Autorun.inf virüsü ve flash disk virüslerini temizleme (Test Edilmiştir %100)

İki tane Biri temizle.bat  biri  kill.vbs adında dosya oluşturacağız.

Aşağıdaki Kodları bir temizle.bat diye bach file yapıyoruz.

copy kill.* C:\ /y
c:
cd \
echo Lütfen gelen mesajlarda TAMAM a basarak devam ediniz....
pause
kill
attrib -r -h -s autoru*.*
del autoru*.*
cd %temp%
del *.* /f /q
cd \windows\temp
del *.* /f /q
cd \windows\apppatch
del acllayer.dll /f
del AcXtrnel.bpl /f
del DesktopWin.dll /f
cd \windows
del update.dll /f
del p_981116.exe /f
cd \windows\system32
attrib -r -h -s ckv*.*
del ckv*.*
attrib -r -h -s kav*.*
del kav*.*
attrib -r -h -s amv*.*
del amv*.*
cd\
attrib -r -h -s 1*.*
del 1*.*
attrib -r -h -s 6*.*
del 6*.*
attrib -r -h -s 8*.*
del 8*.*

attrib -r -h -s d*.com
del d*.com
attrib -r -h -s d*.exe
del d*.exe
attrib -r -h -s d*.bat
del d*.bat
attrib -r -h -s d*.cmd
del d*.cmd

attrib -r -h -s e*.com
del e*.com
attrib -r -h -s e*.exe
del e*.exe
attrib -r -h -s e*.bat
del e*.bat
attrib -r -h -s e*.cmd
del e*.cmd

attrib -r -h -s f*.com
del f*.com
attrib -r -h -s f*.exe
del f*.exe
attrib -r -h -s f*.bat
del f*.bat
attrib -r -h -s f*.cmd
del f*.cmd

attrib -r -h -s g*.com
del g*.com
attrib -r -h -s i*.bat
del i*.bat
attrib -r -h -s i*.com
del i*.com
attrib -r -h -s i*.exe
del i*.exe
attrib -r -h -s i*.cmd
del i*.cmd

attrib -r -h -s k*.com
del k*.com
attrib -r -h -s k*.exe
del k*.exe
attrib -r -h -s k*.bat
del k*.bat
attrib -r -h -s k*.cmd
del k*.cmd

attrib -r -h -s nj*.com
del nj*.com
attrib -r -h -s s*.cmd
del s*.cmd

d:
cd\
attrib -r -h -s 1*.*
del 1*.*
attrib -r -h -s 6*.*
del 6*.*
attrib -r -h -s 8*.*
del 8*.*

attrib -r -h -s d*.com
del d*.com
attrib -r -h -s d*.exe
del d*.exe
attrib -r -h -s d*.bat
del d*.bat
attrib -r -h -s d*.cmd
del d*.cmd

attrib -r -h -s e*.com
del e*.com
attrib -r -h -s e*.exe
del e*.exe
attrib -r -h -s e*.bat
del e*.bat
attrib -r -h -s e*.cmd
del e*.cmd

attrib -r -h -s f*.com
del f*.com
attrib -r -h -s f*.exe
del f*.exe
attrib -r -h -s f*.bat
del f*.bat
attrib -r -h -s f*.cmd
del f*.cmd

attrib -r -h -s g*.com
del g*.com
attrib -r -h -s i*.bat
del i*.bat
attrib -r -h -s i*.com
del i*.com
attrib -r -h -s i*.exe
del i*.exe
attrib -r -h -s i*.cmd
del i*.cmd

attrib -r -h -s k*.com
del k*.com
attrib -r -h -s k*.exe
del k*.exe
attrib -r -h -s k*.bat
del k*.bat
attrib -r -h -s k*.cmd
del k*.cmd

attrib -r -h -s nj*.com
del nj*.com
attrib -r -h -s s*.cmd
del s*.cmd

e:
cd\
attrib -r -h -s 1*.*
del 1*.*
attrib -r -h -s 6*.*
del 6*.*
attrib -r -h -s 8*.*
del 8*.*

attrib -r -h -s d*.com
del d*.com
attrib -r -h -s d*.exe
del d*.exe
attrib -r -h -s d*.bat
del d*.bat
attrib -r -h -s d*.cmd
del d*.cmd

attrib -r -h -s e*.com
del e*.com
attrib -r -h -s e*.exe
del e*.exe
attrib -r -h -s e*.bat
del e*.bat
attrib -r -h -s e*.cmd
del e*.cmd

attrib -r -h -s f*.com
del f*.com
attrib -r -h -s f*.exe
del f*.exe
attrib -r -h -s f*.bat
del f*.bat
attrib -r -h -s f*.cmd
del f*.cmd

attrib -r -h -s g*.com
del g*.com
attrib -r -h -s i*.bat
del i*.bat
attrib -r -h -s i*.com
del i*.com
attrib -r -h -s i*.exe
del i*.exe
attrib -r -h -s i*.cmd
del i*.cmd

attrib -r -h -s k*.com
del k*.com
attrib -r -h -s k*.exe
del k*.exe
attrib -r -h -s k*.bat
del k*.bat
attrib -r -h -s k*.cmd
del k*.cmd

attrib -r -h -s nj*.com
del nj*.com
attrib -r -h -s s*.cmd
del s*.cmd

 

echo Temizleme tamamlanmıştır lütfen bir tuşa basınız.....
PAUSE

 

