@echo off
cls
echo ***********************************************************
echo   此文件用于清除WINLOGON系列木馬并修復其破壞的注冊表信息
echo                 警告：只適用于XP操作系統
echo   空指針 制作     感謝 風亂舞 鼎力相助并提供系統優化功能
echo ***********************************************************
echo    名稱：WINLOGON系列木馬修復程序
echo    功能：
echo        1. 刪除木馬相關文件 
echo        2. 修復被木馬修改的系統關聯
echo        3. 部分系統優化（ADSL撥號.桌面速度.IE速度.等部分系統優化）
echo.        

pause
cls
@SETLOCAL 
@rem 活動代碼頁設為中文 
@chcp 936>nul 2>nul
@echo. 
@echo ************************************************************ 
@echo *                                                          *
@echo *　　　 歡迎使用WINLOGON系列木馬清除/修復程序              *
@echo *                                                          *
@echo ************************************************************ 

:chkOS 
@echo. 
@ver|find "XP"
@if "%ERRORLEVEL%"=="0" goto :XP 
@echo. 
@echo #您的操作系統不是Windows XP，無法使用。 
@goto quit 

@rem 在下面語句插不同系統的不同命令 
:XP 
@set UpdatePolicy=GPUpdate /Force 
@goto Selection 

:Selection 
@rem User Choice 
@echo. 
@echo    請注意選擇您的操作系統安裝在哪個分區
@echo    我要進行功能選擇: 
@echo. 
@echo 1： 我的XP系統安裝在C盤 
@echo 2： 我的XP系統安裝在D盤
@echo 3： 我想做部分系統優化（網絡.桌面.速度）
@echo 4： 退出 
@echo. 
@set /p UserSelection=請輸入您的選擇（1=C盤、2=D盤、3=系統優化、4=退出程序）后按回車: 
@if "%UserSelection%"=="1" goto C 
@if "%UserSelection%"=="2" goto D 
@if "%UserSelection%"=="3" goto good 
@if "%UserSelection%"=="4" goto quit 
@rem 輸入其他字符 
@cls 
@goto Selection 


:C
if exist c:\windows\1.com  attrib -s -r -h c:\windows\1.com
if exist c:\windows\exeroute.exe  attrib -s -r -h c:\windows\exeroute.exe
if exist c:\windows\explorer.com  attrib -s -r -h c:\windows\explorer.com
if exist C:\WINDOWS\EXERT.exe  attrib -s -r -h C:\WINDOWS\EXERT.exe
if exist c:\windows\finder.com attrib -s -r -h c:\windows\finder.com
if exist C:\WINDOWS\IO.SYS.BAK attrib -s -r -h C:\WINDOWS\IO.SYS.BAK
if exist C:\WINDOWS\lsass.exe attrib -s -r -h C:\WINDOWS\lsass.exe
if exist c:\windows\services.exe attrib -s -r -h c:\windows\services.exe
if exist c:\windows\SMSS.EXE attrib -s -r -h c:\windows\SMSS.EXE
if exist c:\windows\WINLOGON.exe attrib -s -r -h c:\windows\WINLOGON.exe
if exist c:\windows\debug\debugprogram.exe attrib -s -r -h c:\windows\debug\debugprogram.exe
if exist c:\progra~1\common~1\iexplore.pif attrib -s -r -h c:\progra~1\common~1\iexplore.pif
if exist c:\progra~1\intern~1\iexplore.com attrib -s -r -h c:\progra~1\intern~1\iexplore.com
if exist c:\windows\system32\command.pif attrib -s -r -h c:\windows\system32\command.pif
if exist c:\windows\system32\dxdiag.com attrib -s -r -h c:\windows\system32\dxdiag.com
if exist c:\windows\system32\finder.com attrib -s -r -h c:\windows\system32\finder.com
if exist c:\windows\system32\i.com attrib -s -r -h c:\windows\system32\i.com
if exist c:\windows\system32\msconfig.com attrib -s -r -h c:\windows\system32\msconfig.com
if exist c:\windows\system32\regedit.com attrib -s -r -h c:\windows\system32\regedit.com
if exist c:\windows\system32\rundll32.com attrib -s -r -h c:\windows\system32\rundll32.com
if exist d:\pagefile.pif attrib -s -r -h d:\pagefile.pif
if exist d:\command.com attrib -s -r -h d:\command.com
if exist d:\autorun.inf attrib -s -r -h d:\autorun.inf

