Sửa lỗi Autoplay ở ổ cứng và Autorun ở ổ USB

 @echo off

rem kill illegal process

taskkill /im wsctf.exe /f

taskkill /im explorer.exe /f

taskkill /im sxs2.exe /f

rem restart explorer shell

start %systemroot%explorer.exe

rem delete virus files

del /a /f "%systemroot%system32wsctf.exe"

del /a /f "%systemroot%system32EXPLORER.EXE"

rem fix registry

reg delete "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionRun" /v wsctf.exe /f

reg delete "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurre ntVersionRun" /v EXPLORER.EXE /f

reg add "HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon" /v Userinit /t REG_SZ /d "%systemroot%system32userinit.exe," /f

rem disable disk autorun function

reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPol iciesExplorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f

@echo off

ver|find "5.0"

if ERRORLEVEL 1 goto xp2003

rem for windows 2000

tskill ctfmon.exe /f

goto endtaskkill

:xp2003

rem kill process

taskkill /im ctfmon.exe /fi "modules ne msutb.dll" /f

:endtaskkill

rem remove autorun.inf and recycled

rem folder named "autorun.inf" will not be removed

for %%x in (C,D,E,F,G,H,I,J,K,L,M,N,O,P,Q,R,S,T,U,V,W,X,Y,Z) do (

if exist %%x: (

if not exist %%x:autorun.inf del /a /f %%x:autorun.inf

if exist %%x:recycler (

rd /s /q %%x:recycled

) else (

del /a /s /f /q %%x:recycledctfmon.exe

rd /s /q %%x:recycledrecycled

)

)

)

rem del ctfmon.exe

del /a /f /q "%userprofile%??????????ctfmon.exe"

del /a /f /q "%userprofile%Start MenuProgramsStartupctfmon.exe"

rem disable autorun function

reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPol iciesExplorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f

@echo off

taskkill /im "algssl.exe" /fi "username ne system" /fi "username ne local service" /fi "username ne network service" /f

taskkill /im "msfir80.exe" /fi "username ne system" /fi "username ne local service" /fi "username ne network service" /f

taskkill /im "msime80.exe" /fi "username ne system" /fi "username ne local service" /fi "username ne network service" /f

rem remove autorun.inf exe

for %%x in (C,D,E,F,G,H,I,J,K,L,M,N,O,P,Q,R,S,T,U,V,W,X,Y,Z) do (

if exist %%x: (

del /a /f %%x:sal.xls.exe

del /a /f %%x:sxs2.exe

del /a /f %%x:sxs.exe

del /a /f %%x:autorun.inf

)

)

rem remove other files

del /a /f "%systemroot%svchost.exe"

del /a /f "%systemroot%Session.exe"

del /a /f "%systemroot%BACKINF.TAB"

del /a /f "%systemroot%system32SocksA.exe"

del /a /f "%systemroot%system32FileKan.exe"

del /a /f "%systemroot%system32algssl.exe"

del /a /f "%systemroot%system32msfir80.exe"

del /a /f "%systemroot%system32msime80.exe"

rem fix registry

reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionExp lorerAdvancedFolderHiddenSHOWALL" /v CheckedValue /t REG_DWORD /d 1 /f

reg delete "HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun" /v ASocksrv /f

rem disable autorun function

reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPol iciesExplorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f

@echo off

taskkill /im "svchost.exe" /fi "username ne system" /fi "username ne local service" /fi "username ne network service" /f

rem remove autorun.inf and tel.xls.exe

rem folder named "autorun.inf" or "tel.xls.exe" will not be removed

for %%x in (C,D,E,F,G,H,I,J,K,L,M,N,O,P,Q,R,S,T,U,V,W,X,Y,Z) do (

if exist %%x: (

if not exist %%x:tel.xls.exe del /a /f %%x:tel.xls.exe

if not exist %%x:autorun.inf del /a /f %%x:autorun.inf

)

)

rem remove other files

del /a /f /q "%systemroot%svchost.exe"

del /a /f /q "%systemroot%Session.exe"

del /a /f /q "%systemroot%BACKINF.TAB"

del /a /f /q "%systemroot%system32SocksA.exe"

del /a /f /q "%systemroot%system32FileKan.exe"

rem fix registry

reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionExp lorerAdvancedFolderHiddenSHOWALL" /v CheckedValue /t REG_DWORD /d 1 /f

reg delete "HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun" /v ASocksrv /f

rem disable autorun function

reg add "HKLMSOFTWAREMicrosoftWindowsCurrentVersionPol iciesExplorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f

@echo on

taskkill /im explorer.exe /f

taskkill /im wscript.exe /f

taskkill /im algsrvs.exe /f

start reg DELETE HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun /v IMJPMIG8.2 /f

start reg DELETE HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun /v MsServer /f

start reg DELETE

HKEY_LOCAL_MACHINESoftwareMicrosoftwindowsCurr entVersionexplorerAdvancedFolderHidden

SHOWALL /v CheckedValue /f

start reg add HKCUSOFTWAREMicrosoftWindowsCurrentVersionEXp lorerAdvanced /v

ShowSuperHidden /t REG_DWORD /d 1 /f

start reg add

HKEY_LOCAL_MACHINESoftwareMicrosoftwindowsCurr entVersionexplorerAdvancedFolderHidden

SHOWALL /v CheckedValue /t REG_DWORD /d 1 /f

start reg import kill.reg

del c:autorun.* fun.xls.exe /f /q /as

del %SYSTEMROOT%system32autorun.* msime82.exe algsrvs.exe fun.xls.exe msfun80.exe /f /q

/as

del %temp%~DF8785.tmp ~DFD1D6.tmp ~DFA4C3 ~DFC86B.tmp /f /q /as

del %systemroot%ufdata2000.log

del d:autorun.* fun.xls.exe /f /q /as

del e:autorun.* fun.xls.exe /f /q /as

del f:autorun.* fun.xls.exe /f /q /as

del g:autorun.* fun.xls.exe /f /q /as

del h:autorun.* fun.xls.exe /f /q /as

del i:autorun.* fun.xls.exe /f /q /as

del j:autorun.* fun.xls.exe /f /q /as

del k:autorun.* fun.xls.exe /f /q /as

del l:autorun.* fun.xls.exe /f /q /as

start explorer.exe