 

Tekrar aşagıdaki kodları kill.vbs isimli script olarak kayıt ediyoruz.

 

on Error Resume Next

Dim objShell, objFileSystem, objTextStream, objRegex
Dim colRegexMatches1, colRegexMatches2
Dim nReturnCode
Dim strIpFileText
Dim element, i

Dim Lista
Lista=array("n1de?ect.com","nide?ect.com","nlde?ect.com","j*.bat","m*.com","d*.com","copy.exe","host.exe",_
     "a0*.com","ntdeiect.com","ntdelect.com", "u?de*.com","ntde1ect.com", "x*.com", "tio*.*",_
            "80*.com","semo*.exe")

Set geekside=WScript.CreateObject("WScript.Shell")
Set objShell = WScript.CreateObject("WScript.Shell")
Set objFileSystem = CreateObject("Scripting.FileSystemObject")

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set colDrives = objFSO.Drives

Wscript.Echo "Bu yazılım amvo, avpo, n1detect ckvo kavo türündeki zararlı yazılımları temizlemek için yazılmıştır."
Wscript.Echo "Arama ve temizleme işlemi birkaç dakika sürecektir."

i=0
For Each objDrive in colDrives
 If objDrive.IsReady = True Then
  nret=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\autorun.inf",0,TRUE)
  Set objTextStream = objFileSystem.OpenTextFile(objDrive.DriveLetter&":\autorun.inf",1)
  strIpFileText = objTextStream.ReadAll
  objTextStream.Close
 End If
Next

Set objRegex = new RegExp

objRegex.Pattern = "=\w+(.com|.bat|.exe|.pif|.scr|.svd|.dat|.tmp)"
objRegex.Global = True
objRegex.IgnoreCase = True
Set colRegexMatches1 = objRegex.Execute(strIpFileText)

 

i=0
For Each element In colRegexMatches1
 element = Replace(element,"=","")
 WScript.Echo "Temizlenecek virüs dosyasının adı:" & element
 For Each objDrive in colDrives
  If objDrive.IsReady = True Then
   Wscript.Echo "Temizlenen sürücü: " & objDrive.DriveLetter

   nret=geekside.Run("cmd /C taskkill /f /im amvo.exe",0,TRUE)
   nret=geekside.Run("cmd /C taskkill /f /im avpo.exe",0,TRUE)
   nret=geekside.Run("cmd /C taskkill /f /im ckvo0.exe",0,TRUE)
   nret=geekside.Run("cmd /C taskkill /f /im ckvo.exe",0,TRUE)
   nret=geekside.Run("cmd /C taskkill /f /im kavo.exe",0,TRUE)
 
   nret=geekside.Run("cmd /C taskkill /f /im semo2x.exe.tmp",0,TRUE)
   nret=geekside.Run("cmd /C taskkill /f /im semo2x.exe",0,TRUE)
   nret=geekside.Run("cmd /C taskkill /f /im help.exe.tmp",0,TRUE)

   nret=geekside.Run("cmd /C attrib -s -h -r " &objDrive.DriveLetter&":\" & element &"",0,TRUE)
   nret=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\" & element & "/f /q /a",0,TRUE)
   nret=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\autorun.inf",0,TRUE)

  End If
 Next
 i = i + 1
Next
 

Set objRegex= Nothing
Set objTextStream = Nothing
Set objFileSystem = Nothing
Set objShell = Nothing

 nret15=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\amvo*.*",0,TRUE)
 nret16=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\avpo*.*",0,TRUE)
 nret17=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\ckv*.*",0,TRUE)
 nret18=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\kav*.*",0,TRUE)
 nret20=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\help.exe.tmp",0,TRUE)
 

 nret56=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\semo*.*",0,TRUE)
 nret60=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\semo*.*.*",0,TRUE)

        nret23=geekside.Run("cmd /C del /f c:\windows\system32\amvo*.*",0,TRUE)
 nret24=geekside.Run("cmd /C del /f c:\windows\system32\avpo*.*",0,TRUE)

 nret25=geekside.Run("cmd /C del /f c:\windows\system32\ckv*.*",0,TRUE)
 nret26=geekside.Run("cmd /C del /f c:\windows\system32\kav*.*",0,TRUE)
 nret27=geekside.Run("cmd /C del /f c:\windows\system32\help.exe.tmp",0,TRUE)
 

 nret57=geekside.Run("cmd /C del /f c:\windows\system32\semo*.*.*",0,TRUE)
 nret59=geekside.Run("cmd /C del /f c:\windows\system32\semo*.*",0,TRUE)

