After writing the "WORM.WIN32.VB.FW Analysis and Removal program", also did not think to write what special kill, but these days many students have said this virus, I if one to solve, not busy dead I do! The scope of infection is very large! I have written a "VBS programming to create their own virus kill tool", VBS relatively familiar point, so this time with a VBS to write a special kill it ... The following code does not understand, please refer to that article about how to write your own virus kill the article bar.
Copy Code code as follows:
On Error Resume Next
Set W=getobject ("winmgmts:")
Set P=w.execquery ("SELECT * from Win32_Process where name= ' Wininit.exe '")
For all I in P
I.terminate
Next
Set Fso=createobject ("Scripting.FileSystemObject")
Set V1=fso.getfile ("C:\windows\system32\systeminit.exe")
Set V2=fso.getfile ("C:\windows\system32\wininit.exe")
Set V3=fso.getfile ("C:\windows\system32\winsystem.exe")
V1.attributes=0
V2.attributes=0
V3.attributes=0
V1.delete
V2.delete
V3.delete
Set Drvs=fso.drives
For each DRV in DRVs
If drv.drivetype=1 or drv.drivetype=2 or drv.drivetype=3 or drv.drivetype=4 then
Set W=fso.getfile (drv.driveletter& ": \kerneldrive.exe")
W.attributes=0
W.delete
Set U=fso.getfile (drv.driveletter& ": \autorun.inf")
U.attributes=0
U.delete
End If
Next
Set Reg=wscript.createobject ("Wscript.Shell")
Reg.regwrite "Hkey_current_user\software\microsoft\windows\currentversion\policies\system\disabletaskmgr", 0, " REG_DWORD "
Reg.regwrite "Hkey_local_machine\system\currentcontrolset\services\sharedaccess\start", 2, "REG_DWORD"
Reg.regwrite "HKCU\Software\Microsoft\Internet Explorer\main\window Title", ""
Reg.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Nt\currentversion\winlogon\userinit", "C:\WINDOWS\ System32\userinit.exe, "
Reg.regdelete "Hklm\software\microsoft\windows\currentversion\run\wininit"
Reg.regdelete "Hkey_current_user\software\microsoft\windows\currentversion\policies\explorer\nofolderoptions"
Fso.getfile ("Regedit.exe"). Copy ("C:\regedit.exe")
Fso.getfile ("cmd.exe"). Copy ("C:\windows\system32\cmd.exe")
Fso.getfile ("Taskmgr.exe"). Copy ("C:\windows\system32\taskmgr.exe")
Fso.getfile ("Msconfig.exe"). Copy ("C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe")
Fso.getfile ("Regedit.exe"). Copy ("C:\WINDOWS\system32\dllcache\regedit.exe")
Fso.getfile ("cmd.exe"). Copy ("C:\WINDOWS\system32\dllcache\cmd.exe")
Fso.getfile ("Taskmgr.exe"). Copy ("C:\WINDOWS\system32\dllcache\taskmgr.exe")
Fso.getfile ("Msconfig.exe"). Copy ("C:\WINDOWS\system32\dllcache\msconfig.exe")
Regedit.exe, Cmd.exe, Taskmgr.exe, Msconfig.exe four files are normal (you can copy these four files from other computers) and place the four files in the same directory as the killvirus.vbs above. Run Killvirus.vbs can!
Writing is not easy to kill, the code for the original ... Hope to respect the fruits of labor ah! Another: VBS write out the special kill really not how, but the effect is very good (against the small virus). Thought so, put up for reference only trial. The above code test passed, very effective! Complete file please go to my network disk download:-) http://ycosxhack.ys168.com/, "Virus Kill" directory, file name "Worm.Win32.VB.fw Kill. RAR (Amendment)".
Add: After using this dedicated kill, restart the computer. Because some registry or other settings to see the effect after the reboot! But the virus certainly did not have this time ... Special Kill correction
