BYR Achieve · 镜像论坛

[color=blue] 该工具默认会删除每个磁盘根目录下的autorun.inf,setup.exe,explorer.exe等文件,更多的文件信息可以到代码中去找,找那些*.exe,*.com,*.inf的关键字看看,看看你正常使用的文件是不是在代码里面不过一般说来除非你使用电脑习惯比较诡异,否则这些都是病毒文件 [/color] 鉴于autorun病毒一直都在流行,并且主要通过移动设备传播,而且渐渐到了期末和毕业,去打论文的人越来越多,此病毒有可能会大规模爆发故此分享一个原创的工具,就是一个bat,技术含量比较低,主要功能是免疫常见的autorun病毒,杀毒能力(主要是在停止进程方面)还有待于加强,最适合干净的环境下免疫,若是已经中了,效果也还可以. 下面把代码贴出来,会用批处理命令的可以帮忙改进,比如多收集些病毒信息之类的,还请贴出来,大家共享信息.不会的就直接拿着用好了,见附件中的bat文件自己用的时候连echo都没有用,那两个pause也是后加上去的~~~图个简便另外病毒数量多了,代码必然冗余,有空的时候再写个程序把病毒信息单独存到一个文件里去,也便于整理和功能拓展一下红字部分是代码: [color=red] rem 国电信息中心 liyuan@sgcc.com.cn pause %systemroot%\system32\taskkill.exe /F /T /IM severe.exe /IM rundll32.exe /IM tfidma.exe /IM conime.exe /IM ravmone.exe /IM svohost.exe /IM svch0st.exe /IM rundl132.exe /IM ctfmon.exe /IM rund1132.exe /IM ose.exe /IM fun.xls.exe /IM tel.xls.exe /IM sxs.exe /IM rose.exe %systemroot%\system32\shutdown.exe /a for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\autorun.inf" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\autorun.inf" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\autorun.inf" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\autorun.inf/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\autorun.inf" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\oso.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\oso.exe*" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\oso.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\oso.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\oso.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\mplay.com" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\mplay.com*" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\mplay.com" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\mplay.com/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\mplay.com" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\setup.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\setup.exe*" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\setup.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\setup.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\setup.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\gamesetup.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\gamesetup.exe*" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\gamesetup.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\gamesetup.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\gamesetup.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\tel.xls.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\tel.xls.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\tel.xls.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\tel.xls.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\tel.xls.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\fun.xls.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\fun.xls.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\fun.xls.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\fun.xls.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\fun.xls.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\memsub.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\memsub.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\memsub.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\memsub.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\memsub.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\BjEMN.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\BjEMN.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\BjEMN.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\BjEMN.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\BjEMN.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\PWShare.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\PWShare.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\PWShare.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\PWShare.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\PWShare.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\sxs.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\sxs.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\sxs.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\sxs.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\sxs.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\重要文件.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\重要文件.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\重要文件.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\重要文件.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\重要文件.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\个人档案.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\个人档案.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\个人档案.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\个人档案.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\个人档案.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\setup.pif" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\setup.pif" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\setup.pif" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\setup.pif/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\setup.pif" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\RavMonE.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\RavMonE.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\RavMonE.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\RavMonE.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\RavMonE.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\rose.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\rose.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\rose.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\rose.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\rose.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\driver.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\driver.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\driver.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\driver.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\driver.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\sxs2.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\sxs2.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\sxs2.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\sxs2.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\sxs2.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\explore.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\explore.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\explore.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\explore.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\explore.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\重要资料.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\重要资料.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\重要资料.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\重要资料.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\重要资料.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\tool.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\tool.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\tool.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\tool.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\tool.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\成人小说.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\成人小说.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\成人小说.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\成人小说.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\成人小说.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib -h -r -s -a "%%a:\美女游戏.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do del /q /f "%%a:\美女游戏.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\美女游戏.exe" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do md "%%a:\美女游戏.exe/病毒免疫请勿删除 /" for %%a in (c,d,e,f,g,h,i,j,k,l,m,n) do attrib +h +r +s +a "%%a:\美女游戏.exe" [/color] 免疫后效果如下图每个磁盘根目录下会多出n个带后缀名的文件夹,默认是隐藏的,点进去后会看到"病毒免疫请勿删除"字样以下是附件,先麻烦的直接下了双击就行,中间会暂停一次,按任意键继续,最后也会停一次附件(8.7KB) Kill_Autorun.bat 最后,大家有杀毒方面的问题可以和俺联系,现在的工作就是杀毒[em20] 论坛可能不会经常上,发邮件吧,liyuan@sgcc.com.cn

[原创]Autorun病毒专杀免疫工具