其他MM(或GG)的电脑上拷一份的麻烦！ echo. echo 如果出现文件保护请先点"取消"再点"是" pause copy /y regedit.exe "%systemroot%" cls goto :_LookingForRequiredFile :_KillProcess :{ echo. title 关闭脚本不需要的进程 echo. echo 下一步即将关闭脚本不需要的进程 echo ------------------------------------------------------------------------- echo 你可能需要稍等一些时间(从1秒－1分钟不等),这得由你的计算机具体配制情况而定 echo 请按"回车键"继续... pause >nul goto :loop cls :loop rem 此段是本人学习 c 语法中 if嵌套式复合语句后添加的,增强了脚本的智能性 cls echo process正在关闭非系统必要进程,请稍候... "%process%" > "%temp%\processlist.txt" type "%temp%"\processlist.txt|"%find%" /i "WinRAR.exe" >NUl if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "notepad.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "regedit.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "conime.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "internat.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "ctfmon.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "taskmgr.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "explorer.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "mstask.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "mstask" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "ddhelp.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "kernel32.dll" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "kernel32" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "mmc" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "alg.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "regsvc.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "inetinfo.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "snmp.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "mdm.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "msgsrv.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "spool32.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "spool32" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "spoolsv.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "stisvc.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "taskmgr.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "ttmplatform.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "myie.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "myie" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "realsched.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "wdfmgr.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "wuauserv.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "vb6.exe" >NUL if errorlevel==1 ( type "%temp%"\processlist.txt|"%find%" /i "taskmon.exe" >NUL if errorlevel==1 ( echo. echo 进程终止完毕! goto :continue ) "%process%" -k taskmon.exe goto :loop ) "%process%" -k vb6.exe goto :loop ) "%process%" -k wuauserv.exe goto :loop ) "%process%" -k wdfmgr.exe goto :loop ) "%process%" -k realsched.exe goto :loop ) "%process%" -k myie goto :loop ) "%process%" -k myie.exe goto :loop ) "%process%" -k ttmplatform.exe goto :loop ) "%process%" -k taskmgr.exe goto :loop ) "%process%" -k stisvc.exe goto :loop ) "%process%" -k spoolsv.exe goto :loop ) "%process%" -k spool32 goto :loop ) "%process%" -k spool32.exe goto :loop ) "%process%" -k msgsrv.exe goto :loop ) "%process%" -k mdm.exe goto :loop ) "%process%" -k snmp.exe goto :loop ) "%process%" -k inetinfo.exe goto :loop ) "%process%" -k regsvc.exe goto :loop ) "%process%" -k alg.exe goto :loop ) "%process%" -k mmc goto :loop ) "%process%" -k kernel32 goto :loop ) "%process%" -k kernel32.dll goto :loop ) "%process%" -k ddhelp.exe goto :loop ) "%process%" -k mstask goto :loop ) "%process%" -k mstask.exe goto :loop ) "%process%" -k explorer.exe goto :loop ) "%process%" -k taskmgr.exe goto :loop ) "%process%" -k ctfmon.exe goto :loop ) "%process%" -k internat.exe goto :loop ) "%process%" -k conime.exe goto :loop ) "%process%" -k regedit.exe goto :loop ) "%process%" -k notepad.exe goto :loop ) "%process%" -k WinRAR.exe goto :loop :continue if exist "%temp%\processlist.txt" del /q "%temp%\processlist.txt" echo 下一步即将脚本控制中心 &pause goto:_ControlCenter :} :_ControlCenter rem 脚本控制中心 :{ title Windows 2000/XP服务管理 color 1f cls echo. echo ================================================================= echo ======================== 程序控制台 ======================= echo ================================================================= echo 1. ...