根据达人提供资源编写
【原创】UcHelp 病毒分析 By Cater  [url]http://bbs.pediy.com/showthread.php?t=45699[/url]
 
Kill-Uchelp.bat
-----------------------------------------------------------------------------
pskill -t explorer.exe
attrib -s -h c:\windows\system32\AceExt32.dll
attrib -s -h  "c:\windows\Downloaded Program Files\Ext32.dat"
attrib -s -h  "c:\windows\Downloaded Program Files\Ext32.dll"
attrib -s -h  "c:\windows\Downloaded Program Files\CxUSBKey.exe"
attrib -s -h  "c:\windows\Downloaded Program Files\ZipExt32.dll"
del "c:\windows\system32\AceExt32.dll"
del "c:\windows\Downloaded Program Files\Ext32.dat"
del "c:\windows\Downloaded Program Files\Ext32.dll"
del "c:\windows\Downloaded Program Files\CxUSBKey.exe"
del "c:\windows\Downloaded Program Files\ZipExt32.dll"
start explorer.exe
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
                  CurrentVersion\ShellServiceObjectDelayLoad /v ZipExt32 /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
                   CurrentVersion\ShellServiceObjectDelayLoad /v AceExt32 /f
reg delete HKEY_CLASSES_ROOT\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524140} /f
reg delete HKEY_CLASSES_ROOT\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524150} /f
 
 
说明：
1.附件需要分别改名为pskill.exe和pdh.dll
2.文中reg delete后无换行
3.移动设备中的Uchelp.exe可根据Cater写的文档进行手工删除
  （Step1：运用Attrib -s -h取消 RECYCLER下Uchelp.exe的隐藏和系统文件属性）
   （Step2：Del Uchelp.exe）
*在删除移动设备上的文件时，首先需要取消移动设备的AutoRun