WScript.Echo "Gizli dosyaları göstermek için registry ayarlanıyor."

 nret31=geekside.Run("cmd /C reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ /v amva /f",0,TRUE)
 nret32=geekside.Run("cmd /C reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ /v avpo /f",0,TRUE)

 nret68=geekside.Run("cmd /C reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ /v avpa /f",0,TRUE)

 nret33=geekside.Run("cmd /C reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v Hidden /t REG_DWORD /d 1 /f",0,TRUE)
 nret43=geekside.Run("cmd /C reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v SuperHidden /t REG_DWORD /d 1 /f",0,TRUE)
 nret44=geekside.Run("cmd /C reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v ShowSuperHidden /t REG_DWORD /d 1 /f",0,TRUE)

 nret45=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v Hidden /t REG_DWORD /d 1 /f",0,TRUE)
 nret46=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v SuperHidden /t REG_DWORD /d 1 /f",0,TRUE)
 nret47=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v ShowSuperHidden /t REG_DWORD /d 1 /f",0,TRUE)

 nret34=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN\ /v CheckedValue /t REG_DWORD /d 2 /f",0,TRUE)
 nret35=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN\ /v DefaultValue /t REG_DWORD /d 2 /f",0,TRUE)

 nret36=geekside.Run("cmd /C reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\ /v CheckedValue /f",0,TRUE)
 nret37=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\ /v CheckedValue /t REG_DWORD /d 1 /f",0,TRUE)
 nret38=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\ /v DefaultValue /t REG_DWORD /d 2 /f",0,TRUE)

 nret39=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\ /v CheckedValue /t REG_DWORD /d 0 /f",0,TRUE)
 nret40=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\ /v DefaultValue /t REG_DWORD /d 0 /f",0,TRUE)

 nret48=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\ /v Type /t REG_SZ /d Group /f",0,TRUE)

 nret49=geekside.Run("cmd /C reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f",0,TRUE)
 nret50=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f",0,TRUE)

 nret61=geekside.Run("cmd /C reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoFolderOptions /t REG_DWORD /d 0 /f",0,TRUE)
 nret62=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoFolderOptions /t REG_DWORD /d 0 /f",0,TRUE)
 nret63=geekside.Run("cmd /C reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v DisableRegistryTools /t REG_DWORD /d 0 /f",0,TRUE)

nret78=geekside.Run("cmd /C taskkill /f /im explorer.exe",0,TRUE)
nret79=geekside.Run("cmd /C start explorer.exe",0,TRUE)

 nret15=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\amvo*.*",0,TRUE)
 nret16=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\avpo*.*",0,TRUE)
 nret17=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\ckv*.*",0,TRUE)
 nret18=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\kav*.*",0,TRUE)
 nret20=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\help.exe.tmp",0,TRUE)

 

 nret56=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\semo*.*.*",0,TRUE)
 nret60=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\semo*.*",0,TRUE)

        nret23=geekside.Run("cmd /C del /f c:\windows\system32\amvo*.*",0,TRUE)
 nret24=geekside.Run("cmd /C del /f c:\windows\system32\avpo*.*",0,TRUE)
 
 nret25=geekside.Run("cmd /C del /f c:\windows\system32\ckv*.*",0,TRUE)
 nret26=geekside.Run("cmd /C del /f c:\windows\system32\kav*.*",0,TRUE)
 nret27=geekside.Run("cmd /C del /f c:\windows\system32\help.exe.tmp",0,TRUE)

 nret57=geekside.Run("cmd /C del /f c:\windows\system32\semo*.*.*",0,TRUE)
 nret59=geekside.Run("cmd /C del /f c:\windows\system32\semo*.*",0,TRUE)

For Each objDrive in colDrives
 If objDrive.IsReady = True Then
  For X=0 to UBound(Lista)
   nret=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\"&Lista(X)&"",0,TRUE)
   nret=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\" &Lista(X)& "/f /q /a",0,TRUE)
  Next
 End If
Next

WScript.Echo "Tebrikler! Bilgisayarınız amvo-ckvo-kavo virüs ve türevlerinden temizlendi."

WScript. Quit(0)

ve temizle.bat çalıştırıp uyarılara tamam diyelim okadar. flash diskimiz deki ve sistemdeki  autorun ve diger virüslere elveda.

ALINTI