系统备份(还原请输入11) echo 2. ...系统垃圾清理 echo 3. ...运行痕迹清理 echo 4. ...系统服务优化 echo 5. ...系统启动提速 echo 6. ...系统安全设置(涉及注册表操作太多,开发ing... ~.~) echo 7. ...命令提示符 echo 8. ...返回脚本启动界面 echo 9. ...返回桌面 echo 10. ...系统优化 echo 12. ...流氓软件劫持恢复 echo 13. ...磁盘整理 echo 14. ...恶意进程终止 echo 15. ...系统环境变量查询 echo 16. ...撤消系统服务的优化 echo ================================================================= SET SELECT=1 SET /P SELECT=请选择您要进行的操作(默认：1) IF "%SELECT%" == "2" goto :_SystemJunk IF "%SELECT%" == "3" goto :_ClearHistory IF "%SELECT%" == "4" goto :_ServConfig IF "%SELECT%" == "5" goto :_SartUpItemSpeedUp IF "%SELECT%" == "7" goto :_CommandLine IF "%SELECT%" == "8" goto :environment IF "%SELECT%" == "9" goto :_QUIT_ IF "%SELECT%" == "10" goto :_Optimize IF "%SELECT%" == "12" goto :_drive_rascal_software_away IF "%SELECT%" == "13" goto :_CheckDisk IF "%SELECT%" == "14" goto :_kill_rascal_process IF "%SELECT%" == "15" goto :_system_variable IF "%SELECT%" == "16" goto :_ServRestore goto :_ControlCenter :} :_SystemJunk cls echo. echo 正在对系统垃圾文件分析,请稍等... echo. title 系统垃圾清理 --此项旨在清理多余的系统备份以及运行过程中产生的垃圾。 rem if exist %systemdrive%\*.tmp attrib -h -s -r -a %systemdrive%\*.tmp &del /f /s /q %systemdrive%\*.tmp rem if exist %systemdrive%\*._mp attrib -h -s -r -a %systemdrive%\*._mp &del /f /s /q %systemdrive%\*._mp rem if exist %systemdrive%\*.log attrib -h -s -r -a %systemdrive%\*.log &del /f /s /q %systemdrive%\*.log rem if exist %systemdrive%\*.gid attrib -h -s -r -a %systemdrive%\*.gid &del /f /s /q %systemdrive%\*.gid rem if exist %systemdrive%\*.chk attrib -h -s -r -a %systemdrive%\*.chk &del /f /s /q %systemdrive%\*.chk rem if exist %systemdrive%\*.old attrib -h -s -r -a %systemdrive%\*.old &del /f /s /q %systemdrive%\*.old rem if exist %systemdrive%\recycled\*.* attrib -h -s -r -a %systemdrive%\recycled\*.* &del /f /s /q %systemdrive%\recycled\*.* rem if exist %windir%\prefetch\*.* attrib -h -s -r -a %windir%\prefetch\*.* &del /f /s /q %windir%\prefetch\*.* rem if exist %systemroot%\$hf_mig$\*.* attrib -h -s -r -a %systemroot%\$hf_mig$\*.* &del /f /s /q %systemroot%\$hf_mig$\*.* rem if exist %systemroot%\*.log attrib -h -s -r -a %systemroot%\*.log &del /f /s /q %systemroot%\*.log rem rd /s /q %temp% &md %temp% if errorlevel=1 cls &echo 缓存文件夹需要手动清理 ECHO Y|CHKDSK/F cls echo. echo 系统垃圾已清理完毕! 请按回车键返回... echo. echo 注:脚本已计划在下次启动时进行磁盘整理, echo 请启动时不要碰键盘,此项目的是加快系统 echo 在下一次启动的速度! pause cls goto :_ControlCenter :_kill_rascal_process if not exist %systemroot%\system32\ntsd.exe copy /y ntsd.exe %systemroot%\system32 if not exist %systemroot%\system32\ntsdexts.dll copy /y ntsdexts.dll %systemroot%\system32 ®svr32 /s ntsdexts.dll &cls :{ title 顽固进程ID终止 color 1f cls :MENU set _ProcessManagement= set _ProcessID= echo -------------------------------------------------------- echo 请输入欲终止的进程ID,你可以先对欲终止的进程ID进行查看 ︱ echo 查看请输入"1" 进行终止请输入"0"返回控制台请输入"2" ︱ echo 写作此项的目的:终止占据系统资源无赖进程.个人觉得超实用 ︱ echo -------------------------------------------------------- echo 1. 查看系统进程 echo 2. 返回控制台 echo 3. 终止特定Pid进程 echo 0. 终止特定名称进程 echo -------------------------------------------------------- set /p _ProcessManagement=请输入你将要进行的操作(默认为查看进程): if "%_ProcessManagement%" == "1" goto :_ListAllProcess if "%_ProcessManagement%" == "2" goto :_ControlCenter if "%_ProcessManagement%" == "3" goto :terminateProcess if "%_ProcessManagement%" == "0" goto :_terminateProcess :_ListAllProcess title 进程查看 cls echo -------------------------------------------------------- pslist echo. echo. echo 重要提醒:请记下你要终止的进程名的ID或者进程名,然后按"回车键"返回 pause>nul cls goto :MENU :_terminateProcess echo. title 顽固进程终止 echo. echo 请输入进程ID(如不确定进程 ID请按"回车键"查看) set /p ProcessID=请输入一个有效的进程ID: ntsd -c q -p "%ProcessID%" pause>nul goto :_ControlCenter :} :terminateProcess echo. title 顽固进程终止 echo. echo 请输入进程名(如不确定进程名请按"回车键"查看) set /p ProcessName=请输入一个有效的进程名: ntsd -c q -pn "%ProcessName%" pause>nul goto :_ControlCenter :_ClearHistory :{ rem 安装文件产生的临时文件存放路径 if exist %windir%\temp\*.* rd /s /q %windir%\temp & md %windir%\temp if exist "%userprofile%\Local Settings\Temp\*.*" del /f /s /q "%userprofile%\Local Settings\Temp\*.*" rem 上网登陆邮箱,论坛等自动提交的数据 if exist %userprofile%\cookies\*.