'-----------------遍历删除各盘符根目录下病毒文件模块开始-----------------
set fso=createobject("scripting.filesystemobject")
set drvs=fso.drives
for each drv in drvs
if drv.drivetype=1 or drv.drivetype=2 or drv.drivetype=3 or drv.drivetype=4 then
set w=fso.getfile(drv.driveletter&":rundll.exe")
w.attributes=0
w.delete
set u=fso.getfile(drv.driveletter&":autorun.inf")
u.attributes=0
u.delete
end if
next
'-----------------遍历删除各盘符根目录下病毒文件模块终止-----------------
'-----------------注册表操作模块开始-----------------
set reg=wscript.createobject("wscript.shell")
reg.regwrite "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit", fso.GetSpecialFolder(1)&"userinit.exe,","REG_SZ"
reg.regwrite "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools",0,"REG_DWORD"
reg.regdelete "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoFolderOptions"
'-----------------注册表操作模块终止-----------------
'-----------------系统文件恢复模块开始-----------------
set fso=createobject("scripting.filesystemobject")
fso.getfile("rundll32.exe").copy("c:windowssystem32rundll32.exe")
fso.getfile("rundll32.exe").copy("C:WINDOWSsystem32dllcacherundll32.exe")
'-----------------系统文件修复模块终止-----------------
'-----------------HOST文件修复模块开始-----------------
set fso=createobject("scripting.filesystemobject")
set re=fso.OpenTextFile("C:WINDOWSsystem32driversetchosts",2,0)
re.Writeline "127.0.0.1 localhost"
re.Writeline "127.0.0.1 www.你要屏蔽的恶意网址或IP.com"
re.Close
set re=nothing
'-----------------HOST文件修复模块终止-----------------
'-----------------Autorun免疫模块开始-----------------
set fso=createobject("scripting.filesystemobject")
set drvs=fso.drives
for each drv in drvs
if drv.drivetype=1 or drv.drivetype=2 or drv.drivetype=3 or drv.drivetype=4 then
fso.createfolder(drv.driveletter&":autorun.inf")
fso.createfolder(drv.driveletter&":autorun.inf免疫文件夹..")
set fl=fso.getfolder(drv.driveletter&":autorun.inf")
fl.attributes=3
end if
next
'-----------------Autorun免疫模块终止-----------------
'-----------------ARP病毒欺骗--客户端免疫模块开始-----------------
set WshShell=wscript.createobject("wscript.shell")
WshShell.run "arp -d",0
WshShell.run "arp -s 202.4.139.1 00-07-ec-23-f8-0a",0,true
'-----------------ARP病毒欺骗--客户端免疫模块终止-----------------
