清除oxjsybe病毒(病毒源文件包括psdoawu.inf,meex.exe,eleicnd.exe,asgwmne.exe,oxjsybe.exe等)

把下面的代码复制下来，另存为.bat后后缀的文件也就是批处理文件啦，然后双击运行保存的批处理就可以了，其实这个病毒和hsomklg病毒似，是同门兄弟。

 

@echo off
title 忆林子
color 0a
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
echo.
echo                                    该病毒资料
echo.
echo    该病毒建立的包括的源文件如下:
echo.
echo    病毒文件全路径                                                 大小(字节)
echo    C:/Program Files/psdoawu.inf                                   169
echo    C:/Program Files/meex.exe                                      25,392
echo    c:/Program Files/Common Files/Microsoft Shared/eleicnd.exe     25,392
echo    C:/Program Files/Common Files/System/asgwmne.exe               25,392
echo    其它所有分区:/autorun.inf                                      169
echo    其它所有分区:/oxjsybe.exe                                      25,392
echo.
echo     autorun.inf和psdoawu.inf文件里的内容
echo.
echo      [AutoRun]
echo      open=oxjsybe.exe
echo      shell/open=打开(^&O)
echo      shell/open/Command=oxjsybe.exe
echo      shell/open/Default=1
echo      shell/explore=资源管理器(^&X)
echo      shell/explore/Command=oxjsybe.exe
echo.
echo   该病毒的后果:
echo   你的杀毒软件会无法打开,另外只要你的文件名中如果是"病毒","杀毒","瑞星"等和病毒.
echo   有关的字眼时,你这个文件打开之后会马上被关闭.网页中一搜索这些字眼也会马上关闭.
echo   可能还有其它的情况,我这里就不详细说明了.
echo.
echo   注意：因为该病毒与exeplorer.exe关联，所以在杀毒时，你的桌面
echo        会出现暂时只剩背景图片，那时请不要结束该程序，让它继续运行。
echo        到该程序运行结束之后，会自然显示出桌面的。
echo.
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
echo.
set /p tmp=以上是该病毒的信息，如果要清除该病毒，请回车键开始杀毒...

rem 结束病毒进程
for %%d in (eleicnd.exe,asgwmne.exe,oxjsybe.exe,meex.exe) do taskkill /im %%d /f

rem 去除病毒源文件的 系统、隐藏、只读 属性,然后删除它们。
for %%d in (psdoawu.inf,meex.exe) do if exist "C:/Program Files/%%d" attrib -s -h -r "C:/Program Files/%%d"
for %%d in (psdoawu.inf,meex.exe) do if exist "C:/Program Files/%%d" del "C:/Program Files/%%d" /q
if exist "C:/Program Files/Common Files/Microsoft Shared/eleicnd.exe" attrib -s -h -r "C:/Program Files/Common Files/Microsoft Shared/eleicnd.exe"
if exist "C:/Program Files/Common Files/Microsoft Shared/eleicnd.exe" del "C:/Program Files/Common Files/Microsoft Shared/eleicnd.exe" /q
if exist "C:/Program Files/Common Files/System/asgwmne.exe" attrib -s -h -r "C:/Program Files/Common Files/System/asgwmne.exe"
if exist "C:/Program Files/Common Files/System/asgwmne.exe" del "C:/Program Files/Common Files/System/asgwmne.exe" /q
for %%f in (autorun.inf,oxjsybe.exe) do for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:/%%f attrib -s -h -r %%d:/%%f
for %%f in (autorun.inf,oxjsybe.exe) do for /D %%d in (c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:/%%f del %%d:/%%f /q