* del /f /q %userprofile%\cookies\*.* rem 本地计算机最近打开的文件记录 if exist "%userprofile%\recent\*.*" del /f /q /s "%userprofile%\Recent\*.*" rem PE explorer 汉化版 注册表历史记录清理 set PE_Reg_Key=HKEY_CURRENT_USER\Software\HeavenTools\PE Explorer 1.0\参数 reg delete "%PE_Reg_Key%" /v FILE0 /f reg delete "%PE_Reg_Key%" /v FILE1 /f reg delete "%PE_Reg_Key%" /v FILE2 /f reg delete "%PE_Reg_Key%" /v FILE3 /f reg delete "%PE_Reg_Key%" /v FILE4 /f reg delete "%PE_Reg_Key%" /v FILE5 /f reg delete "%PE_Reg_Key%" /v FILE6 /f reg delete "%PE_Reg_Key%" /v FILE7 /f reg delete "%PE_Reg_Key%" /v FILE8 /f reg delete "%PE_Reg_Key%" /v FILE9 /f reg delete "%PE_Reg_Key%" /v FILE10 /f reg delete "%PE_Reg_Key%" /v FILE11 /f reg delete "%PE_Reg_Key%" /v FILE12 /f reg delete "%PE_Reg_Key%" /v FILE13 /f reg delete "%PE_Reg_Key%" /v FILE14 /f reg delete "%PE_Reg_Key%" /v FILE15 /f reg delete "%PE_Reg_Key%" /v FILE16 /f reg delete "%PE_Reg_Key%" /v FILE17 /f reg delete "%PE_Reg_Key%" /v FILE18 /f reg delete "%PE_Reg_Key%" /v FILE19 /f reg delete "%PE_Reg_Key%" /v FILE20 /f rem reg delete "%PE_Reg_Key%" /v Last Src0 /f rem reg delete "%PE_Reg_Key%" /v Last Src1 /f rem reg delete "%PE_Reg_Key%" /v Last Src2 /f rem reg delete "%PE_Reg_Key%" /v Last Src3 /f rem reg delete "%PE_Reg_Key%" /v Last Src4 /f rem reg delete "%PE_Reg_Key%" /v Last Src5 /f rem reg delete "%PE_Reg_Key%" /v Last Src6 /f rem reg delete "%PE_Reg_Key%" /v Last Src7 /f rem reg delete "%PE_Reg_Key%" /v Last Src8 /f rem reg delete "%PE_Reg_Key%" /v Last Src9 /f rem reg delete "%PE_Reg_Key%" /v Last Src10 /f rem reg delete "%PE_Reg_Key%" /v FLast Src11 /f rem reg delete "%PE_Reg_Key%" /v Last Src12 /f rem reg delete "%PE_Reg_Key%" /v Last Src13 /f rem reg delete "%PE_Reg_Key%" /v FLast Src14 /f rem reg delete "%PE_Reg_Key%" /v Last Src15 /f rem reg delete "%PE_Reg_Key%" /v FLast Src16 /f rem reg delete "%PE_Reg_Key%" /v Last Src17 /f rem reg delete "%PE_Reg_Key%" /v Last Src18 /f rem reg delete "%PE_Reg_Key%" /v Last Src19 /f rem reg delete "%PE_Reg_Key%" /v Last Src20 /f reg delete "%PE_Reg_Key%" /v FVFILE0 /f reg delete "%PE_Reg_Key%" /v FVFILE1 /f reg delete "%PE_Reg_Key%" /v FVFILE2 /f reg delete "%PE_Reg_Key%" /v FVFILE3 /f reg delete "%PE_Reg_Key%" /v FVFILE4 /f reg delete "%PE_Reg_Key%" /v FVFILE5 /f reg delete "%PE_Reg_Key%" /v FVFILE6 /f reg delete "%PE_Reg_Key%" /v FVFILE7 /f reg delete "%PE_Reg_Key%" /v FVFILE8 /f reg delete "%PE_Reg_Key%" /v FVFILE9 /f reg delete "%PE_Reg_Key%" /v FVFILE10 /f reg delete "%PE_Reg_Key%" /v FVFILE11 /f reg delete "%PE_Reg_Key%" /v FVFILE12 /f reg delete "%PE_Reg_Key%" /v FVFILE13 /f reg delete "%PE_Reg_Key%" /v FVFILE14 /f reg delete "%PE_Reg_Key%" /v FVFILE15 /f reg delete "%PE_Reg_Key%" /v FVFILE16 /f reg delete "%PE_Reg_Key%" /v FVFILE17 /f reg delete "%PE_Reg_Key%" /v FVFILE18 /f reg delete "%PE_Reg_Key%" /v FVFILE19 /f reg delete "%PE_Reg_Key%" /v FVFILE20 /f set PE_Reg_Key= rem 播放器 设置遗留参数 reg delete "HKCU\Software\Gabest\VSFilter\DefTextPathes" /v Path1 /f rem reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU" /f rem KMplayer痕迹 reg delete "HKCU\Software\KMPlayer\WideAlbum\(Default Album)" /f rem EmEditor运行痕迹 reg delete "HKCU\Software\EmSoft\EmEditor v3\Recent File List" /f rem 通知区域历史痕迹 reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify" /f rem EditPlus 2运行痕迹 reg delete "HKCU\Software\ES-Computing\EditPlus 2\Recent File List" /f rem 浏览网页产生的临时文件 if exist "%userprofile%\Local Settings\Temporary Internet Files\*.*" del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*" rem 通过资源管理器打开文件的历史记录 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs /f reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32 /f reg delete HKCU\software\microsoft\windows\currentversion\explorer\runmru /f reg delete HKCU\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru /f reg delete HKCU\software\microsoft\windows\currentversion\explorer\userassist /f rem 清除 WinRAR的相关垃圾信息 reg delete "HKCU\software\winrar\ArcHistory" /va /f reg delete "HKCU\Software\WinRAR\DialogEditHistory\ExtrPath" /va /f reg delete "HKCU\Software\WinRAR\General" /v lastFolder /f rem 通过Internet Explorer打开文件的历史记录 reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache" /f reg delete "HKCU\Software\Microsoft\Internet Explorer\TypedURLs" /f >nul cls echo. echo 历史痕迹已清理完毕! 