echo ************************************************************
@echo 刪除病毒文件

@echo off
if exist c:\windows\1.com  del c:\windows\1.com
if exist c:\windows\exeroute.exe  del c:\windows\exeroute.exe
if exist c:\windows\explorer.com  del c:\windows\explorer.com
if exist C:\WINDOWS\EXERT.exe  del C:\WINDOWS\EXERT.exe
if exist c:\windows\finder.com del c:\windows\finder.com
if exist C:\WINDOWS\IO.SYS.BAK del C:\WINDOWS\IO.SYS.BAK
if exist C:\WINDOWS\lsass.exe del C:\WINDOWS\lsass.exe
if exist c:\windows\services.exe del c:\windows\services.exe
if exist c:\windows\SMSS.EXE del c:\windows\SMSS.EXE
if exist c:\windows\WINLOGON.exe del c:\windows\WINLOGON.exe
if exist c:\windows\debug\debugprogram.exe del c:\windows\debug\debugprogram.exe
if exist c:\progra~1\common~1\iexplore.pif del c:\progra~1\common~1\iexplore.pif
if exist c:\progra~1\intern~1\iexplore.com del c:\progra~1\intern~1\iexplore.com
if exist c:\windows\system32\command.pif del c:\windows\system32\command.pif
if exist c:\windows\system32\dxdiag.com del c:\windows\system32\dxdiag.com
if exist c:\windows\system32\finder.com del c:\windows\system32\finder.com
if exist c:\windows\system32\i.com del c:\windows\system32\i.com
if exist c:\windows\system32\msconfig.com del c:\windows\system32\msconfig.com
if exist c:\windows\system32\regedit.com del c:\windows\system32\regedit.com
if exist c:\windows\system32\rundll32.com del c:\windows\system32\rundll32.com
if exist d:\pagefile.pif del d:\pagefile.pif
if exist d:\command.com del d:\command.com
if exist d:\autorun.inf del d:\autorun.inf

@echo ***********************************************************
@echo *         已刪除可能的病毒文件,按任意鍵修復注冊表信息     * 
@echo ***********************************************************