rem 添加进入安全模式的注册表项
reg add "HKLM/SYSTEM/ControlSet001/Control/SafeBoot/Minimal/{4D36E967-E325-11CE-BFC1-08002BE10318}" /ve /d DiskDrive /f
reg add "HKLM/SYSTEM/ControlSet001/Control/SafeBoot/Network/{4D36E967-E325-11CE-BFC1-08002BE10318}" /ve /d DiskDrive /f
reg add "HKLM/SYSTEM/ControlSet003/Control/SafeBoot/Minimal/{4D36E967-E325-11CE-BFC1-08002BE10318}" /ve /d DiskDrive /f
reg add "HKLM/SYSTEM/ControlSet003/Control/SafeBoot/Network/{4D36E967-E325-11CE-BFC1-08002BE10318}" /ve /d DiskDrive /f
reg add "HKLM/SYSTEM/CurrentControlSet/Control/SafeBoot/Minimal/{4D36E967-E325-11CE-BFC1-08002BE10318}" /ve /d DiskDrive /f
reg add "HKLM/SYSTEM/CurrentControlSet/Control/SafeBoot/Network/{4D36E967-E325-11CE-BFC1-08002BE10318}" /ve /d DiskDrive /f

rem 添加显示隐藏文件的注册表项
reg delete "HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Advanced/Folder/Hidden/SHOWALL" /v CheckedValue /f
reg add "HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Advanced/Folder/Hidden/SHOWALL" /v CheckedValue /t reg_dword /d 1 /f

rem 删除由病毒添加的启动项
reg delete "HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run" /v oxjsybe /f
reg delete "HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run" /v psdoawu /f