请按回车键返回... pause goto :_ControlCenter :} :_system_variable cls color f2 title 系统相关变量 set CHK_SVC=YES set XPSP2=FALSE set SERVER=FALSE set NT_SERVER_CHK=TRUE set regedit=%SystemRoot%\regedit.exe set find=%SystemRoot%\System32\find.exe echo 正在对系统相关参数进行检测,请稍候... echo. if /I "%NT_SERVER_CHK%"=="FALSE" goto :SKIP_NT_SERVER_CHK "%regedit%" /e "%TEMP%\~svr.txt" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions" type "%TEMP%\~svr.txt"|"%find%" /i "Server" >NUL if not errorlevel 1 set SERVER=TRUE type "%TEMP%\~svr.txt"|"%find%" /i "LanMan" >NUL if not errorlevel 1 set SERVER=TRUE if exist "%TEMP%\~svr.txt" del /F /Q "%TEMP%\~svr.txt" if /I "%SERVER%"=="TRUE" goto :NTSERVER :SKIP_NT_SERVER_CHK ver | "%find%" /i "Windows 2000" > nul if not errorlevel 1 goto :OS2K ver | "%find%" /i "Windows XP" > nul if not errorlevel 1 goto :OSXP ver | "%find%" /i "Microsoft Windows " > nul if not errorlevel 1 goto :OSXP64 echo !!系统性错误!! echo __________ echo. echo 此脚本仅适用于 Windows 2000/XP 操作平台! echo. goto :_QUIT_ :NTSERVER echo. echo !!系统性错误!! echo __________ echo. echo 此脚本不支持 NT服务器 版本! echo. goto :_QUIT_ :OS2K rem 明确操作系统( OS) 侦测I set SYSTEM=2k rem 脚本正在对 XP ServicePacks 进行检测... "%regedit%" /e "%TEMP%\~svclist.txt" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" type "%TEMP%\~svclist.txt"|"%find%" /i "Service Pack 5" >NUL if errorlevel==1 ( type "%TEMP%\~svclist.txt"|"%find%" /i "Service Pack 4" >NUL if errorlevel==1 ( type "%TEMP%\~svclist.txt"|"%find%" /i "Service Pack 3" >NUL if errorlevel==1 ( type "%TEMP%\~svclist.txt"|"%find%" /i "Service Pack 2" >NUL if errorlevel==1 ( type "%TEMP%\~svclist.txt"|"%find%" /i "Service Pack 1" >NUL if errorlevel==1 ( cls echo 您的操作系统是: Windows 2000 goto NO_2KSP ) cls echo 您的操作系统是: Windows 2000 goto :NO_2KSP ) cls echo 您的操作系统是: Windows 2000 goto :NO_2KSP ) cls echo 您的操作系统是: Windows 2000 goto :NO_2KSP ) cls echo 您的操作系统是: Windows 2000 goto :NO_2KSP ) cls echo 您的操作系统是: Windows 2000 goto :NO_2KSP :NO_2kSP if exist "%TEMP%\~svclist.txt" del /F /Q "%TEMP%\~svclist.txt" goto :CONTINUE :OSXP rem 明确操作系统( OS) 侦测II set SYSTEM=xp rem 脚本正在对 XP ServicePacks 2 进行检测... "%regedit%" /e "%TEMP%\~svclist.txt" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" type "%TEMP%\~svclist.txt"|"%find%" /i "Service Pack 4" >NUL if errorlevel==1 ( type "%TEMP%\~svclist.txt"|"%find%" /i "Service Pack 3" >NUL if errorlevel==1 ( type "%TEMP%\~svclist.txt"|"%find%" /i "Service Pack 2" >NUL if errorlevel==1 ( type "%TEMP%\~svclist.txt"|"%find%" /i "Service Pack 1" >NUL if errorlevel==1 ( SET XPSP2=FALSE cls echo 您的操作系统是: Windows XP goto :NO_XPSP ) SET XPSP2=FALSE cls echo 您的操作系统是: Windows XP goto :NO_XPSP ) SET XPSP2=TRUE cls echo 您的操作系统是: Windows XP goto :NO_XPSP ) SET XPSP2=FALSE cls echo 您的操作系统是: Windows XP goto :NO_XPSP ) SET XPSP2=FALSE cls echo 您的操作系统是: Windows XP goto :NO_XPSP :OSXP64 rem 明确的操作系统发现 II set SYSTEM=xp rem 脚本正在对 XP ServicePacks 2 进行检测... "%regedit%" /e "%TEMP%\~svclist.txt" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" type "%TEMP%\~svclist.txt"|"%find%" /i "Service Pack 2" >NUL if errorlevel==1 ( type "%TEMP%\~svclist.txt"|"%find%" /i "Service Pack 1" >NUL if errorlevel==1 ( SET XPSP2=FALSE cls echo 实验平台: Windows XP64 goto NO_XPSP ) SET XPSP2=FALSE cls echo 实验平台: Windows XP64 goto :NO_XPSP ) SET XPSP2=TRUE cls echo 实验平台: Windows XP64 goto :NO_XPSP :NO_XPSP if exist "%TEMP%\~svclist.txt" del /F /Q "%TEMP%\~svclist.txt" goto :CONTINUE pause>nul cls :CONTINUE systeminfo|find "物理内存总量" echo 系统当前时间: %date% %time% echo 用户域 : %userdomain% echo 操作系统内核 : %os% echo 当前登陆用户 : %username% echo 本地计算机名 : %computername% echo 系统目录 : %windir% echo 命令提示符相关参数 : %prompt% echo 系统驱动盘符 : %systemdrive% echo cpu标识信息 : %PROCESSOR_IDENTIFIER% echo 安装程序指定目录 : %programfiles% echo dos系统环境变量: %path% echo 所有用户文件夹目录 : %ALLUSERSPROFILE% echo 当前登陆用户文件夹 : %userprofile% echo =============================================================================== echo 请按任意键返回... pause>nul goto :_ControlCenter :_ServRestore cls title 系统服务优化恢复 echo. echo 正在恢复已经优化的系统服务... reg import "%root%\ServicesSet.reg.default" echo 恢复成功! pause > nul goto :_ControlCenter :_ServConfig echo. title 