BY 余弦函數 2007.6.1 有不足之處還望指出：） 復制代碼 代碼如下: on error resume next msgbox "本專殺有ycosxhack提供http://hi.baidu.com/ycosxhack！",64,"tel.xls.exe病毒專殺" '本專殺模板有ycosxhack（余弦函數）制作，我的博客：http://hi.baidu.com/ycosxhack，歡迎討論。 set w=getobject("winmgmts:") set p=w.execquery("select * from win32_process where name='algsrv.exe' or name='SocksA.exe'") for each i in p i.terminate next set fso=createobject("scripting.filesystemobject") set del=wscript.createobject("wscript.shell") dim d(5) dim v(5) d(0)=del.ExpandEnvironmentStrings("%SystemRoot%/system32/SocksA.exe") d(1)=del.ExpandEnvironmentStrings("%SystemRoot%/system32/FileKan.exe") d(2)=del.ExpandEnvironmentStrings("%SystemRoot%/system32/algsrv.exe") d(3)=del.ExpandEnvironmentStrings("%SystemRoot%/Session.exe") d(4)=del.ExpandEnvironmentStrings("%SystemRoot%/BACKINF.TAB") for i=0 to 1 set v(i)=fso.getfile(d(i)) v(i).attributes=0 v(i).delete next set fso=createobject("scripting.filesystemobject") set drvs=fso.drives for each drv in drvs if drv.drivetype=1 or drv.drivetype=2 or drv.drivetype=3 or drv.drivetype=4 then set w=fso.getfile(drv.driveletter&":/tel.xls.exe") w.attributes=0 w.delete set u=fso.getfile(drv.driveletter&":/AUTORUN.INF") u.attributes=0 u.delete end if next set reg=wscript.createobject("wscript.shell") reg.regwrite "HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Advanced/Folder/Hidden/SHOWALL/CheckedValue",1,"REG_DWORD" reg.regwrite "HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Advanced/Folder/Hidden/SHOWALL/DefaultValue",2,"REG_DWORD" reg.regwrite "HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Advanced/Folder/Hidden/NOHIDDEN/CheckedValue",2,"REG_DWORD" reg.regwrite "HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Advanced/Folder/Hidden/NOHIDDEN/DefaultValue",2,"REG_DWORD" reg.regwrite "HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Advanced/Folder/SuperHidden/UncheckedValue",1,"REG_DWORD" reg.regwrite "HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Advanced/Folder/HideFileExt/UncheckedValue",0,"REG_DWORD" reg.regdelete "HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/ASocksrv"
'-----------------Autorun病毒免疫模塊----------------- set fso=createobject("scripting.filesystemobject") set drvs=fso.drives for each drv in drvs if drv.drivetype=1 or drv.drivetype=2 or drv.drivetype=3 or drv.drivetype=4 then fso.createfolder(drv.driveletter&":/autorun.inf") fso.createfolder(drv.driveletter&":/autorun.inf/免疫文件夾../") set fl=fso.getfolder(drv.driveletter&":/autorun.inf") fl.attributes=3 end if next '-----------------Autorun病毒免疫模塊-----------------
set fso=nothing msgbox "病毒清除成功，請重啟電腦！",64,"xxx病毒專殺"