rem 删除病毒添加的禁用杀毒软件的关联
set RegDeleteIFEO=reg delete "HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File Execution Options
%RegDeleteIFEO%/360rpt.exe" /v Debugger /f
%RegDeleteIFEO%/360Safe.exe" /v Debugger /f
%RegDeleteIFEO%/360tray.exe" /v Debugger /f
%RegDeleteIFEO%/adam.exe" /v Debugger /f
%RegDeleteIFEO%/AgentSvr.exe" /v Debugger /f
%RegDeleteIFEO%/AppSvc32.exe" /v Debugger /f
%RegDeleteIFEO%/ArSwp.exe" /v Debugger /f
%RegDeleteIFEO%/AST.exe" /v Debugger /f
%RegDeleteIFEO%/autoruns.exe" /v Debugger /f
%RegDeleteIFEO%/avconsol.exe" /v Debugger /f
%RegDeleteIFEO%/avgrssvc.exe" /v Debugger /f
%RegDeleteIFEO%/AvMonitor.exe" /v Debugger /f
%RegDeleteIFEO%/avp.com" /v Debugger /f
%RegDeleteIFEO%/avp.exe" /v Debugger /f
%RegDeleteIFEO%/CCenter.exe" /v Debugger /f
%RegDeleteIFEO%/ccSvcHst.exe" /v Debugger /f
%RegDeleteIFEO%/EGHOST.exe" /v Debugger /f
%RegDeleteIFEO%/FileDsty.exe" /v Debugger /f
%RegDeleteIFEO%/FTCleanerShell.exe" /v Debugger /f
%RegDeleteIFEO%/FYFireWall.exe" /v Debugger /f
%RegDeleteIFEO%/HijackThis.exe" /v Debugger /f
%RegDeleteIFEO%/IceSword.exe" /v Debugger /f
%RegDeleteIFEO%/iparmo.exe" /v Debugger /f
%RegDeleteIFEO%/Iparmor.exe" /v Debugger /f
%RegDeleteIFEO%/isPwdSvc.exe" /v Debugger /f
%RegDeleteIFEO%/kabaload.exe" /v Debugger /f
%RegDeleteIFEO%/KaScrScn.SCR" /v Debugger /f
%RegDeleteIFEO%/KASMain.exe" /v Debugger /f
%RegDeleteIFEO%/KASTask.exe" /v Debugger /f
%RegDeleteIFEO%/KAV32.exe" /v Debugger /f
%RegDeleteIFEO%/KAVDX.exe" /v Debugger /f
%RegDeleteIFEO%/KAVPF.exe" /v Debugger /f
%RegDeleteIFEO%/KAVPFW.exe" /v Debugger /f
%RegDeleteIFEO%/KAVSetup.exe" /v Debugger /f
%RegDeleteIFEO%/KAVStart.exe" /v Debugger /f
%RegDeleteIFEO%/KISLnchr.exe" /v Debugger /f
%RegDeleteIFEO%/KMailMon.exe" /v Debugger /f
%RegDeleteIFEO%/KMFilter.exe" /v Debugger /f
%RegDeleteIFEO%/KPFW32.exe" /v Debugger /f
%RegDeleteIFEO%/KPFW32X.exe" /v Debugger /f
%RegDeleteIFEO%/KPFWSvc.exe" /v Debugger /f
%RegDeleteIFEO%/KRegEx.exe" /v Debugger /f
%RegDeleteIFEO%/KRepair.COM" /v Debugger /f
%RegDeleteIFEO%/KsLoader.exe" /v Debugger /f
%RegDeleteIFEO%/KVCenter.kxp" /v Debugger /f
%RegDeleteIFEO%/KvDetect.exe" /v Debugger /f
%RegDeleteIFEO%/KvfwMcl.exe" /v Debugger /f
%RegDeleteIFEO%/KVMonXP.kxp" /v Debugger /f
%RegDeleteIFEO%/KVMonXP_1.kxp" /v Debugger /f
%RegDeleteIFEO%/kvol.exe" /v Debugger /f
%RegDeleteIFEO%/kvolself.exe" /v Debugger /f
%RegDeleteIFEO%/KvReport.kxp" /v Debugger /f
%RegDeleteIFEO%/KVScan.kxp" /v Debugger /f
%RegDeleteIFEO%/KVSrvXP.exe" /v Debugger /f
%RegDeleteIFEO%/KVStub.kxp" /v Debugger /f
%RegDeleteIFEO%/kvupload.exe" /v Debugger /f
%RegDeleteIFEO%/kvwsc.exe" /v Debugger /f
%RegDeleteIFEO%/KvXP.kxp" /v Debugger /f
%RegDeleteIFEO%/KvXP_1.kxp" /v Debugger /f
%RegDeleteIFEO%/KWatch.exe" /v Debugger /f
%RegDeleteIFEO%/KWatch9x.exe" /v Debugger /f
%RegDeleteIFEO%/KWatchX.exe" /v Debugger /f
%RegDeleteIFEO%/loaddll.exe" /v Debugger /f
%RegDeleteIFEO%/MagicSet.exe" /v Debugger /f
%RegDeleteIFEO%/mcconsol.exe" /v Debugger /f
%RegDeleteIFEO%/mmqczj.exe" /v Debugger /f
%RegDeleteIFEO%/mmsk.exe" /v Debugger /f
%RegDeleteIFEO%/Navapsvc.exe" /v Debugger /f
