Del /a /f /q %%a:autorun.inf >nul 2>nul
) >nul 2>nul
)
cls
Echo Autorun 病毒清除完毕，任意键返回……
pause>nul
Goto clearauto
:clearauto2
taskkill /F /IM SocksA.exe /IM SVOHOST.exe /IM AdobeR.exe /IM ravmone.exe /IM wincfgs.exe /IM doc.exe /IM rose.exe /IM sxs.exe /IM autorun.exe /IM KB20060111.exe /IM tel.xls.exe>nul 2>nul
For %%a In (C D E F G H I J K L M N O P Q R S T U V W X Y Z) Do (
fsutil fsinfo drivetype %%a: |find /i "固定驱动器" && (
For /f "tokens=2 delims==" %%b In (%%a:autorun.inf) Do Del /a /f /q "%%a:%%b" & md "%%a:%%b免疫目录不要删除!..." & attrib +s +h +r "%%a:%%b" & Echo Y|cacls "%%a:%%b" /T /C /P everyone:N >nul 2>nul
Del /a /f /q %%a:autorun.inf & md "%%a:autorun.inf免疫目录不要删除!..." & attrib +s +h +r %%a:autorun.inf & Echo Y|cacls "%%a:autorun.inf" /T /C /P everyone:N >nul 2>nul
) >nul 2>nul
fsutil fsinfo drivetype %%a: |find /i "可移动驱动器" && (
For /f "tokens=2 delims==" %%b In (%%a:autorun.inf) Do Del /a /f /q "%%a:%%b" & md "%%a:%%b免疫目录不要删除!..." & attrib +s +h +r "%%a:%%b" & Echo Y|cacls "%%a:%%b" /T /C /P everyone:N >nul 2>nul
Del /a /f /q %%a:autorun.inf & md "%%a:autorun.inf免疫目录不要删除!..." & attrib +s +h +r %%a:autorun.inf & Echo Y|cacls "%%a:autorun.inf" /T /C /P everyone:N >nul 2>nul
) >nul 2>nul
)
cls
Echo Autorun 病毒清除并免疫完毕，任意键返回……
pause>nul
Goto clearauto
:clearauto3
cls
Echo.
Echo 正在停止相关服务……
Echo.
reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000ff /f >nul 2>nul
reg add "HKCUSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0x000000ff /f >nul 2>nul
net stop ShellHWDetection >nul 2>nul
sc config ShellHWDetection start= disabled >nul 2>nul
Rem 添加防止从回收站或仿回收站的目录中直接运行可执行文件的策略
Set REGPATH=HKLMSOFTWAREPoliciesMicrosoftWindowsSaferCodeIdentifiers Paths
Set SFLAG=/v SaferFlags /t REG_DWORD /d 0x00000000 /f
Set IDATA=/f /v ItemData /d "?:Recyc?
reg add %REGPATH%{00ffa5bf-abe7-4901-aacf-4f58aa31217a} %SFLAG%>nul
