只要有兩個批次檔就解決了... \I`g[nT|
]u@`XVEJ
第一個檔將下面的文字剪下貼上記事本再把檔名存成 kavo1.bat ?;)F_aHp
Y!L<&
sl
-------------------------------------------------------------------------------------------------------------------- YO^iEI.
@echo off /0I=?+QSo
cls `SSUQ#@
echo. PFnq:G^L
echo 自動刪除KAVO病毒 第1個步驟 CHRO9
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "kava" /f >nul 2>nul =3Hv
echo. mjz<,s`D
echo 1.刪除個磁碟中的autorun.inf及ntdelect.com的病毒檔 wam-=3W
echo. Z6vm!#\
echo 請按任意鍵以開始做這個動作..... ;Jrk#7
pause >nul 2>nul B=`"!?we
for %%a in (C D E F G H I J K L M N O P Q R S T U V W X Y Z) do ( /Aq):T T
attrib -r -s -h -a %%a:\autorun.inf >nul 2>nul&&echo.&&echo.&&attrib -r -s -h -a %%a:\ntdelect.com >nul 2>nul Q5s?/r
del %%a:\autorun.inf /q /f >nul 2>nul&&echo.&&echo.&&del %%a:\nddelect.com /q /f >nul 2>nul ) I2wT]L UV
echo. 9#;UQ.qA
cls O<x53MN^
echo autorun.inf及ntdelect.com 的病毒檔刪除完成 D?w-uR%Y
echo. Qp?n0WXZ
echo. zq5_&AeW
echo. S"=oU}'|
echo 2.建立名稱為autorun.inf的資料夾,防止病毒再度寫入 &\C{,:[
echo 屬性順便改成「唯讀、隱藏、系統」 C%P"Ds=w0N
echo. /Ki :6
echo 請按任意鍵以開始做這個動作..... b)u9#%Q
pause >nul 2>nul qi7wr\XNW
pause >nul 2>nul -}UCdaQ3
for %%a in (C D E F G H I J K L M N O P Q R S T U V W X Y Z) do ( "VWxHRVg4M
del %%a:\autorun.inf /q /f >nul 2>nul&del %%a:\nddelect.com /q /f >nul 2>nul #%e`OA(b
md %%a:\autorun.inf >nul 2>nul&&echo.&&echo.&&echo.&&echo.&&echo.&&echo.&&echo.&&echo.&&echo.&&echo.&&echo.&&echo.&&echo.&&attrib +r +s +h %%a:\autorun.inf >nul 2>nul ) _@jKFDPL
echo 完成autorun.inf資料夾的建立(可用attrib autorun.inf的指令看到) ]?)zH:2)
echo. Zt` ,DM
echo. ((dG<
echo. f\(K ou$
echo 最後請『重新開機』再執行第2個步驟的批次檔 |E7]69=P
echo 請按任意鍵以關閉這個視窗(有時要按2下,跟電腦有關)..... */8\Z46z
pause >nul 2>nul E0oJ|My
pause >nul 2>nul !E7/:t4
)O&$-4gL'
lp]O8^][&
----------------------------------------------------------------------------------------------------------------- (Pu*[STTT
<n`|zQ
第二個檔做法一樣...改成kavo2.bat 9%dNktt
<=`@`rm{
------------------------------------------------------------------------------------------------------------------- N!va12
@echo off 4@Qq5kpk*
cls qy]-YJZ
echo. U9q*zP_jV
echo 自動刪除KAVO病毒 第2個步驟(前提執行過第1個步驟後重開機) ls5S9R 5
echo 如未執行過第1個步驟請按「CTRL+C」結束這個動作 npF[J x[
echo. )2A4vU-IR.
echo 3.將被鎖定的隱藏檢視功能開啟(登錄檔的部份) @PI\.y_w
echo. I5~DC
echo 請按任意鍵以開始做這個動作..... 1m0':n Vdu
pause >nul 2>nul _pS%tPw
reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v "CheckedValue" /t REG_DWORD /d 00000001 /f >nul 2>nul g U?)
echo. --9mTqx
reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v "DefaultValue" /t REG_DWORD /d 00000002 /f >nul 2>nul r>Ln*R,9D
echo. {OOt+U!
reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v "CHKeyRoot" /t REG_DWORD /d 80000001 /f >nul 2>nul %gaKnT(|r
echo. a%dx\&K
reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v "ValueName" /t REG_SZ /d Hidden /f >nul 2>nul OLrD4 e
echo. zjA/Z(
reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v "Text" /t REG_SZ /d "@shell32.dll,-30500" /f >nul 2>nul ))`Zv=y"
echo. >| ?T|
reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v "Type" /t REG_SZ /d radio /f >nul 2>nul (5~C
_Y
echo. NJ>p8P`_k
reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v "RegPath" /t REG_SZ /d "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /f >nul 2>nul |xVCl<{F%
echo. ]%|WE
cls au|^V^m
echo 已修復無法開啟檢視隱藏檔的功能 -kbm$~P
echo 請到資料夾中的資料夾選項去開啟檢視隱藏的功能(有需要就開,不需要就別開) lGUV(D
echo. hw$c@:pW;
echo 4.刪除kavo.exe的病毒主程式 KC:4
echo. "F$o!Vk
attrib -s -h -r "C:\WINDOWS\system32\kav*.*" >nul 2>nul qQOD
del "C:\WINDOWS\system32\kav*.*" >nul 2>nul ^}Qj}
attrib -s -h -r "C:\ntdelect.com" >nul 2>nul ?[VpN2*
del "C:\ntdelect.com" >nul 2>nul g'ZMV6b?K
attrib -s -h -r "C:\WINDOWS\fly3*.*" >nul 2>nul c~UAr k S
del "C:\WINDOWS\fly3*.*" >nul 2>nul ]}[Yf
attrib -r -s -h -a "c:\found.???" /S /D >nul 2>nul K-
I\P6R`
del "c:\found.???\*.*" /s /q /f >nul 2>nul jD/7/G*
echo. sQ}%7BMK
echo 刪除完成,kavo的病毒已成功解除! oY%"2PW1B
echo. 'sRg4?PT
echo 請按任意鍵以關閉這個視窗(有時要按2下,跟電腦有關)..... H+VO.s.a
pause >nul 2>nul ^r>f2 x
pause >nul 2>nul hG3m7ht
*#lBQBH|.
------------------------------------------------------------------------------------------------------------------------------ N^h|h
-(\1r2
Y
最後再把這兩個檔放到C槽根目錄下...點第一個檔...會提示重開機...重開後再點第二個檔...按照說明做...這樣就行了... qr)v'aC3
]}z'X!v_@
祝大家解毒愉快!~~