%RegDeleteIFEO%/Navapw32.exe" /v Debugger /f
%RegDeleteIFEO%/nod32.exe" /v Debugger /f
%RegDeleteIFEO%/nod32krn.exe" /v Debugger /f
%RegDeleteIFEO%/nod32kui.exe" /v Debugger /f
%RegDeleteIFEO%/NPFMntor.exe" /v Debugger /f
%RegDeleteIFEO%/PFW.exe" /v Debugger /f
%RegDeleteIFEO%/PFWLiveUpdate.exe" /v Debugger /f
%RegDeleteIFEO%/QHSET.exe" /v Debugger /f
%RegDeleteIFEO%/QQDoctor.exe" /v Debugger /f
%RegDeleteIFEO%/QQKav.exe" /v Debugger /f
%RegDeleteIFEO%/Ras.exe" /v Debugger /f
%RegDeleteIFEO%/Rav.exe" /v Debugger /f
%RegDeleteIFEO%/RavMon.exe" /v Debugger /f
%RegDeleteIFEO%/RavMonD.exe" /v Debugger /f
%RegDeleteIFEO%/RavStub.exe" /v Debugger /f
%RegDeleteIFEO%/RavTask.exe" /v Debugger /f
%RegDeleteIFEO%/RegClean.exe" /v Debugger /f
%RegDeleteIFEO%/rfwcfg.exe" /v Debugger /f
%RegDeleteIFEO%/RfwMain.exe" /v Debugger /f
%RegDeleteIFEO%/rfwsrv.exe" /v Debugger /f
%RegDeleteIFEO%/RsAgent.exe" /v Debugger /f
%RegDeleteIFEO%/Rsaupd.exe" /v Debugger /f
%RegDeleteIFEO%/runiep.exe" /v Debugger /f
%RegDeleteIFEO%/safelive.exe" /v Debugger /f
%RegDeleteIFEO%/scan32.exe" /v Debugger /f
%RegDeleteIFEO%/shcfg32.exe" /v Debugger /f
%RegDeleteIFEO%/SmartUp.exe" /v Debugger /f
%RegDeleteIFEO%/SREng.exe" /v Debugger /f
%RegDeleteIFEO%/symlcsvc.exe" /v Debugger /f
%RegDeleteIFEO%/SysSafe.exe" /v Debugger /f
%RegDeleteIFEO%/TrojanDetector.exe" /v Debugger /f
%RegDeleteIFEO%/Trojanwall.exe" /v Debugger /f
%RegDeleteIFEO%/TrojDie.kxp" /v Debugger /f
%RegDeleteIFEO%/UIHost.exe" /v Debugger /f
%RegDeleteIFEO%/UmxAgent.exe" /v Debugger /f
%RegDeleteIFEO%/UmxAttachment.exe" /v Debugger /f
%RegDeleteIFEO%/UmxCfg.exe" /v Debugger /f
%RegDeleteIFEO%/UmxFwHlp.exe" /v Debugger /f
%RegDeleteIFEO%/UmxPol.exe" /v Debugger /f
%RegDeleteIFEO%/upiea.exe" /v Debugger /f
%RegDeleteIFEO%/UpLive.exe" /v Debugger /f
%RegDeleteIFEO%/USBCleaner.exe" /v Debugger /f
%RegDeleteIFEO%/vsstat.exe" /v Debugger /f
%RegDeleteIFEO%/webscanx.exe" /v Debugger /f
%RegDeleteIFEO%/WoptiClean.exe" /v Debugger /f
cls
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
echo.
echo       病毒清除完毕，按回车键开始解决分区无法双击打开的问题.
echo.
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
set /p test=
cls
@echo   off
title 忆林子--解决分区无法打开
color 0a
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
echo.
echo       例如：D盘无法打开则输入 d,你也可以
echo       输入d,e,f这样来同时对d,e,f等多个分区操作.
echo.
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
set /p input=[请输入无法打开的分区的盘符]
if /i "%input%"=="c" goto :特殊
for /d %%i in (%input%) do cacls %%i:/autorun.inf /c /e /p everyone:f
for /d %%i in (%input%) do attrib -s -h -r %%i:/autorun.inf
for /d %%i in (%input%) do del %%i:/autorun.inf /q
cls
for /d %%i in (%input%) do chkdsk %%i: /f /x
cls
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
echo.
set /p tmp=         操作结束,按回车键退出该程序。

:exit
exit

:特殊
attrib -s -h -r %input%:/autorun.inf
del %input%:/autorun.inf /q
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
echo.
echo        操作成功结束，请重启，然后就可以双击就可以打开了。
echo        如果重启之后，还是无法双击打开的话，说明你的电脑
echo        里还有病毒，请先杀毒。然后再运行该程序。
echo.
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
set /p tmp=        操作结束，按回车键退出该程序。