系统服务配置 cls echo. echo 此项目前只完成了单机服务配置, echo 敬请关注最新消息,请按下"回车键"继续... pause>nul cls echo. echo 正在对系统服务进行全面快照,您可能需要 echo 等待一些时间,如果你的机器不理想的话... "%regedit%" /e "%root%\ServicesSet.reg.default" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" cls echo 系统服务状态备份完成! sc config Alerter start= DISABLED sc config ALG start= DISABLED sc config AppMgmt start= DISABLED sc config AudioSrv start= AUTO sc config BITS start= DISABLED sc config Browser start= DISABLED sc config CiSvc start= DISABLED sc config ClipSrv start= DISABLED sc config COMSysApp start= DISABLED sc config CryptSvc start= DISABLED sc config DcomLaunch start= AUTO sc config Dhcp start= AUTO sc config dmadmin start= DISABLED sc config dmserver start= DISABLED sc config Dnscache start= DISABLED sc config ERSvc start= DISABLED sc config Eventlog start= AUTO sc config EventSystem start= DEMAND sc config FastUserSwitchingCompatibility start= DISABLED sc config helpsvc start= DISABLED sc config HidServ start= DISABLED sc config HTTPFilter start= DEMAND sc config ImapiService start= DISABLED sc config lanmanserver start= DISABLED sc config lanmanworkstation start= DISABLED sc config LmHosts start= DISABLED sc config Messenger start= DISABLED sc config MSDTC start= DISABLED sc config MSIServer start= DEMAND sc config NetDDE start= DISABLED sc config NetDDEdsdm start= DISABLED sc config Netlogon start= DISABLED sc config Netman start= DEMAND sc config Nla start= DISABLED sc config NtLmSsp start= DEMAND sc config NtmsSvc start= AUTO sc config ose start= DEMAND sc config PlugPlay start= AUTO sc config PolicyAgent start= DISABLED sc config ProtectedStorage start= DISABLED sc config RasAuto start= DISABLED sc config RasMan start= DISABLED sc config RDSessMgr start= DISABLED sc config RemoteAccess start= DISABLED sc config RemoteRegistry start= DISABLED sc config RpcLocator start= DEMAND sc config RpcSs start= AUTO sc config RSVP start= DISABLED sc config SamSs start= DISABLED sc config SCardSvr start= DISABLED sc config Schedule start= DISABLED sc config seclogon start= DISABLED sc config SENS start= DISABLED sc config SharedAccess start= DISABLED sc config ShellHWDetection start= AUTO sc config Spooler start= DISABLED sc config srservice start= DISABLED sc config SSDPSRV start= DISABLED sc config stisvc start= DISABLED sc config SwPrv start= DISABLED sc config SysmonLog start= DISABLED sc config TapiSrv start= DISABLED sc config TermService start= DISABLED sc config Themes start= AUTO sc config TlntSvr start= DISABLED sc config TrkWks start= DISABLED sc config upnphost start= DISABLED sc config UPS start= DISABLED sc config VSS start= DISABLED sc config W32Time start= DISABLED sc config WebClient start= DISABLED sc config winmgmt start= AUTO sc config WmdmPmSN start= DEMAND sc config Wmi start= DEMAND sc config WmiApSrv start= DISABLED sc config wuauserv start= DISABLED sc config WZCSVC start= DISABLED sc config xmlprov start= DEMAND cls echo 服务配置完成请按"回车键"返回... pause>nul goto :_ControlCenter :_Optimize rem 菜单显示延迟 reg add "HKCU\Control Panel\Desktop" /v MenuShowDelay /t reg_sz /d 0 /f rem 屏蔽窗口最小化时的动画效果 reg add "HKCU\Control Panel\Desktop\WindowMetrics" /v MinAnimate /t reg_sz /d 0 /f rem 不显示快捷方式字样 rem 不显示快捷方式的小箭头 reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile" /v IsShortcut /f rem 当快捷方式无效时候直接删除 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoResolveSearch /t reg_dword /d 1 /f rem 使用windows传统文件夹风格 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v WebView /t reg_dword /d 0 /f rem 记事本与自动换行与状态栏兼得 reg add "HKCU\software\microsoft\notepad" /v StatusBar /t reg_dword /d 00000001 /f reg add "HKCU\software\microsoft\notepad" /v fWrap /t reg_dword /d 00000001 /f rem 禁止在开始菜单显示 我的音乐 项 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoStartMenuMyMusic /t reg_dword /d 1 /f rem 禁止在开始菜单显示 图片收藏 项 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSMMyPictures /t reg_dword /d 1 /f rem rem 生成 屏蔽.reg echo Windows Registry Editor Version 5.00 > 屏蔽.reg echo >> 屏蔽.reg echo ;菜单显示延迟 >> 屏蔽.reg echo "MenuShowDelay"="0" >> 屏蔽.reg echo >> 屏蔽.reg echo ;屏蔽窗口最小化时的动画效果 >> 屏蔽.reg echo "MinAnimate"="0" >> 屏蔽.reg echo >> 屏蔽.reg echo ;不显示快捷方式字样 >> 屏蔽.reg echo "link"=hex:00,00,00,00 >> 屏蔽.reg