1, double-click to run Tel.xls.vbs can eliminate TROJAN.WIN32.PATCHED.V virus.
2, the killing using the VBS script, execution efficiency, but lack of intelligence, I do not want to add those if judgment statements to make intelligent judgments, this is not necessary. As long as I analyze the virus and write to kill all is effective, of course, the virus mutated then there is no way, any special kill is so. There are variants to contact me http://hi.baidu.com/ycosxhack.
3, learn how to use the VBS to write their own kill tool can view here:
Http://hi.baidu.com/ycosxhack/blog/item/36569f51dbd0cc8e8c5430d8.html
By cosine function 2007.6.1 There is a shortage in the hope that:
Copy Code code as follows:
On Error Resume Next
MsgBox "This special kill has Ycosxhack provided http://hi.baidu.com/ycosxhack! "," Tel.xls.exe, "kill the virus."
' This special kill template has Ycosxhack (cosine function) production, my blog: http://hi.baidu.com/ycosxhack, Welcome to discuss.
Set W=getobject ("winmgmts:")
Set P=w.execquery ("SELECT * from Win32_Process where name= ' Algsrv.exe ' or name= ' SocksA.exe '")
For all I in P
I.terminate
Next
Set Fso=createobject ("Scripting.FileSystemObject")
Set Del=wscript.createobject ("Wscript.Shell")
Dim d (5)
Dim V (5)
D (0) =del. ExpandEnvironmentStrings ("%systemroot%\system32\socksa.exe")
D (1) =del. ExpandEnvironmentStrings ("%systemroot%\system32\filekan.exe")
D (2) =del. ExpandEnvironmentStrings ("%systemroot%\system32\algsrv.exe")
D (3) =del. ExpandEnvironmentStrings ("%systemroot%\session.exe")
D (4) =del. ExpandEnvironmentStrings ("%systemroot%\backinf.") Tab ")
For i=0 to 1
Set V (i) =fso.getfile (d (i))
V (i). attributes=0
V (i). Delete
Next
Set Fso=createobject ("Scripting.FileSystemObject")
Set Drvs=fso.drives
For each DRV in DRVs
If drv.drivetype=1 or drv.drivetype=2 or drv.drivetype=3 or drv.drivetype=4 then
Set W=fso.getfile (drv.driveletter& ": \tel.xls.exe")
W.attributes=0
W.delete
Set U=fso.getfile (drv.driveletter& ": \autorun. INF ")
U.attributes=0
U.delete
End If
Next
Set Reg=wscript.createobject ("Wscript.Shell")
Reg.regwrite "Hklm\software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall\ CheckedValue ", 1," REG_DWORD "
Reg.regwrite "Hklm\software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall\ DefaultValue ", 2," REG_DWORD "
Reg.regwrite "hklm\software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\nohidden\ CheckedValue ", 2," REG_DWORD "
Reg.regwrite "hklm\software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\nohidden\ DefaultValue ", 2," REG_DWORD "
Reg.regwrite "hklm\software\microsoft\windows\currentversion\explorer\advanced\folder\superhidden\ Uncheckedvalue ", 1," REG_DWORD "
Reg.regwrite "hklm\software\microsoft\windows\currentversion\explorer\advanced\folder\hidefileext\ Uncheckedvalue ", 0," REG_DWORD "
Reg.regdelete "Hklm\software\microsoft\windows\currentversion\run\asocksrv"
'-----------------Autorun virus immune Module-----------------
Set Fso=createobject ("Scripting.FileSystemObject")
Set Drvs=fso.drives
For each DRV in DRVs
If drv.drivetype=1 or drv.drivetype=2 or drv.drivetype=3 or drv.drivetype=4 then
Fso.createfolder (drv.driveletter& ": \autorun.inf")
Fso.createfolder (drv.driveletter& ": \autorun.inf\ Immunization folder. \")
Set Fl=fso.getfolder (drv.driveletter& ": \autorun.inf")
Fl.attributes=3
End If
Next
'-----------------Autorun virus immune Module-----------------
Set fso=nothing
MsgBox "Virus removal successful, please reboot the computer!" ",", "XXX virus specifically killed"
Package file Download
