最新病毒之SXS病毒专杀方式，最近挂马严重

摘要：[%repeat_0match="/data/option"%][%=@title%][%=@count%]票[[%=@percent%]％...

[%repeat_0match="/data/option"%][%=@title%][%=@count%]票[[%=@percent%]％]

[%_repeat_0%]

SXS.EXE这是一个盗取QQ帐号密码的木马病毒，特点是可以通过可移动磁盘传播。该病毒的主要危害是盗取QQ帐户和密码；该病毒还会结束大量反病毒软件，降低系统的安全等级。

中毒症状：电脑分区双击不能自动打开或者很难打开，用右键打开可以！这是最显见的症状！

解决方式：网上已经有很多手动删除的方式！

现在有个最简单的方式，如下：

1.把以下红色代码保存成*.bat文件

@echooff

attrib-s-h-r%windir%system32autorun.bat

attrib-s-h-r%windir%system32autorun.bin

attrib-s-h-r%windir%system32autorun.reg

attrib-s-h-r%windir%system32autorun.txt

attrib-s-h-r%windir%system32autorun.vbs

attrib-s-h-r%windir%system32autorun.wsh

del%windir%system32autorun.bat/q

del%windir%system32autorun.bin/q

del%windir%system32autorun.reg/q

del%windir%system32autorun.txt/q

del%windir%system32autorun.vbs/q

del%windir%system32autorun.wsh/q

for/D%%din(c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z)doifexist%%d:nulattrib-s-h-r%%d:autorun.reg

for/D%%din(c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z)doifexist%%d:nulattrib-s-h-r%%d:autorun.bat

for/D%%din(c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z)doifexist%%d:nulattrib-s-h-r%%d:autorun.bin

for/D%%din(c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z)doifexist%%d:nulattrib-s-h-r%%d:autorun.txt

for/D%%din(c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z)doifexist%%d:nulattrib-s-h-r%%d:autorun.wsh

for/D%%din(c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z)doifexist%%d:nulattrib-s-h-r%%d:autorun.vbs

for/D%%din(c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z)doifexist%%d:nuldel%%d:autorun.vbs/q

for/D%%din(c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z)doifexist%%d:nuldel%%d:autorun.txt/q

for/D%%din(c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z)doifexist%%d:nuldel%%d:autorun.reg/q

for/D%%din(c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z)doifexist%%d:nuldel%%d:autorun.bin/q

for/D%%din(c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z)doifexist%%d:nuldel%%d:autorun.wsh/q

for/D%%din(c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z)doifexist%%d:nuldel%%d:autorun.bat/q

attrib+s+h+rc:NTDETECT.COM

regadd"HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced"/vShowSuperHidden/treg_dword/d1/f

regadd"HKLMSOFTWAREMicrosoftWindowsNTCurrentVersionWinlogon"/vUserinit/d"C:WINDOWSsystem32userinit.exe,"/f

regdelete"HKCUSoftwareMicrosoftWindowsScriptHost"/f

regadd"HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerCLSID{645FF040-5081-101B-9F08-00AA002F954E}DefaultIcon"/vEmpty/treg_expand_sz/d"%SystemRoot%System32shell32.dll,31"/f

regadd"HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerCLSID{645FF040-5081-101B-9F08-00AA002F954E}DefaultIcon"/vFull/treg_expand_sz/d"%SystemRoot%System32shell32.dll,32"/f

cls

set/ptmp=按回车开始解决分区无法双击打开的错误.

@echooff

title忆林子

color0a

echo例如：D盘无法打开则输入d

set/pinput=[请输入无法打开的分区的盘符]

if/i"%input%"=="c"goto:特殊

attrib-s-h-r%input%:autorun.inf

cls

del%input%:autorun.inf/q

cls