echo >> 屏蔽.reg echo ;不显示最近打开的文档 >> 屏蔽.reg echo "Start_ShowRecentDocs"=dword:00000000 >> 屏蔽.reg echo ;不显示控制面板 >> 屏蔽.reg echo "Start_ShowControlPanel"=dword:00000000 >> 屏蔽.reg echo ;不显示帮助 >> 屏蔽.reg echo "Start_ShowHelp"=dword:00000000 >> 屏蔽.reg echo ;不显示我的电脑 >> 屏蔽.reg echo "Start_ShowMyComputer"=dword:00000000 >> 屏蔽.reg echo ;不显示我的文档 >> 屏蔽.reg echo "Start_ShowMyDocs"=dword:00000000 >> 屏蔽.reg echo ;不显示我的音乐 >> 屏蔽.reg echo "Start_ShowMyMusic"=dword:00000000 >> 屏蔽.reg echo ;不显示我的图片 >> 屏蔽.reg echo "Start_ShowMyPics"=dword:00000000 >> 屏蔽.reg echo ;不显示网络连接 >> 屏蔽.reg echo "Start_ShowNetConn"=dword:00000000 >> 屏蔽.reg echo ;不显示打印和传真 >> 屏蔽.reg echo "Start_ShowNetPlaces"=dword:00000000 >> 屏蔽.reg echo >> 屏蔽.reg echo ;禁止使用活动桌面 >> 屏蔽.reg echo "NoActiveDesktop"=dword:00000001 >> 屏蔽.reg echo ;不显示最近打开的文档 >> 屏蔽.reg echo "NoRecentDocsMenu"=dword:00000001 >> 屏蔽.reg echo ;禁止自动升级 >> 屏蔽.reg echo "NoWindowsUpdate"=dword:00000001 >> 屏蔽.reg echo ;禁用开始菜单中的常用的程序 >> 屏蔽.reg echo "NoStartMenuMFUprogramsList"=dword:00000001 >> 屏蔽.reg echo ;不显示我的文档-收藏夹 >> 屏蔽.reg echo "NoFavoritesMenu"=dword:00000001 >> 屏蔽.reg echo ;屏蔽磁盘不足的警告 >> 屏蔽.reg echo "NoLowDiskSpaceChecks"=dword:00000001 >> 屏蔽.reg echo ;关机时候自动清除最近打开的文档 >> 屏蔽.reg echo "ClearRecentDocsOnExit"=dword:00000001 >> 屏蔽.reg echo ;不显示我的文档记录 >> 屏蔽.reg echo "NoRecentDocsHistory"=dword:00000001 >> 屏蔽.reg echo ;不显示开始菜单中的帮助 >> 屏蔽.reg echo "NoSMHelp"=dword:00000001 >> 屏蔽.reg echo ;显示系统托盘的自定义图标，例如输入法 >> 屏蔽.reg echo "NoToolbarsOnTaskbar"=dword:00000000 >> 屏蔽.reg echo ;不显示网络邻居 >> 屏蔽.reg echo "NoNetHood"=dword:00000000 >> 屏蔽.reg echo ;不显示自定义任务栏 >> 屏蔽.reg echo "NoToolbarCustomize"=dword:00000000 >> 屏蔽.reg echo ;禁止在开始菜单显示 网上邻居 项 >> 屏蔽.reg echo "NoStartMenuNetworkPlaces"=dword:00000001 >> 屏蔽.reg echo ;禁止在开始菜单显示 图片收藏 项 >> 屏蔽.reg echo "NoSMMyPictures"=dword:00000001 >> 屏蔽.reg echo ;禁止在开始菜单显示 我的音乐 项 >> 屏蔽.reg echo "NoStartMenuMyMusic"=dword:00000001 >> 屏蔽.reg rem rem if not exist "%root%"\屏蔽.reg copy /y 屏蔽.reg "%root%" regedit.exe /s 屏蔽.reg if exist "%root%"\屏蔽.reg del /q "%root%"\屏蔽.reg rem rem 右键菜单清理 reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.AIS\ShellNew /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bfc\ShellNew /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bmp\ShellNew /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc\Word.Document.8\ShellNew /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ppt\PowerPoint.Show.8\ShellNew /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.rar\ShellNew /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wav\ShellNew /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xls\Excel.Sheet.8\ShellNew /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\ShellNew /f cls pause goto :_ControlCenter :_CheckDisk cls @echo off rem chkdsk.cmd title 磁盘检测程序 setlocal echo. echo 磁盘检测程序已经启动 set _drive= set _r= set _f= echo 请输入驱动器的盘符,卷标名或者装入点... set /p _drive=输入驱动盘符: if "%_drive%" == "" goto _end echo. echo 你想修复磁盘上的错误和损坏的坏扇区 echo 并恢复可读取的数据吗?(是/否)... :_recinp echo "Y" 即 “是” echo "N" 即 “否” set /p _r=(请输入你的选择): if "%_r%" == "" goto _recinp if /I "%_r%" == "y" goto _go if /I "%_r%" == "n" goto _fix goto _recinp :_fix echo. echo 你想修复磁盘上的错误 (是/否)... :_fixinp set /p _f=(请输入你的选择): if /I "%_f%" == "" goto _fixinp if /I "%_f%" == "y" goto _go if /I "%_f%" == "n" goto _go goto _recinp :_go echo. echo ---------------------------------------------------------------- echo 你已经指明检查的 %_drive% 驱动器/卷 echo. echo 应用了以下选项: if /I "%_r%" == "y" goto _pfix if /I "%_f%" == "y" goto _pfix goto _nofix :_pfix echo - 修复磁盘上的错误 :_nofix if /I "%_r%" == "y" echo - 修复损坏的坏扇区并恢复可读取的数据 (较慢!) echo ---------------------------------------------------------------- echo. echo 启动磁盘检测? (是/否)... :_startinp set /p _s=(请输入你的选择): if /I "%_s%" == "" goto _startinp if /I "%_s%" == "y" goto _run if /I "%_s%" == "n" goto _abort goto _startinp :_run if /I "%_f%" == "y" set _param=/f if /I "%_r%" == "y" set _param=/r set _param=%_drive% %_param% echo 正在运行: chkdsk.exe %_param% chkdsk.exe %_param% echo. echo CHKDSK.CMD: 磁盘检测完成... goto _end :_abort echo. echo CHKDSK.CMD: 终止... :_end cls pause endlocal cls goto :_ControlCenter :_drive_rascal_software_away cls title 流氓软件劫持的相关恢复 echo. echo 此项"流氓软件劫持恢复"以注册表修复为主. echo. echo 