After writing "worm. win32.vb. after the FW analysis and cleanup plan, I did not expect to write special bans. However, many people have mentioned this virus these days. If I solve it one by one, I am not busy! The scope of infection is quite large! I have previously written an article "vbs programming to build your own virus exclusive tool". vbs is a little familiar with it, so this time I will use vbs to write an exclusive tool ...... BelowCodePlease refer to the article about how to write your own virus killingArticleRight.
Copy code The Code is as follows: on error resume next
Set W = GetObject ("winmgmts :")
Set p1_w.exe cquery ("select * From win32_process where name1_'wininit.exe '")
For each I in P
I. Terminate
Next
Set FSO = Createobject ("scripting. FileSystemObject ")
Set V1 = FSO. GetFile ("C: \ windows \ system32 \ systeminit.exe ")
Set v2 = FSO. GetFile ("C: \ windows \ system32 \ wininit.exe ")
Set V3 = FSO. GetFile ("C: \ windows \ system32 \ winsystem.exe ")
V1.attributes = 0
V2.attributes = 0
V3.attributes = 0
V1.delete
V2.delete
V3.delete
Set drvs = FSO. Drives
For each DRV in drvs
If DRV. drivetype = 1 or DRV. drivetype = 2 or DRV. drivetype = 3 or DRV. drivetype = 4 then
Set W = FSO. GetFile (DRV. driveletter & ": \ kerneldrive.exe ")
W. Attributes = 0
W. Delete
Set u = FSO. GetFile (DRV. driveletter & ": \ autorun. inf ")
U. Attributes = 0
U. Delete
End if
Next
Set Reg = wscript. Createobject ("wscript. Shell ")
Reg. regwrite "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \ disabletaskmgr", 0, "REG_DWORD"
Reg. regwrite "HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ sharedaccess \ Start", 2, "REG_DWORD"
Reg. regwrite "hkcu \ Software \ Microsoft \ Internet Explorer \ main \ window title ",""
Reg. regwrite "HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ userinit", "C: \ windows \ system32 \ userinit.exe ,"
Reg. regdelete "HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Run \ wininit"
Reg. regdelete "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer \ nofolderoptions"
FSO. GetFile ("regedit.exe"). Copy ("C: \ regedit.exe ")
FSO. GetFile ("cmd.exe"). Copy ("C: \ windows \ system32 \ cmd.exe ")
FSO. GetFile ("taskmgr.exe"). Copy ("C: \ windows \ system32 \ taskmgr.exe ")
FSO. GetFile ("msconfig.exe"). Copy ("C: \ WINDOWS \ pchealth \ helpctr \ binaries \ msconfig.exe ")
FSO. GetFile ("regedit.exe"). Copy ("C: \ windows \ system32 \ dllcache \ regedit.exe ")
FSO. GetFile ("cmd.exe"). Copy ("C: \ windows \ system32 \ dllcache \ cmd.exe ")
FSO. GetFile ("taskmgr.exe"). Copy ("C: \ windows \ system32 \ dllcache \ taskmgr.exe ")
FSO. GetFile ("msconfig.exe"). Copy ("C: \ windows \ system32 \ dllcache \ msconfig.exe ")
regedit.exe00000000.exe0000taskmgr.exe0000msconfig.exe is normal (you can copy these four files from other computers). Put these four files and the preceding killvirus. vbs files in the same directory. Run killvirus. vbs!
it is not easy to write the code to kill. The code is original ...... We hope to respect the fruits of our work! What's more, the exclusive killer written by vbs is really not good, but the effect is still quite good (dealing with small viruses ). The idea is so, it is for reference only. The code above has been tested and is very effective! For full files, go to my online storage and download it at: -) modify )".
supplement: restart the computer after using this killing rule. Because some registry or other settings must be effective after restart! But the virus is definitely gone ...... Killing and correcting
