中国DOS联盟

@echo off
title 清除熊猫烧香病工具 God God.10Mb.cN
@echo 清除熊猫烧香病工具
@echo
@echo
@echo
@echo
pause

if exist %windir%\rundl132.exe echo ☆☆☆发现有熊猫烧香病毒! ☆☆☆
if exist %windir%\logo_1.exe echo ☆☆☆发现有熊猫烧香病毒! ☆☆☆
if exist %Windir%\system32\drivers\spoclsv.exe echo ☆☆☆嘿嘿！！熊猫烧香你还想跑!!☆☆☆
@echo 正在杀进程里的病毒,请稍等.........
tskill logo_1
tskill rundl132
tskill zt
tskill wow
tskill logo1_
tskill Ravmon
tskill Eghost
tskill Mailmon
tskill KAVPFW
tskill IPARMOR
tskill Ravmond
tskill spoclsv
tskill SVCHQST
tskill devgt
tskill sxs
taskkill /f /im 0sy.exe
taskkill /f /im 1sy.exe
taskkill /f /im 2sy.exe
taskkill /f /im 3sy.exe
taskkill /f /im 4sy.exe
taskkill /f /im 5sy.exe
taskkill /f /im 6sy.exe
taskkill /f /im 7sy.exe
taskkill /f /im 8sy.exe
taskkill /f /im 9sy.exe
taskkill /f /im spoclsv.exe
taskkill /f /im SVCHQST
taskkill /f /im devgt.exe
taskkill /f /im sxs.exe
echo 正在查找熊猫烧香病毒,请稍等.........
del d:\_desktop.ini /f/s/q/a
del c:\Program Files\_desktop.ini
del %Windir%\MickNew\MickNew.dll
del %Windir%\MH_FILE\MH_DLL.dll
del %Windir%\_desktop.ini
del %Windir%\TODAYZTKING\TODAYZTKING.DLL
del %Windir%\system32\drivers\spoclsv.exe
attrib -h -r -s c:\sxs.exe
del c:\sxs.exe
del c:\setup.exe
attrib -h -s -r c:\autorun.inf
del c:\autorun.inf
attrib -h -r -s d:\sxs.exe
del d:\sxs.exe
del d:\setup.exe
attrib -h -s -r d:\autorun.inf
del d:\autorun.inf
attrib -h -r -s e:\sxs.exe
del e:\sxs.exe
del e:\setup.exe
attrib -h -s -r e:\autorun.inf
del e:\autorun.inf
attrib -h -r -s f:\sxs.exe
del f:\sxs.exe
del f:\setup.exe
attrib -h -s -r f:\autorun.inf
del f:\autorun.inf
attrib -h -r -s g:\sxs.exe
del g:\sxs.exe
del g:\setup.exe
attrib -h -s -r g:\autorun.inf
del g:\autorun.inf
attrib -h -s -r h:\sxs.exe
del h:\sxs.exe
del h:\setup.exe
attrib -h -s -r h:\autorun.inf
del h:\autorun.inf
attrib -h -s -r i:\sxs.exe
del i:\sxs.exe
del i:\setup.exe
attrib -h -s -r i:\autorun.inf
del i:\autorun.inf
attrib -h -s -r i:\sxs.exe
del j:\sxs.exe
del j:\setup.exe
attrib -h -s -r g:\autorun.inf
del j:\autorun.inf
del %windir%\system\Logo1_.exe
del %windir%\rundl132.exe
del %windir%\vDll.dll
del %windir%\Dll.dll
del %windir%{topic_info}Sy.exe
del %windir%\1Sy.exe
del %windir%\2Sy.exe
del %windir%\3Sy.exe
del %windir%\5Sy.exe
del %windir%\1.com
echo 正在删注册表的病毒......
echo Windows Registry Editor Version 5.00> c:\aa.reg
echo [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]>> c:\aa.reg
echo "qdoxjq"=->> c:\aa.reg
echo "ctfmon"=->> c:\aa.reg
echo "svcshare"=->> c:\aa.reg
echo "myZt3"=->> c:\aa.reg
echo "myMh2"=->> c:\aa.reg
echo "SVOHOST"=- >> c:\aa.reg
echo "sxs"=->> c:\aa.reg
echo Nowing using the registry file to chang the system default properties.
regedit /s c:\aa.reg
echo Deleting the temprotarily files.
del c:\aa.reg
echo 正在修改被病毒感染的注册表......
echo Windows Registry Editor Version 5.00> c:\delshare.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]>> c:\delshare.reg
echo "RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced">> c:\delshare.reg
echo "Text"="@shell32.dll,-30500">> c:\delshare.reg
echo "Type"="radio">> c:\delshare.reg
echo "CheckedValue"=dword:00000001>> c:\delshare.reg
echo "ValueName"="Hidden">> c:\delshare.reg
echo "DefaultValue"=dword:00000002>> c:\delshare.reg
echo "HKeyRoot"=dword:80000001>> c:\delshare.reg
echo "HelpID"="shell.hlp#51105">> c:\delshare.reg
echo Nowing using the registry file to chang the system default properties.
regedit /s c:\delshare.reg
echo Deleting the temprotarily files.
del c:\delshare.reg
echo Windows Registry Editor Version 5.00> c:\cc.reg
echo [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]>> c:\cc.reg
echo "DebugOptions"="2048">> c:\cc.reg
echo "Documents"="">> c:\cc.reg
echo "DosPrint"="no">> c:\cc.reg
echo "load"=->> c:\cc.reg
echo "NetMessage"="no">> c:\cc.reg
echo "NullPort"="None">> c:\cc.reg
echo "Programs"="com exe bat pif cmd">> c:\cc.reg
echo "Device"="">> c:\cc.reg
echo Nowing using the registry file to chang the system default properties.
regedit /s c:\cc.reg
echo Deleting the temprotarily files.
del c:\cc.reg
@echo -God QQ455843494-请重新启动!!----
goto type
**将以上代码变为批处理文件即可**

还没中过熊猫
注册表可以用 Reg add， Reg delete， Reg export 等直接改写
结束进程如果可以做到如果存在 0sy.exe， 1sy.exe， 2sy.exe 等就结束
如果不存在就提示找不到病毒特征文件
这样感觉会专业些