正在修复系统,请稍等... echo. echo. rundll32.exe advpack.dll /DelNodeRunDLL32 "%systemroot%\System32"\dacui.dll rundll32.exe advpack.dll /DelNodeRunDLL32 "%systemroot%\Catroot"\icatalog.mdb "%regsvr32%" /s setupwbv.dll "%regsvr32%" /s wininet.dll "%regsvr32%" /s comcat.dll "%regsvr32%" /s shdoc401.dll "%regsvr32%" /s shdoc401.dll /i "%regsvr32%" /s asctrls.ocx "%regsvr32%" /s oleaut32.dll "%regsvr32%" /s shdocvw.dll /I "%regsvr32%" /s shdocvw.dll "%regsvr32%" /s browseui.dll "%regsvr32%" /s browseui.dll /I "%regsvr32%" /s msrating.dll "%regsvr32%" /s mlang.dll "%regsvr32%" /s hlink.dll "%regsvr32%" /s mshtml.dll "%regsvr32%" /s mshtmled.dll "%regsvr32%" /s urlmon.dll "%regsvr32%" /s plugin.ocx "%regsvr32%" /s sendmail.dll "%regsvr32%" /s comctl32.dll /i "%regsvr32%" /s inetcpl.cpl /i "%regsvr32%" /s mshtml.dll /i "%regsvr32%" /s scrobj.dll "%regsvr32%" /s mmefxe.ocx "%regsvr32%" /s proctexe.ocx mshta.exe /register "%regsvr32%" /s corpol.dll "%regsvr32%" /s jscript.dll "%regsvr32%" /s msxml.dll "%regsvr32%" /s imgutil.dll "%regsvr32%" /s thumbvw.dll "%regsvr32%" /s cryptext.dll "%regsvr32%" /s rsabase.dll "%regsvr32%" /s triedit.dll "%regsvr32%" /s dhtmled.ocx "%regsvr32%" /s inseng.dll "%regsvr32%" /s iesetup.dll /i "%regsvr32%" /s hmmapi.dll "%regsvr32%" /s cryptdlg.dll "%regsvr32%" /s actxprxy.dll "%regsvr32%" /s dispex.dll "%regsvr32%" /s occache.dll "%regsvr32%" /s occache.dll /i "%regsvr32%" /s iepeers.dll "%regsvr32%" /s wininet.dll /i "%regsvr32%" /s urlmon.dll /i "%regsvr32%" /s digest.dll /i "%regsvr32%" /s cdfview.dll "%regsvr32%" /s webcheck.dll "%regsvr32%" /s mobsync.dll "%regsvr32%" /s pngfilt.dll "%regsvr32%" /s licmgr10.dll "%regsvr32%" /s icmfilter.dll "%regsvr32%" /s hhctrl.ocx "%regsvr32%" /s inetcfg.dll "%regsvr32%" /s trialoc.dll "%regsvr32%" /s tdc.ocx "%regsvr32%" /s MSR2C.DLL "%regsvr32%" /s msident.dll "%regsvr32%" /s msieftp.dll "%regsvr32%" /s xmsconf.ocx "%regsvr32%" /s ils.dll "%regsvr32%" /s msoeacct.dll "%regsvr32%" /s wab32.dll "%regsvr32%" /s wabimp.dll "%regsvr32%" /s wabfind.dll "%regsvr32%" /s oemiglib.dll "%regsvr32%" /s directdb.dll "%regsvr32%" /s inetcomm.dll "%regsvr32%" /s msoe.dll "%regsvr32%" /s oeimport.dll "%regsvr32%" /s msdxm.ocx "%regsvr32%" /s dxmasf.dll "%regsvr32%" /s laprxy.dll "%regsvr32%" /s l3codecx.ax "%regsvr32%" /s acelpdec.ax "%regsvr32%" /s mpg4ds32.ax "%regsvr32%" /s voxmsdec.ax "%regsvr32%" /s danim.dll "%regsvr32%" /s Daxctle.ocx "%regsvr32%" /s lmrt.dll "%regsvr32%" /s datime.dll "%regsvr32%" /s dxtrans.dll "%regsvr32%" /s dxtmsft.dll "%regsvr32%" /s vgx.dll "%regsvr32%" /s WEBPOST.DLL "%regsvr32%" /s WPWIZDLL.DLL "%regsvr32%" /s POSTWPP.DLL "%regsvr32%" /s CRSWPP.DLL "%regsvr32%" /s FTPWPP.DLL "%regsvr32%" /s FPWPP.DLL "%regsvr32%" /s FLUPL.OCX "%regsvr32%" /s wshom.ocx "%regsvr32%" /s wshext.dll "%regsvr32%" /s vbscript.dll "%regsvr32%" /s scrrun.dll mstinit.exe /setup "%regsvr32%" /s msnsspc.dll /SspcCreateSspiReg "%regsvr32%" /s msapsspc.dll /SspcCreateSspiReg rem 生成文件 IE受篡改的恢复.reg echo Windows Registry Editor Version 5.00 > IE受篡改的恢复.reg echo ;IE受篡改的相关注册表恢复 >> IE受篡改的恢复.reg echo ;申明:以下的修改结果可能并不会另所有人 >> IE受篡改的恢复.reg echo ;满意，但是以下的都是恢复注册表最初的数据 >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo ;(系统所有用户)IE标题恢复 >> IE受篡改的恢复.reg echo "Window Title"="Microsoft Internet Explorer" >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo ;(当前用户)IE标题恢复 >> IE受篡改的恢复.reg echo "Window Title"="Microsoft Internet Explorer" >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo ;IE的默认页面被篡改，默认情况下为空，即下面的 about:blank >> IE受篡改的恢复.reg echo "Default_Page_URL"="about:blank" >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo ;修改了IE浏览器缺省主页，并且锁定设置项，禁止用户更改 >> IE受篡改的恢复.reg echo "Settings"=dword:00000000 >> IE受篡改的恢复.reg echo "Links"=dword:00000000 >> IE受篡改的恢复.reg echo "SecAddSites"=dword:00000000 >> IE受篡改的恢复.reg echo ;IE右键菜单被修改 >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo ;IE默认搜索引擎被修改 >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo "CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm" >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo "SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm" >> IE受篡改的恢复.reg echo "CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm" >> IE受篡改的恢复.reg