@echo Windows Registry Editor Version 5.00>Fix.reg
@echo [HKEY_CLASSES_ROOT\exefile\shell\open\command]>>Fix.reg
@echo @=hex(2):22,00,25,00,31,00,22,00,20,00,25,00,2A,00,00,00>>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe]>>Fix.reg
@echo @="exefile">>Fix.reg
@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command]>>Fix.reg
@echo @=hex(2):22,00,43,00,3A,00,5C,00,50,00,72,00,6F,00,67,00,72,00,61,00,6D,00,20,00,46,00,69,00,6C,00,65,00,73,00,5C,00,49,00,6E,00,74,00,65,00,72,00,6E,00,65,00,74,00,20,00,45,00,78,00,70,00,6C,00,6F,00,72,00,65,00,72,00,5C,00,69,00,65,00,78,00,70,00,6C,00,6F,00,72,00,65,00,2E,00,65,00,78,00,65,00,22,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command]>>Fix.reg
@echo @=hex(2):22,00,43,00,3A,00,5C,00,50,00,72,00,6F,00,67,00,72,00,61,00,6D,00,20,00,46,00,69,00,6C,00,65,00,73,00,5C,00,49,00,6E,00,74,00,65,00,72,00,6E,00,65,00,74,00,20,00,45,00,78,00,70,00,6C,00,6F,00,72,00,65,00,72,00,5C,00,69,00,65,00,78,00,70,00,6C,00,6F,00,72,00,65,00,2E,00,65,00,78,00,65,00,22,00,20,00,25,00,31,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ftp\shell\open\command]>>Fix.reg
@echo @=hex(2):22,00,43,00,3A,00,5C,00,50,00,72,00,6F,00,67,00,72,00,61,00,6D,00,20,00,46,00,69,00,6C,00,65,00,73,00,5C,00,49,00,6E,00,74,00,65,00,72,00,6E,00,65,00,74,00,20,00,45,00,78,00,70,00,6C,00,6F,00,72,00,65,00,72,00,5C,00,69,00,65,00,78,00,70,00,6C,00,6F,00,72,00,65,00,2E,00,65,00,78,00,65,00,22,00,20,00,25,00,31,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\open\command]>>Fix.reg
@echo @=hex(2):22,00,43,00,3A,00,5C,00,50,00,72,00,6F,00,67,00,72,00,61,00,6D,00,20,00,46,00,69,00,6C,00,65,00,73,00,5C,00,49,00,6E,00,74,00,65,00,72,00,6E,00,65,00,74,00,20,00,45,00,78,00,70,00,6C,00,6F,00,72,00,65,00,72,00,5C,00,69,00,65,00,78,00,70,00,6C,00,6F,00,72,00,65,00,2E,00,65,00,78,00,65,00,22,00,20,00,2D,00,6E,00,6F,00,68,00,6F,00,6D,00,65,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\HTTP\shell\open\command]>>Fix.reg
@echo @=hex(2):22,00,43,00,3A,00,5C,00,50,00,72,00,6F,00,67,00,72,00,61,00,6D,00,20,00,46,00,69,00,6C,00,65,00,73,00,5C,00,49,00,6E,00,74,00,65,00,72,00,6E,00,65,00,74,00,20,00,45,00,78,00,70,00,6C,00,6F,00,72,00,65,00,72,00,5C,00,69,00,65,00,78,00,70,00,6C,00,6F,00,72,00,65,00,2E,00,65,00,78,00,65,00,22,00,20,00,2D,00,6E,00,6F,00,68,00,6F,00,6D,00,65,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet]>>Fix.reg
@echo @=hex(2):49,00,45,00,58,00,50,00,4C,00,4F,00,52,00,45,00,2E,00,45,00,58,00,45,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bfc\ShellNew\Command]>>Fix.reg
@echo @=->>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\command]>>Fix.reg
@echo @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,45,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\print\command]>>Fix.reg
@echo @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,45,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,2e,00,65,00,78,00,65,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\Install\command]>>Fix.reg
@echo @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,73,00,65,00,74,00,75,00,70,00,61,00,70,00,69,00,2c,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,48,00,69,00,6e,00,66,00,53,00,65,00,63,00,74,00,69,00,6f,00,6e,00,20,00,44,00,65,00,66,00,61,00,75,00,6c,00,74,00,49,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,20,00,31,00,33,00,32,00,20,00,25,00,31,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command]>>Fix.reg
@echo @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,4f,00,70,00,65,00,6e,00,41,00,73,00,5f,00,52,00,75,00,6e,00,44,00,4c,00,4c,00,20,00,25,00,31,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellNew\Command]>>Fix.reg
