史萊姆論壇 - 中毒

開啟記事本，
把下方紅色文字複製上去，然後另存新檔成為 USB.bat
然後點兩下試試看 :
語法:
@echo off

title Killer Of Trojan.Win32.Hider.i

echo Killer Of Trojan.Win32.Hider.i

chcp | find "437" >nul && (set "fs=Removable Drive" & set "rs=Application" & goto :start)

chcp | find "936" >nul && (set "fs=可移動驅動器" & set "rs=應用程序" & goto :start)

chcp | find "950" >nul && (set "fs=卸除式磁碟機" & set "rs=應用程式" & goto :start)

echo Language Not Supported & pause

goto :eof

:start

rem Kill Process

taskkill /f /im isass.exe >nul

rem Delte Files

del %windir%\system32\isass.exe /f /q /a >nul

rem Clean Registry

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt" /v UncheckedValue /t REG_DWORD /d 0 /f >nul

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden" /v UncheckedValue /t REG_DWORD /d 1 /f >nul

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t REG_DWORD /d 1 /f >nul

reg add "HKCR\exefile" /ve /d %rs% /f >nul

sc delete "CSNetManagerXp" >nul

 

rem Other

if not exist %windir%\system32\wbem\wmic.exe goto :C1

for /f "skip=2" %%i in ('fsutil fsinfo drives ^| more') do (

         fsutil fsinfo drivetype %%i | find "%fs%"         >nul&& call :DF %%i

)

goto :END

:C1

set /p "u=%fs%:?（g:\ OR g:\ h:\）"

for %%i in (%u%) do call :DF %%i

goto :END

:DF

for /f "delims=" %%a in ('dir %1 /b /ad /s') do (

     attrib "%%~dpna" -s -h

     del "%%~dpna.exe" /f /q /a 1>nul 2>nul

)

goto :eof

 

:END

pause