LoveGate专杀工具

昨天我家里的计算机中病毒，系统的EXE文件几乎全部变成隐藏文件，然后生成同名病毒。

好可恶啊。

到网上查了资料，再改了改，写成以下程序(批处理)，运行，半小时就将病毒搞定了，5万多个啊。

 

@echo off

echo “LoveGate”专杀工具 Modify By 踏雪无痕

echo

echo 请在安全模式和Dos模式下运行

pause

echo

pause

cd /d %windir%/system

for %%i in (msjdbc11.dll,mssign30.dll,kernel66.dll,odbc16.dll) do del /s /q /a:rh %%i

for %%i in (hxdef.exe,ravmond.exe,iexplore.exe,netmeeting.exe,spollsv.exe) do del /s /q /a:rh %%i

for %%i in (autorun.inf,command.exe) do del /s /q /a:rh %%i

cd/

for %%i in (letter.rar,install.rar,pass.rar,setup.rar,work.rar,bak.rar) do del /q %%i

for %%i in (letter.zip,install.zip,pass.zip,setup.zip,work.zip,bak.zip) do del /q %%i

echo

pause

net share media /del

echo

pause

echo Windows Registry Editor Version 5.00 >> tmp.reg

echo. >> tmp.reg

echo [HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run] >> tmp.reg

echo "Hardware Profile"=- >> tmp.reg

echo "Microsoft NetMeeting Associates, Inc."=- >> tmp.reg

echo "VFW Encoder/Decoder Settings"=- >> tmp.reg

echo "Shell Extension"=- >> tmp.reg

echo "Protected Storage"=- >> tmp.reg

echo "Program In Windows"=- >> tmp.reg

echo "BIE"=- >> tmp.reg

echo. >> tmp.reg

echo [-HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/unServices] >> tmp.reg

echo. >> tmp.reg

echo [-HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services_reg] >> tmp.reg

echo. >> tmp.reg

echo [-HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/Windows]>> tmp.reg

echo. >> tmp.reg

regedit /s tmp.reg

del tmp.reg

echo

pause

attrib -s -h -r *.zmx /s

@dir /b /s *.zmx>zmx_file.txt

@for /f "delims==" %%a in (zmx_file.txt) do ren "%%a" *.exe

@del zmx_file.txt

echo 清除恢复成功，将程序复制到到其它盘运行

pause