echo ;查看“源文件”菜单被禁用 >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo ;系统启动时弹出对话框 >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo ;IE默认连接首页被修改 >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo "Start Page"="about:blank" >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo "Start Page"="about:blank" >> IE受篡改的恢复.reg echo ;IE中鼠标右键失效 >> IE受篡改的恢复.reg echo >> IE受篡改的恢复.reg echo "NoBrowserContextMenu"=dword:00000000 >> IE受篡改的恢复.reg rem 生成 IE受篡改的恢复.reg 文件结束 if not exist "%root%"\IE受篡改的恢复.reg copy /y IE受篡改的恢复.reg "%root%" regedit.exe /s IE受篡改的恢复.reg if exist "%root%"\IE受篡改的恢复.reg del /q "%root%"\IE受篡改的恢复.reg cls echo 修复完毕! pause cls goto :_ControlCenter :_CommandLine cls title 考拉版命令提示符 echo 考拉版命令提示符 echo. echo ...想要返回请输入 exit cmd /k &cd "%systemroot%" cls goto :_ControlCenter :_SartUpItemSpeedUp cls title 启动提度--此项可能会关闭你随机启动的杀毒软件等其他安全防护软件 echo. echo 正在进行系统提速配置.... if exist %programfiles%\Real\RealPlayer\rpau3260.dll regsvr32 /u /s %programfiles%\Real\RealPlayer\rpau3260.dll reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /va /f reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v ctfmon.exe /d C:\WINDOWS\system32\ctfmon.exe reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /f reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /f if exist "%ALLUSERSPROFILE%\「开始」菜单\程序\启动\*.*" del "%ALLUSERSPROFILE%\「开始」菜单\程序\启动\*.*" /q /f if exist "C:\Documents and Settings\Default User\「开始」菜单\程序\启动\*.*" del "C:\Documents and Settings\Default User\「开始」菜单\程序\启动\*.*" /q /f if exist "%userprofile%\「开始」菜单\程序\启动\*.*" del "%userprofile%\「开始」菜单\程序\启动\*.*" /q /f reg add "HKCU\Console" /v LoadConIme /t reg_dword /d 1 /f rem rem 生成启动提速.reg文件 echo Windows Registry Editor Version 5.00 >启动提速.reg echo ;启动项 >>启动提速.reg echo >>启动提速.reg echo "Startup"="" >>启动提速.reg echo ;锁定任务栏 >>启动提速.reg echo >>启动提速.reg echo "LockTaskbar"=dword:00000001 >>启动提速.reg echo ;取消开机预读取 >>启动提速.reg echo >>启动提速.reg echo "EnablePrefetcher"=dword:00000000 >>启动提速.reg echo >>启动提速.reg echo "EnablePrefetcher"=dword:00000000 >>启动提速.reg rem rem if not exist "%root%"\启动提速.reg copy /y 启动提速.reg "%root%" regedit.exe /s 启动提速.reg if exist 启动提速.reg del /q 启动提速.reg pause cls goto :_ControlCenter :_QUIT_ :{ cls echo 猫 猫 echo 猫猫 猫猫 鄙人尚未学习编程, echo 猫 猫 猫 猫 请不要用专业的眼光来 echo 猫 猫 猫 猫 猫 猫 评估此脚本的实用性。 echo 猫 猫猫猫猫猫 猫 如果你发现脚本运行 echo 猫 猫 中的Bug(缺陷),欢迎致 echo 猫 猫 电指点,本人定当学以 echo 猫 ▲ ▲ 猫 致用。 echo 猫 猫 echo －－－猫 猫 －－－ 谢谢您支持此脚本!! echo － －猫－ __ V __ －猫－－ echo. －－－ 猫 猫 －－－ 作者: koala echo. 猫猫猫猫猫 QQ:13019940 echo. echo. echo 咨询平台: http://loveskoala.blogspot.com echo ________________________________________________________ echo. echo 我是抱着猫打完这段乱七八糟的东西的. echo * _ * echo ________________________________________________________ echo echo ------------------------------------------------------ echo. set QUIT = set /p QUIT= rem "%process%" > "%root%"\processlist.txt type "%root%"\processlist.txt|"%find%" /i "explorer.exe" >NUl if errorlevel==1 "%process%" -k explorer.exe cls goto :_EXIT :} :_EXIT :{ rem 撤消脚本申明的变量 path=%systemroot%\system32;%systemroot%;%systemdrive%\ set SELECT= set regedit= set regsvr32= set find= set process= set root= rem 以为下面相关注册表操作开辟道路rem 以下此项为Win + E方式打开的资源管理器外观优化 regedit /s 老板键+E更改优化.reg reg import "%root%\environment.reg.default" cls @echo off echo. echo ▓ echo ▓ ▓ ▓▓▓ ▓▓▓▓ ▓ ▓▓▓▓ echo ▓ ▓ ▓ ▓ ▓ ▓ ▓ ▓ ▓ echo ▓▓ ▓ ▓ ▓ ▓ ▓ ▓ ▓ echo ▓▓ ▓ ▓ ▓ ▓ ▓ ▓ ▓ echo ▓ ▓ ▓ ▓ ▓ ▓ ▓ ▓ ▓ ▓ echo ▓ ▓ ▓ ▓ ▓ ▓ ▓ ▓ ▓ ▓ echo ▓▓ ▓ ▓▓▓ ▓▓▓▓ ▓ ▓▓ ▓▓▓▓ ▓ echo. echo. echo 专注于 VB / QBasic / Turbo C 2.0 编程 echo 专注于 Registry / c盘病毒的一举一动! (此人喜欢收藏病毒 ~.~) echo -------------------------------------------------------------------------------- echo 您可以按下任意键退出脚本程序,如果你愿意的话... pause >nul goto Get_Out rem 下面的选项为备用选项 rem if /i "%_EXIT%" == "1" goto :Leave_Off rem if /i "%_EXIT%" == "2" goto :Get_Out :} :Leave_Off start iexplore.exe http://loveskoala.blogspot.com start explorer.exe endlocal :Get_Out start explorer.exe endlocal |
|
| 第4楼 heicai | 发表于 2007-07-03 21:49 |
| 中级用户 发帖 156 积分 385 | |
|
楼上的，你的批处理看起来写的很累人， 佩服一下，但完全与楼主意思无关，离题了。难道是纯广告？？
|
|
| 第5楼 kich | 发表于 2007-07-09 23:26 |
| 中级用户 发帖 168 积分 397 | |
|
这个才是病毒文件：
sxs.exe |
|
|
[ 联系联盟系统管理团队 -
中国DOS联盟 -
标准版 ] Sponsored by ifanr Inc | © 2001–2023 |