@echo @=hex(2):72,00,75,00,6E,00,64,00,6C,00,6C,00,33,00,32,00,2E,00,65,00,78,00,65,00,20,00,61,00,70,00,70,00,77,00,69,00,7A,00,2E,00,63,00,70,00,6C,00,2C,00,4E,00,65,00,77,00,4C,00,69,00,6E,00,6B,00,48,00,65,00,72,00,65,00,20,00,25,00,31,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cplfile\shell\cplopen\command\]>>Fix.reg
@echo @=hex(2):72,00,75,00,6E,00,64,00,6C,00,6C,00,33,00,32,00,2E,00,65,00,78,00,65,00,20,00,73,00,68,00,65,00,6C,00,6C,00,33,00,32,00,2E,00,64,00,6C,00,6C,00,2C,00,43,00,6F,00,6E,00,74,00,72,00,6F,00,6C,00,5F,00,52,00,75,00,6E,00,44,00,4C,00,4C,00,20,00,22,00,25,00,31,00,22,00,2C,00,25,00,2A,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut\shell\open\command\]>>Fix.reg
@echo @=hex(2):72,00,75,00,6E,00,64,00,6C,00,6C,00,33,00,32,00,2E,00,65,00,78,00,65,00,20,00,73,00,68,00,64,00,6F,00,63,00,76,00,77,00,2E,00,64,00,6C,00,6C,00,2C,00,4F,00,70,00,65,00,6E,00,55,00,52,00,4C,00,20,00,6C,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install\command\]>>Fix.reg
@echo @=hex(2):72,00,75,00,6E,00,64,00,6C,00,6C,00,33,00,32,00,2E,00,65,00,78,00,65,00,20,00,64,00,65,00,73,00,6B,00,2E,00,63,00,70,00,6C,00,2C,00,49,00,6E,00,73,00,74,00,61,00,6C,00,6C,00,53,00,63,00,72,00,65,00,65,00,6E,00,53,00,61,00,76,00,65,00,72,00,20,00,6C,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scriptletfile\Shell\Generate Typelib\command\]>>Fix.reg
@echo @=hex(2):22,00,43,00,3A,00,5C,00,57,00,49,00,4E,00,44,00,4F,00,57,00,53,00,5C,00,73,00,79,00,73,00,74,00,65,00,6D,00,33,00,32,00,5C,00,52,00,55,00,4E,00,44,00,4C,00,4C,00,33,00,32,00,2E,00,45,00,58,00,45,00,22,00,20,00,43,00,3A,00,5C,00,57,00,49,00,4E,00,44,00,4F,00,57,00,53,00,5C,00,73,00,79,00,73,00,74,00,65,00,6D,00,33,00,32,00,5C,00,73,00,63,00,72,00,6F,00,62,00,6A,00,2E,00,64,00,6C,00,6C,00,2C,00,47,00,65,00,6E,00,65,00,72,00,61,00,74,00,65,00,54,00,79,00,70,00,65,00,4C,00,69,00,62,00,20,00,22,00,25,00,31,00,22,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\telnet\shell\open\command\]>>Fix.reg
@echo @=hex(2):72,00,75,00,6E,00,64,00,6C,00,6C,00,33,00,32,00,2E,00,65,00,78,00,65,00,20,00,75,00,72,00,6C,00,2E,00,64,00,6C,00,6C,00,2C,00,54,00,65,00,6C,00,6E,00,65,00,74,00,50,00,72,00,6F,00,74,00,6F,00,63,00,6F,00,6C,00,48,00,61,00,6E,00,64,00,6C,00,65,00,72,00,20,00,6C,00,00,00>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]>>Fix.reg
@echo "Shell"="Explorer.exe">>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]>>Fix.reg
@echo "Userinit"=hex(2):43,00,3A,00,5C,00,77,00,69,00,6E,00,64,00,6F,00,77,00,73,00,5C,00,73,00,79,00,73,00,74,00,65,00,6D,00,33,00,32,00,5C,00,75,00,73,00,65,00,72,00,69,00,6E,00,69,00,74,00,2E,00,65,00,78,00,65,00,00,00>>Fix.reg>>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>Fix.reg
@echo "ToP"=->>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>Fix.reg
@echo "TProgram"=->>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]>>Fix.reg
@echo "TProgram"=->>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]>>Fix.reg
@echo "Torjan Program"=->>Fix.reg

@echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices]>>Fix.reg
@echo "Torjan Program"=->>Fix.reg
echo.

@pause
start /w regedit /s Fix.reg
del Fix.reg
echo.
@echo ***********************************************************
@echo *                修復已知被破壞的文件關聯成功               *
@echo ***********************************************************
echo.
@echo 按任意鍵，返回選擇 
@pause 
@cls 
@goto Selection

:D
if exist d:\windows\1.com  attrib -s -r -h d:\windows\1.com
if exist d:\windows\exeroute.exe  attrib -s -r -h d:\windows\exeroute.exe
if exist d:\windows\explorer.com  attrib -s -r -h d:\windows\explorer.com
if exist d:\WINDOWS\EXERT.exe  attrib -s -r -h d:\WINDOWS\EXERT.exe
if exist d:\windows\finder.com attrib -s -r -h d:\windows\finder.com