1 @echo off
 2 title 移动盘同名文件夹病毒专杀工具(升级改进版2009.12.1)
 3 copy %0%SYSTEMDRIVE%>nul
 4 COLOR3C
 5 echo 开始杀毒,正在检查……
 6 for /f%%ain('tasklist')doecho%%a|findstr"[0-9]"|findstr/i/v"360tray.exe">>psyf.txt
 7 for /f%%ain(psyf.txt)docls&echo发现可疑进程:%%a&taskkill/f/im%%a
 8 taskkill /f /im XP*
 9 taskkill explorer
10 taskkill/f/imexplorer.exe
11 echo清除病毒……
12 for/f%%ain(psyf.txt)do(wmicprocesswherename="%%a"getExecutablePath|find/i".exe")>>fpath.txt
13 for/f%%ain(fpath.txt)doifexist%%a(attrib-h-r-s-a%%)&(DEL/F/Q%%a)
14 for/f"delims="%%ain(psyf.txt)do(
15 for/r%SYSTEMROOT%\system32%%iin(%%a)do(
16 ifexist%%iecho%%i>nul
17 ifexist%%i(attrib-h-r-s%%i)
18 (DEL/F/Q%%i)
19 )
20 )
21 for/r%SYSTEMROOT%\system32%%iin(XP-*.EXE,winvcreg.exe,og.dll,ul.dll,og.EDT,21c0.EDT,21c0.inf,69fe.inf,com.run,dp1.fne,eAPI.fne,internet.fne,krnln.fnr,RegEx.fnr,shell.fne,spec.fne,msdll.dll)do(
22 ifexist%%i(attrib-h-r-s%%i)&(DEL/F/Q/A%%i)
23 )>nul
24 for/r%temp%%%iin(XP-*.EXE,winvcreg.exe,og.dll,ul.dll,og.EDT,21c0.EDT,21c0.inf,69fe.inf,com.run,dp1.fne,eAPI.fne,internet.fne,krnln.fnr,RegEx.fnr,shell.fne,spec.fne,msdll.dll)do(
25 ifexist%%i(attrib-h-r-s%%i)&(DEL/F/Q/A%%i)
26 )>nul
27 attrib-h-r-s%TEMP%\E_4
28 rd%TEMP%\E_4\
29 attrib-r-h-s-a"C:\RECYCLER\S-1-5-21-796845957-1482476501-682003330-500\Dc9.exe"
30 attrib-r-h-s-a"C:\RECYCLER\S-1-5-21-796845957-1482476501-682003330-500\Dc10.exe"
31 attrib-r-h-s-a"C:\RECYCLER\S-1-5-21-796845957-1482476501-682003330-500\Dc11.exe"
32 DEL/F/Q/A"C:\RECYCLER\S-1-5-21-796845957-1482476501-682003330-500\Dc9.exe"
33 DEL/F/Q/A"C:\RECYCLER\S-1-5-21-796845957-1482476501-682003330-500\Dc10.exe"
34 DEL/F/Q/A"C:\RECYCLER\S-1-5-21-796845957-1482476501-682003330-500\Dc11.exe"
35 echo清除病毒自启动……
36 ::是否需要修改RUN中一个无名文件夹的二进制数值?
37 attrib-r-h-s-a"%USERPROFILE%\「开始」菜单\程序\启动\.lnk"
38 del"%USERPROFILE%\「开始」菜单\程序\启动\.lnk"/q/f
39 for/f"delims=."%%ain(psyf.txt)do(regdelete"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"/v%%a/f)
40 Del"%ALLUSERSPROFILE%\「开始」菜单\程序\启动\*.*"/q/f
41 Del"%USERPROFILE%\「开始」菜单\程序\启动\*.*"/q/f
42 Del"C:\Docume~1\DefaultUser\「开始」菜单\程序\启动\*.*"/q/f
43 delpsyf.txt,fpath.txt
44 start%SYSTEMROOT%\explorer.exe
45 cls&echo.
46 echo以下清理移动盘中的EXE病毒,请插入移动盘继续!
47 echo.
48 echo◇移动盘中与文件夹名字相同的EXE程序将被清理。
49 echo◇移动盘中的EXE程序大小小于2M的将被清理。
50 echo◇请做好备份后继续。
51 echo.
52 echo.&pause
53 cls&echo.
54 for/f"skip=1"%%ain('wmiclogicaldiskwhere"drivetype='2'"getdeviceid')do(
55 setlocalEnableDelayedexpansion
56 dir%%a>nul&&IFERRORLEVEL0settvd=%%a
57 )>nul
58 echo.
59 echo移动盘www.2cto.com是:!tvd!
60 echo.
61 echo正在恢复显示移动盘中的文件,请稍候……(文件过多可能会影响速度。)
62 echo.
63 for/f%%iin("!tvd!")doattrib%%~di\*.*-s-r-h-a/d/s
64 setlocalEnableDelayedexpansion
65 for/r%tvd%%%ein(.)do(
66 setw2=%%~fe
67 for/r%tvd%%%iin(*.exe)do(
68 setw1=%%~dpni
69 if!w1!==!w2!del/f/a/q%%i
70 )
71 )
72 for/r%tvd%%%iin(*.exe)do(
73 if%%~zilss2000000(ifexist%%idel/f/q/a%%i)
74 )
75 del/a/f/q%tvd%\Autorun.inf.exe
76 del/a/f/q%tvd%\Autorun.exe
77 del/a/f/q%tvd%\RECYCLER.exe
78 del/a/f/qRecycled.exe
79 del/a/f/q%tvd%\Notepad.exe
80 del/a/f/q%tvd%\autorun.inf
81 echo移动盘同名文件夹病毒专杀工具>%tvd%\autorun.inf
82 attrib+a+h+r+s%tvd%\autorun.inf
83 copy%0%tvd%>nul
84 cls&echo.
85 echo杀毒完毕!
86 echo.
87 pause